last executing test programs: 3m54.908127087s ago: executing program 4 (id=35): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x7}}, './file0\x00'}) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "b8147c2c19f7b5b4", "88ea062d55789ec9a9f35306635138ec", "d09f49e2", "9a102fc2be25a689"}, 0x28) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'erspan0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="15460a00ef000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRESDEC=r1], 0x44}}, 0x4) 3m53.646661602s ago: executing program 4 (id=41): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = dup(r2) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000002c0)=ANY=[@ANYBLOB="820000000000000000010040"]) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000500)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r4 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x2, 0xbfdffffc, 0x0, r3}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000740)=ANY=[@ANYBLOB="9feb01001800000000000000d5000000d500000004000000060000000000000e010000000100000006000000000000110500000008000000080000000000000700000000070000000000dd3a3bef79a045907103337e00020500000008000000070000130400000004000000010000000100000003000000070000000500000005000000a50f0000000000000900000029000000018000000600000007000000af4d00000c000000070d000000000000000000000400000009000000090000000240010f010000000300000009000000f7a800000400000009000000df0b0000260200000000000012020000000c00000000000003b494d8da3d37aa9f68cd9a5b5fffd6f8b33b4ff4d6415457ca014f60374154498dd4e0fa12ce704eafaac0096441e2"], &(0x7f0000000640)=""/197, 0xf4, 0xc5, 0x1, 0x2020}, 0x28) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0x4, 0x5, &(0x7f0000000400)=ANY=[@ANYBLOB="660a00002000000061118c0000000000185300001000000000000000000000009500000000000000c1ee9e45dfcee148db3cbce6bc29f8d4ab33"], &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x41000, 0xb, '\x00', 0x0, 0x1b, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'vlan1\x00', 0x0}) setsockopt$packet_int(r8, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r8, &(0x7f0000000300)="3f030300031b12000000000789e9aaa911d7c2ff070088a800008100642cc7ddbd", 0x21, 0x0, &(0x7f00000000c0)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @random="ff9900000300"}, 0x14) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x5, &(0x7f0000000200)={0x77359400}, 0x1, 0x8}) io_uring_enter(r4, 0x47f6, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a00034002c3000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044884) 3m44.960936824s ago: executing program 4 (id=54): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x40000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000100)={{0x1, 0x0, 0x0, 0x3}}) (async, rerun: 32) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f00000000c0)) (async, rerun: 32) lsetxattr$system_posix_acl(&(0x7f0000000400)='.\x00', &(0x7f0000000440)='system.posix_acl_default\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000010000000000000002000000", @ANYRES32=0xee01, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0xee00, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="040000000000800008000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="100000000000000020"], 0x5c, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) getxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@known='system.posix_acl_default\x00', &(0x7f0000000480)=""/4096, 0x1000) 3m43.265333027s ago: executing program 4 (id=61): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x25dfdbff, {0xa, 0x0, 0x0, 0x80}, [@RTA_PREF={0x5, 0x1c, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_usb_connect(0x2, 0x62, &(0x7f0000000500)=ANY=[], 0x0) 3m37.944089155s ago: executing program 4 (id=76): r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x2, 0x1) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, 0x0) 3m37.814339056s ago: executing program 4 (id=78): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r3, 0x330f, 0x6) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000200)={&(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, r4}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b000100000001"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r7, 0xfffffffc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r10, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r12, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}}, 0x80) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0x2, 0x11}, 0x20) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_DEFER_SETUP(r13, 0x112, 0xf, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) 3m22.385967376s ago: executing program 32 (id=78): r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r3, 0x330f, 0x6) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000200)={&(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, r4}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b000100000001"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r7, 0xfffffffc) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r10, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r11, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r12, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}}, 0x80) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000000)={@mcast2={0xff, 0x5}, 0x200, 0x0, 0x2, 0x11}, 0x20) r13 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_DEFER_SETUP(r13, 0x112, 0xf, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) sendmmsg$inet(r0, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0x0) 13.586982296s ago: executing program 2 (id=534): r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r0, &(0x7f0000000600)={0x28, 0x2, 0x0, {0x3, 0xf35, 0x7}}, 0x28) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="a51dfd71fdca517dfcfe410b9a8f830f3a394a", @ANYRES16=r2, @ANYBLOB="01000000000001000000080000000c000280040005000400038018000180140002006970766c616e31000000000000000000"], 0x38}}, 0x0) 12.763208681s ago: executing program 2 (id=536): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x6, &(0x7f0000006680)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x6, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a857000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) rt_sigprocmask(0x2, &(0x7f0000000000)={[0x5]}, 0x0, 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1000}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, &(0x7f0000001080)='\x00', 0x0) request_key(&(0x7f00000010c0)='dns_resolver\x00', &(0x7f0000001100)={'syz', 0x2}, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) r5 = io_uring_setup(0xfc6, &(0x7f0000000180)) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000000b00)="86cf8445f4ba1d9f20174688f169e58c", 0x10) listen(0xffffffffffffffff, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) (async) close_range(r5, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x24fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100}, &(0x7f0000000100), &(0x7f0000000140)) (async) syz_io_uring_setup(0x24fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100}, &(0x7f0000000100), &(0x7f0000000140)) 11.514626135s ago: executing program 2 (id=540): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newtaction={0x124, 0x30, 0x1, 0x0, 0x0, {}, [{0x110, 0x1, [@m_ct={0xc4, 0x2, 0x0, 0x0, {{0x7}, {0x18, 0x2, 0x0, 0x1, [@TCA_CT_LABELS_MASK={0x14, 0x8, "f31147902f306cbebe8c5acab73d12fd"}]}, {0x88, 0x6, "e82cf020d670970975392b8adffef6a86de0d05eb0f0f26ef39f25aad261e9ff7c1b67888529812139c16f21501f3e2d0d0c0236f6de230da2442ffb42aa8fbc2bf95849e09eb4f87ba0b555b54ed7fb76bfe1e68151cb6a6e968c9bca3f10d1ba7415ccc368bb638decf92a5c586c55b5dda5e8851dbdadd9ba76bc961570e67ab0dab2"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0xa0}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x800}, 0x40010) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x141) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000300)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000100), 0x4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x30) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="f800000016008502000000000000000020010000000000000000000000000002a600000200"/56, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000"/15], 0xf8}}, 0x0) keyctl$clear(0x7, 0xfffffffffffffffb) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) lseek(r5, 0xfffffffc, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a32000000002c0003800800014000000000180003801400010076657468315f00005f626f6e64000000080002400000000064000000160a0101000b000000000000010000000900020073797a32000000000900010073797a3000000000300003802c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e640000000800074000000003"], 0x104}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000100)=0x10) recvmsg(r0, &(0x7f00000027c0)={0x0, 0x0, 0x0}, 0x100) sendmmsg$inet6(r0, &(0x7f0000003f00)=[{{0x0, 0xf, &(0x7f0000000300)=[{&(0x7f0000000140)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1c, 0x8, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x85}, 0x94) 11.490061902s ago: executing program 0 (id=541): bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$kcm(0x21, 0x2, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000fd0f000007"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r3}, 0x10) r4 = socket$nl_rdma(0x10, 0x3, 0x14) r5 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0xd, &(0x7f0000000080), 0x24) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000714010000000000000000000800", @ANYRES32=r6], 0x30}}, 0x94) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @any, 0x7ff}, 0xe) mmap(&(0x7f000046c000/0x3000)=nil, 0x3000, 0x1000000, 0x1010, r2, 0x53ef0000) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r7, 0x0, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000080200000000000000000000010500000180000000000000000100008502000000000000000100000000000004", @ANYRES8=r7], 0x0, 0x52}, 0x28) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x13, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8}, [@generic={0x6b, 0x1, 0x0, 0x38}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4d, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) 9.798190995s ago: executing program 2 (id=543): unshare(0x20040400) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r0, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x3}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x58, 0x58, 0x9, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x3, 0x4}}, @decl_tag={0x5, 0x0, 0x0, 0x11, 0x4, 0xa}, @union={0xe, 0x3, 0x0, 0x5, 0x0, 0x7, [{0xd, 0x2, 0x9}, {0x6, 0x3, 0x101}, {0x3, 0x0, 0x7}]}]}, {0x0, [0x0, 0x61, 0x61, 0x30, 0x61, 0x0, 0x30]}}, &(0x7f0000000280)=""/208, 0x79, 0xd0, 0x1, 0x7}, 0x28) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000003800010326bd7002fadbdf2502"], 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x4000014) syz_clone(0x20000, &(0x7f0000000380)="27a62b35330a971ad54890066391b9778e7acb28c9a8cbac681a5c34d640cc6a0758bd8287adf8c0e79776e997f02c11ae5fd77412e92662cab3c0b3098fe57fdfefb55584ac39cf6210c11eccfc0fb0030605cbae774919095c8838499b9426286fee6c704dd9e4fe9f15e9ee9fbe355bf4bec9fc175ec0c92d078cf068beff2eaea785654d64d733b836ea67bc1c2e76984794538868c27b08057e6a56ee8a025c18d36f622c9db1f001897c667a0bef29bcbbabaef0e0cca4a65775e1f7b02dc7fcb320dbd15187cd053f48cc693aed983f9822c7ffbc769ec44a662fcee3a4e6ff153c56966cd696e3861e69088f51aea8f1", 0xf4, &(0x7f0000000200), &(0x7f0000000480), &(0x7f00000004c0)="67f9113b7e01948e7e560ac63f5fdbd371ed7bee0ae68900edabea284e55c1459557f7dd0865c9f5284ace81a3a982580b37ed5ce4e98a1506a59dcfde203466ca064c0dd9e522fc674fbbecdae4f7a6c59b2fd5e408ed32a6a034a38ee4e341196f7ddf85aace963905a3ed6b784ac534088773fec6add7f113722df5ed4548a65185d636ec3d9c850a025a3af6d1750e9455430bf0ca7f09cfb989e96567c95bb37d69e36e6d1b5b80a4064f2bf9a2c4306f4b4d5ec807883322d5f8c2bba3bc8e0f1345e2f3482d3c3fc2b92365eb3c3aec27f14a402db0cb11f5a1de7f80db828136d984e87daebbb2e3a32b7c1a403c9fa80977b763eeb5a610eb14e6") syz_usb_connect(0x2, 0x3d, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x5f, 0xfc, 0x70, 0x20, 0x711, 0x210, 0xfdd6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8b, 0x0, 0x2, 0xbe, 0x44, 0x8f, 0xff, [], [{{0x9, 0x5, 0x80, 0x2, 0x3ff, 0x9, 0xf, 0x5, [@generic={0x7, 0x5, "bdf74e3781"}]}}, {{0x9, 0x5, 0x8b, 0x3, 0x40, 0xe, 0x4b, 0x2}}]}}]}}]}}, 0x0) 8.816158247s ago: executing program 1 (id=545): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f0000000080), 0x8) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000180)={'pcl818\x00', [0x4f27, 0x5, 0x3, 0x4, 0x5, 0xcc9, 0xf, 0x7, 0xa, 0x0, 0xefb, 0x4, 0x6, 0x1, 0x6, 0x101, 0x1000, 0x1a449, 0x3, 0x40000007, 0x99, 0xcaa7, 0x4, 0x20001e58, 0x4, 0xe69, 0x3c, 0x8, 0x2, 0x0, 0xfffffff8]}) 8.426523244s ago: executing program 1 (id=547): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x0, @local, 0x47}, 0x80, 0x0}, 0x240428f8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8b19, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) socket(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x7c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x4c, 0x2, [@TCA_BASIC_EMATCHES={0x48, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x3c, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{}, {0x0, 0x0, 0x1}}}, @TCF_EM_META={0x28, 0x2, 0x0, 0x0, {{0x0, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc}, @TCA_EM_META_RVALUE={0x6, 0x3, [@TCF_META_TYPE_VAR="043f"]}, @TCA_EM_META_LVALUE={0x5, 0x2, [@TCF_META_TYPE_VAR='3']}]}}]}]}]}}]}, 0x7c}}, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="640000000206010200000000000000000000000015000300686173683a69702c706f72742c6e6574000000000900020073797a32000000000500040000000000140007800800124000000000050015002200000005000500020000000500010006"], 0x64}}, 0x0) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x34, 0x4, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0xc011}, 0x800) sendto$inet6(r1, &(0x7f0000000100)="b8", 0x1, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @local, 0xffffffff}, 0x1c) (async) sendto$inet6(r1, &(0x7f0000000100)="b8", 0x1, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @local, 0xffffffff}, 0x1c) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 7.468778992s ago: executing program 3 (id=548): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="2072dc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x28, 0xe, 0x6, 0x101, 0x0, 0x0, {0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000800}, 0x840) (async) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @local, @void, {@ipv6={0x86dd, @generic={0xb, 0x6, "d697da", 0x8, 0x2c, 0x80, @loopback, @dev={0xfe, 0x80, '\x00', 0x16}, {[@dstopts={0x88}]}}}}}, 0x0) (async) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000002580)={&(0x7f0000000180)=[{0xd0, 0x1801, 0x0, 0x0}], 0x1}) 6.444999536s ago: executing program 5 (id=551): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000000004002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20020008008f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000008c0), r4) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r4, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="37bf6a1e07da8509430005"], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000100)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000013000/0x4000)=nil, 0x3000, 0x3}) r8 = syz_io_uring_setup(0xa0, &(0x7f0000000100)={0x0, 0x89b8, 0x800, 0x0, 0x243}, &(0x7f0000000080)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) r11 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r11, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x7, 0x0, 0x20000000, 0x8, 0x6, 0x900, 0x401}}) setsockopt$inet6_int(r11, 0x29, 0xa, &(0x7f0000000040)=0x9, 0x4) 6.23052502s ago: executing program 0 (id=552): socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x28, 0x11, 0x0, 0x401, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x31, 0x0, 0x0, @binary="748cf8e8"}]}]}, 0x28}}, 0x0) (async) sendmsg$nl_netfilter(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x28, 0x11, 0x0, 0x401, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @uid=0xffffffffffffffff}, @nested={0xc, 0x0, 0x0, 0x1, [@typed={0x8, 0x31, 0x0, 0x0, @binary="748cf8e8"}]}]}, 0x28}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x2c, r2, 0x1, 0x70bd2b, 0x0, {0x1a}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRESDEC], 0xbb8}, 0x1, 0x0, 0x0, 0x2000}, 0x4004040) (async) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRESDEC], 0xbb8}, 0x1, 0x0, 0x0, 0x2000}, 0x4004040) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) (async) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) socket$inet_icmp(0x2, 0x2, 0x1) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBTYPE(r4, 0x4b33, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r5 = getpid() syz_pidfd_open(r5, 0x0) (async) syz_pidfd_open(r5, 0x0) prlimit64(0xffffffffffffffff, 0x4, 0x0, 0x0) (async) prlimit64(0xffffffffffffffff, 0x4, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, 0x0) chdir(&(0x7f0000000080)='./file1\x00') syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) faccessat2(0xffffffffffffffff, 0x0, 0xb1, 0x700) setpgid(r6, 0x0) setpgid(0x0, r6) (async) setpgid(0x0, r6) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x200000, &(0x7f0000000500)=ANY=[]) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) 5.270460886s ago: executing program 5 (id=553): bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffdb, 0x0, 0x0, 0x0, 0x7fb}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x65, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 5.125746667s ago: executing program 2 (id=554): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="280500003d0007010000000000000000017c0000040000000c0003"], 0x528}}, 0xc000) socket$vsock_stream(0x28, 0x1, 0x0) (async) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0xffffffff, 0xffdffffe}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x47f4, 0x0, 0x0, 0x0, 0x0) 5.037724519s ago: executing program 3 (id=555): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x24, &(0x7f0000000080)=0x1, 0x4) shutdown(r0, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB, @ANYRES8], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r1}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x20040600) connect$inet(0xffffffffffffffff, 0x0, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x8045fd8577289ab2, 0xffffffffffffffff, 0x0) setitimer(0x1, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x100, 0x0) syslog(0x4, &(0x7f0000000140)=""/179, 0xb3) openat$incfs(0xffffffffffffffff, &(0x7f0000000040)='.log\x00', 0x0, 0x20) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x350, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'lo\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@common=@icmp6={{0x28}, {0xe, "77c8"}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3b0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 4.966675787s ago: executing program 0 (id=556): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r0, 0x4008f50a, &(0x7f0000000080)={0x6, 0x1}) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TRIM(r1, &(0x7f0000003480)={0x0, 0x0, &(0x7f0000003440)={&(0x7f0000003400)={0x10, 0x3f6, 0x8, 0x70bd25, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x24000004}, 0x8044) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) read$alg(r2, &(0x7f0000000100)=""/246, 0xf6) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000a40)={@fallback=r3, r3, 0x2f}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r7, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r8 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r8, 0x8914, &(0x7f0000000000)) r9 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r9, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00', 0xffffffff}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000400)={0x0, 0x0, {0x3, 0x0, 0x0, 0x2, 0xffffffff}, 0xc}) 4.943995903s ago: executing program 5 (id=557): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x68, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100005938d74010973077339600000001090212000100001e000904"], 0x0) 4.655615842s ago: executing program 1 (id=558): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x200008c0) (async) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) (async) r5 = dup(r3) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000140)='ip6gretap0\x00', 0x10) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000003c0)='7', 0x1}], 0x1) (async) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="2800000100"/20, @ANYRES32=0x0, @ANYBLOB="3a8904000a00000008001b0000000000"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) (async) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x5, @empty, 0xb055}}, 0x4, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x1000, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) r9 = syz_io_uring_setup(0xfa, &(0x7f00000003c0)={0x0, 0x0, 0x10100}, &(0x7f00000000c0), &(0x7f0000000100)) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r9, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4000, @fd_index=0x6, 0x4, 0x0, 0x0, 0x4, 0x1, {0x2, r10}}) (async) r11 = openat$comedi(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$COMEDI_CHANINFO(r11, 0x80306403, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000), 0x0}) (async) epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) epoll_create1(0x0) 3.710034871s ago: executing program 0 (id=559): r0 = syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000005c0)='mm_page_free_batched\x00', r4, 0x0, 0x1}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r7, 0xc008ae88, &(0x7f00000000c0)={0x1, 0x0, [{0xc0010055, 0x0, 0x200000000000e}]}) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0xe4, 0x0) read$msr(r8, &(0x7f0000002000)=""/102400, 0x19000) syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x5885, 0x0, 0x0, 0x37f}, &(0x7f0000000340)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 3.709203091s ago: executing program 2 (id=560): mkdir(0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec85"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={0x0, r1}, 0x18) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, 0x0, 0x82002, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x15, 0x5, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read(r3, &(0x7f0000000040)=""/148, 0xffffff96) syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xc, {"a2e3ad214fc752f91b231a0987f70e06d038e7ff7fc6e5539b3272078b089b3b08384b090890e0878f0e1ac6e7049b3350959b669a240d5b67f3988f7ef3195201c0ffe8d17870000000001b1b5d500f0d30090936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb199f6b76383709d8f5c55432a909fda039aec54a1238580f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82999ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad0f765cf60bd0ba2f3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b599d0efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x98) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001080)="d800000018008103e00312ba0d8105040a600300ff0f040b067c55a1bc000900b80006990700000015000500fef32702d3001500030001400200000994007100a007a290457f0155e65f7b7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04000000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad809d5e1cace81ed0b66bce0b42a9ecbee5de6ccd40dd6e4edef3d93452a92307f00000e970300"/208, 0xd0}], 0x1}, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) r5 = syz_open_dev$midi(&(0x7f0000000040), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000000580)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000b00)={&(0x7f0000000540)='afs_get_tree\x00', r0}, 0x10) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', &(0x7f0000002880), 0x0, &(0x7f0000000000)={[{@dyn}]}) r6 = syz_usb_connect(0x3, 0x36, 0x0, 0x0) syz_usb_ep_write$ath9k_ep2(r6, 0x83, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="bcea"]) syz_usb_ep_write$ath9k_ep1(r6, 0x82, 0x32c, &(0x7f0000000200)={[{0xa1, 0x4e00, "8dc28ddc5c17390f2715616aa38d23c1e2a5a4de231387b9eee225461311f6813fbbca3b09b4629e4b5a4b1f557b30fc060fd6aaae623eeee36d7d59dbcbc19920b85f49edb00684bbb94d64bcdc6ec4ee5cf18a9c741ade98fc7e834a7fcd6c634a87c352a0636b93aa3840b22b34784988a2c28d12f11cf187effd8f18d018e45cee2035f60c6d0c158faed7f7653cb448dc0453e9822f38748d5f4b00c2077e"}, {0x3, 0x4e00, 'rL?'}, {0x91, 0x4e00, "f2149ec8a67472b0d128891baaac1a42dcc4bad31078e04dafa3f65c240ed30d384ea70afc60d30ffeddc93ef159416b5651fe2bf5471df97ac044b918e6f8616224449e2c976356e47c015d5409837876cb1d471c0f6725d88f57e7415708ad03552f237ccbb02a8fcb864437a4bb9d5293499519869e611df957e0ef69e2b778bebfe718270dcb4efc93bbca1c3af83f"}, {0x3b, 0x4e00, "21a152f5dc10829c4a2ac8ae344dde6ab1fbf51eb3a98116ef4d430384acc4cbe2b946f759e479eb830c42f3c2726b61fff22d7938c5fd6042a033"}, {0xf1, 0x4e00, "8a3cb764ae7eecf47e5fc7a8b380d0ff377cf8100ddf196436306721d66e04e9075adcd132aa2d4969cb2873185e0e5207550e86ec03964eac75ae6cae8f1e10509b7459f8d2f839f6aa4445d9495b06e8cad50c5688a7ba1f303365726c914595fb79a79cbef4b5e737de1b6ad1bb61b32cbf1b8ee29b032260eba2a5b112b53d4cfd4aca929f57fe66f5095a1df103d6f351b8506042cb73d17a23916d6d0224e35e75e039ce537f08c278f8ca59a9ce945252acd16bc4459ca37da5c15462922599459eba22865be7fe084ee10edb3b41a4b8083ff41386516e5eaa55c6c81172bf855389b7ac8f05984ffe745965ee"}, {0x51, 0x4e00, "eea39ceb9c37088c723cfb251808857c588031e94373ceb1c3e1ec8ee010e0b7e760b48dc29e2dc2069797ed4e581247baa92e9779ae24e06ea59227514ec4374a9521061ed306404252b05a8cd652d4db"}, {0x50, 0x4e00, "4e1e12ff1611d74139565003c7a8d2415b9bfc84bc3662cad04b0378e2a6253be496da55263fd37e8221f46cf3dee45106d0ba3a21604ba24649c1ff2d82230de29e756fa0bf3697c6b07ee4c16ffa9b"}]}) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f00000011c0)=@ethtool_ts_info}) syz_open_dev$evdev(&(0x7f0000001040), 0x1000, 0x80) 3.662137385s ago: executing program 3 (id=561): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000600)) lseek(r0, 0x7ff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16, @ANYBLOB="ff830500000700ffffff"], 0x4}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) 3.5253891s ago: executing program 1 (id=562): r0 = socket$nl_generic(0x10, 0x3, 0x10) futex_waitv(&(0x7f0000001840)=[{0x1, &(0x7f0000000000)=0x1, 0x82}, {0x8, &(0x7f0000000040)=0x27, 0x82}, {0x10, &(0x7f0000000080)=0x10000, 0x2}, {0x0, &(0x7f0000000140)=0x837, 0x2}, {0x277c, &(0x7f0000000180)=0x8, 0x2}, {0x9e, &(0x7f00000001c0)=0x8, 0x82}, {0x400, &(0x7f0000000200)=0x2, 0x2}, {0x7, &(0x7f00000002c0)=0x1, 0x82}, {0x2, &(0x7f0000000300)=0x7fffffffffffffff, 0x2}, {0x3, &(0x7f0000000340)=0x7, 0x2}, {0xbb, &(0x7f0000000380)=0x1, 0x82}, {0x8b, &(0x7f00000003c0)=0x7, 0x82}, {0xb264, &(0x7f0000000400)=0x3, 0x2}, {0x15, &(0x7f0000000440)=0xb1c, 0x2}, {0x8, &(0x7f0000000480)=0x5, 0x82}, {0x401, &(0x7f00000004c0)=0x6, 0x82}, {0x3, &(0x7f0000000500)=0x5, 0x2}, {0x3, &(0x7f0000000540)=0x1, 0x2}, {0x40, &(0x7f0000000580)=0xf1f, 0x82}, {0x9, &(0x7f00000005c0)=0x4c, 0x80}, {0x2, &(0x7f0000000600)=0x80000000, 0x2}, {0xf, &(0x7f0000000680)=0xe, 0x82}, {0x4, &(0x7f00000006c0)=0x7, 0x82}, {0x2, &(0x7f0000000700)=0x3, 0x2}, {0x7, &(0x7f0000000740)=0x8}, {0x9, &(0x7f0000000780)=0x8, 0x82}, {0x5, &(0x7f00000007c0)=0x35, 0x82}, {0x3, &(0x7f0000000800)=0x4, 0x82}, {0x8, &(0x7f0000000840)=0x4, 0x2}, {0x6, &(0x7f0000000880)=0x8, 0x82}, {0x1, &(0x7f00000008c0)=0x3fb0, 0x2}, {0x1, &(0x7f0000000900)=0x5, 0x82}, {0x8, &(0x7f0000000940)=0x6, 0x2}, {0x8001, &(0x7f0000000980)=0xf473, 0x82}, {0x9, &(0x7f00000009c0)=0x4, 0x82}, {0x6, &(0x7f0000000a00)=0x23cf, 0x2}, {0xd9, &(0x7f0000000a40)=0x9, 0x82}, {0x7, &(0x7f0000000a80)=0xb1, 0x82}, {0x1d14, &(0x7f0000000ac0)=0xffffffffffffffff, 0x82}, {0x2, &(0x7f0000000b00)=0x5, 0x2}, {0x9, &(0x7f0000000b40)=0x6, 0x2}, {0x6, &(0x7f0000000b80)=0x480000000, 0x2}, {0x2, &(0x7f0000000bc0)=0xffffffffffff0001, 0x82}, {0x90, &(0x7f0000000c00)=0x10001, 0x2}, {0x9, &(0x7f0000000c40)=0xbb51, 0x2}, {0x1, &(0x7f0000000c80)=0x12e, 0x2}, {0x9e, &(0x7f0000000cc0)=0x8, 0x82}, {0x2a, &(0x7f0000000d00)=0x2, 0x82}, {0x517, &(0x7f0000000d40)=0xce2, 0x82}, {0x3, &(0x7f0000000d80)=0xb, 0x2}, {0x9, &(0x7f0000000dc0)=0x7, 0x82}, {0x4, &(0x7f0000000e00)=0xd, 0x82}, {0x9, &(0x7f0000000e40)=0x81, 0x2}, {0x3, &(0x7f0000000e80)=0x4, 0x2}, {0x7, &(0x7f0000000ec0)=0xf, 0x82}, {0x3, &(0x7f0000000f00), 0x82}, {0x80000000, &(0x7f0000000f40)=0xffffffffffff5eef, 0x2}, {0x2, &(0x7f0000000f80)=0x29d, 0x82}, {0x4, &(0x7f0000000fc0)=0x4, 0x2}, {0x6, &(0x7f0000001000)=0x7, 0x2}, {0x1200000, &(0x7f0000001040)=0x5, 0x80}, {0x7, &(0x7f0000001080)=0xb, 0x2}, {0xfffffffffffffffc, &(0x7f00000010c0)=0x5, 0x2}, {0x6, &(0x7f0000001100)=0x8, 0x2}, {0x1, &(0x7f0000001140), 0x2}, {0x2, &(0x7f0000001180)=0x8, 0x82}, {0xc, &(0x7f00000011c0)=0x400, 0x82}, {0x8000000000000001, &(0x7f0000001200)=0x6477, 0x2}, {0x80000000, &(0x7f0000001240)=0xffffffffffff0000, 0x2}, {0xffffffffffffff00, &(0x7f0000001280)=0xf}, {0x1, &(0x7f00000012c0)=0xac85, 0x2}, {0x6, &(0x7f0000001300), 0x2}, {0x9, &(0x7f0000001340)=0x2, 0x82}, {0x1ff, &(0x7f0000001380)=0x100000000, 0x82}, {0x2, &(0x7f00000013c0)=0x5, 0x82}, {0x5, &(0x7f0000001400)=0x2, 0x2}, {0x0, &(0x7f0000001440)=0xc, 0x82}, {0x1, &(0x7f0000001480)=0x7, 0x2}, {0x80000000, &(0x7f00000014c0)=0x5, 0x2}, {0x3, &(0x7f0000001500)=0x4, 0x2}, {0x3, &(0x7f0000001540)=0x5, 0x2}, {0xd6e6, &(0x7f0000001580)=0x5e6a9230, 0x82}, {0x3, &(0x7f00000015c0)=0x7ff, 0x2}, {0x80, &(0x7f0000001600)=0xc26a, 0x82}, {0x3, &(0x7f0000001640)=0x9e8, 0x186}, {0x8, &(0x7f0000001680)=0x100, 0x2}, {0x47, &(0x7f00000016c0)=0x2, 0x2}, {0x29240000000000, &(0x7f0000001700)=0x7, 0x82}, {0x9, &(0x7f0000001740)=0x8, 0x2}, {0x7, &(0x7f0000001780), 0x2}, {0x101, &(0x7f00000017c0)=0x10000, 0x82}, {0x0, &(0x7f0000001800)=0x7f, 0x2}], 0x5c, 0x0, &(0x7f0000002100)={0x0, 0x3938700}, 0x1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)={0x34, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_TX_RATES={0x18, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0x1}]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x16]}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000801}, 0x8800) 2.690990638s ago: executing program 1 (id=563): r0 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r0, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast1, 0xfffffffd}, 0x1c) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) read$alg(r2, &(0x7f0000001400)=""/18, 0x12) 2.395401559s ago: executing program 3 (id=564): r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_open_dev$vcsn(&(0x7f0000000180), 0x0, 0x1) ioctl$SIOCSIFHWADDR(r2, 0x8924, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000540)={0xffffeffe, 0x1, 0x2}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000000)={0x1f, 0x1, 0x4}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x772f0000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYRES8=r2, @ANYBLOB="0017abc6c99bb6a06c2775f4843fd911621817b0bbc9b83b961a684548acfa22f1a962727bf23620785ffe2217ac266c931fbca7a13ee0b022d4b1a788710744da9dc23a6d678474ffe7f4755d35027a5a792e4f30868a597bdf68a5e0dd322838259b28cab9be84a695a5222671c2f4ab9dc5b049500fa6ef5fb7464937e82b968fea0b8b3448ff437f3e0e2cc37f662d6c86c0a3b38e0faac95cbf0b912416253d6f755c03fc01baca31319fab1686e5d625f9abc9639a3724b1", @ANYRES8=r4, @ANYRES8, @ANYRESOCT=r3, @ANYRESDEC=r0, @ANYRESOCT=r4, @ANYRESDEC=r0, @ANYRES32=r4], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d480e8b089b3f350068090890e0878f0e1ac6e7049b336d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d076d0936cd3b78130daa61d8e8040000005802b77f07227227b7fa67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e9871540000000000004ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e4843e2808d4743b95bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c6f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20e8911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab9d6203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edcad74b221cfec48000000000000000d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea50000000000000068987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c10900df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d8008d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c46bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78bb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bf340b17cfcfd9c52c9711937f79abb1a124f121fc65483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4f01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8650000878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95a498b562d71565f924779ca1f731b3346ff177050373d79ff7bc1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f79a598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015a08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b686081b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24ae918423922e4e0167584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f13a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307f561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe40}}, 0x1047) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="300000001214000429bd7000fbdbdf2508000384df0cd69432f5fa00000000bbbef6dc0001000000080001000100000008004f00000000000886ba0013000000"], 0x30}, 0x1, 0x0, 0x0, 0x14}, 0x24008000) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) write$sysctl(r6, &(0x7f0000000180)='4\x00', 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2000000"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r7}, 0x18) prctl$PR_SET_NO_NEW_PRIVS(0x34, 0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r2, 0xc01864c6, &(0x7f0000000840)={&(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8], 0x9}) 2.205477661s ago: executing program 5 (id=565): r0 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) (async) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) (async) mount$9p_rdma(&(0x7f00000004c0), &(0x7f0000000500)='./file0\x00', &(0x7f0000000540), 0x200000, &(0x7f00000007c0)=ANY=[@ANYBLOB="7472616e733d72646d612c7b0672743d3078303030303030303030303030346532322c73713d3078303030303030303030303030303030312c72713d3078303030303030303030303030373032362c007e74d553b096d9df1969c49cd3d788bc7fbdb976eae5a70aededca48ec21cde78787b8e946986def1a670c3daf50c2"]) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x0, @local}, 0x2}}, 0x26) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f000000100100000058000b480400945f6400940005003892b025000000800000008004000000ff01090000e7fef5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) (async) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/asound/seq/clients\x00', 0x0, 0x0) (async) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000480)='net/ip_tables_names\x00') ioctl$VIDIOC_TRY_EXT_CTRLS(r5, 0xc0205649, &(0x7f0000000680)={0x9f0000, 0x6, 0x5, r6, 0x0, &(0x7f0000000640)={0x990a97, 0x2, '\x00', @ptr=0x7}}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r4) r7 = syz_open_dev$vbi(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_S_OUTPUT(r7, 0xc004562f, &(0x7f00000000c0)=0x1) (async) ioctl$VIDIOC_S_DV_TIMINGS(r7, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x12, 0x7c5, 0x1, 0x3, 0xd59f80, 0x0, 0x5, 0x7, 0x8, 0x5, 0x722, 0x100e72, 0xb530, 0xc, 0x2e, 0x8, {0xffff945a, 0x1}, 0x0, 0xed}}) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=ANY=[@ANYBLOB="3c000075a46fc67ac7fcacfb", @ANYRES16=r3, @ANYBLOB="01002cbd70000400000005000000080009000200000008000c00a80a00000500130009000000060001000700000008000b0000000000", @ANYBLOB="7cb9316ab6383c9023e5d4c73e04ef8942ad99403d4be8402dc783d528402066e18bf4d6c0c95f663b35e5b3d56de67338830647b369d7ad68e037b262e7ec90a8f75d0cbd5dab25b67b9ec1ba932e0f9dc6dd93005e0cf737bc2aaca844bc71c0a0b84dc0fbb321a12900a6cf698c7976e928a96fb95773614c16ee8004051518c444d1ac2f7c", @ANYRES16=r6, @ANYRESOCT, @ANYRES8=r5, @ANYRES8=r8], 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x20) (async) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1b) ioctl$KVM_CAP_X2APIC_API(r9, 0x4068aea3, &(0x7f0000000000)={0x81, 0x0, 0x2}) (async) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f0000000080)=[{{}, {0x80000000}}]}) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r12, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0xd000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0xc, 0xe, &(0x7f0000001080)=ANY=[@ANYRESOCT=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffefc}, 0x94) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x3) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r12, 0x8040942d, &(0x7f0000000140)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r13, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f00000000c0)="de6a84400f005f00440f20c0350a000000440f22c0c442c9a73b33aa00400000460f00d40f01df0f20d835080000000f22d80f0164120066b804000f00d8", 0x3e}], 0x1, 0x63, &(0x7f0000000240)=[@cr4={0x1, 0x2509e0}], 0x1) (async) ioctl$KVM_RUN(r13, 0xae80, 0x0) (async) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000300)={r10, &(0x7f0000000340), &(0x7f0000000400)}) 1.890652304s ago: executing program 1 (id=566): r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socket$vsock_stream(0x28, 0x1, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) inotify_init() unshare(0x20000400) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x14}, 0x14}}, 0x8081) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) writev(r5, &(0x7f00000002c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e9232f2b8db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052343f", 0x35}, {&(0x7f0000000200)="c67f0d7df9", 0x28}], 0x2) pselect6(0x40, &(0x7f0000000580)={0x0, 0x0, 0x5, 0xfffffffffffffffd}, 0x0, &(0x7f0000000540)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x2100000002, 0x7fffffff}, 0x0, 0x0) connect$bt_rfcomm(r2, &(0x7f00000001c0)={0x1f, @any, 0xb}, 0xa) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000000c0)={'comedi_parport\x00', [0x4f27, 0x2, 0x10000, 0x4, 0x3, 0xcc4, 0x4, 0x8000a, 0xe, 0x6, 0x6, 0x0, 0x1, 0x10000, 0x6, 0x10000105, 0x0, 0x1a44d, 0x3, 0x3fff7fff, 0x89, 0x10, 0xc1b, 0x20001e59, 0x1, 0xe69, 0x3c, 0x3, 0x6, 0x0, 0xfffffff8]}) ioctl$VIDIOC_SUBDEV_G_EDID(r0, 0xc0285628, &(0x7f0000002100)={0x0, 0x401, 0x70701eb4, '\x00', 0x0}) 695.137724ms ago: executing program 5 (id=567): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$binfmt_register(r0, &(0x7f0000000200)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0x8, 0x3a, '#%\\h*@#Lw\x9e5\x9f6k\x886\xafm\xa0\b\x81\xdc\xd1\x8f\x93r2\x0eeu}\xf7\"\xbd&-~\xeahJ\xee\'X\x9a\xd4\xfeI6\xd9\x1b\xc8\x14.\xfa\xb8\x03\x16\x96\x11\xa8\x90{\xc5\xe2\xf1u\xd1\xca\x8a>\xc3\x84\xd3\xcf\xa7\x1f\xc1\xb5\x12\xd0\x1e\x98\xce+\x12\xaex{\x91\xc7bw\xcaC\xe1/\x19\xfei\xf0\xa2\x9c3\xee/\xcf\xdew \x1c\xc7=\xfb\xb8\x88\x132\xf9\xbf7K\x8d\x16\xa6\xbf4\v\xces\xa4\x13\xb1\x14\x89\xa0\x14P\x97\x81%)\xa1\x0e)2a2\xa2\xef\f\xef\x8a\x95\xdd\xac\xab\xff#T}`\x88r\xb3\xd8\x19\x06\xde\xb7\xf0GR.?i|\xafhs\x1d\xdc\x12\x85!\xaaqg\x10\xec\x1b\xcb\xfc6\xba\xde\x13\xdf\xc6Z+\r\xb4\x9a\xe8V1\x82\xce\xdd\xddx\xe7H\xa3N\x92\xdb\xaa\xdbe\xc1\x05P\b<\x1e\xd6\x92\x89\xaa\xbe\xda\\|\xcf\xaf$.\x10\x8d\x9aie\xd3W\x1e\xd2L\xfa\xcc\xfb\xc2\x90\x99\xa9\x9f\xcd\xfasX\x9d\xbb\x8f\x1a\xdd\x05\xdc\xb8\xff\xb4v\x1f\xe3\xb6)\x1dM\x1e\xf9\x97\xffLW\x82\t\xf7\xb4\xe2fP\b\n\xdd\x03\x9d&\xd2\xce0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r6, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r8 = socket(0xa, 0x3, 0x3a) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0xff7d) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r9], 0x54}}, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async, rerun: 32) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async, rerun: 32) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[], 0x20}}, 0x8080) getsockname$packet(r5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0xa) 471.551514ms ago: executing program 3 (id=568): mkdir(&(0x7f0000000400)='./file0\x00', 0x101) r0 = socket$netlink(0x10, 0x3, 0xa) write(r0, &(0x7f0000000040)="707f542387ca1c26119cf8d086a8b5b62efdd67f92f7882864f21ee803550f4ce0180afb", 0x24) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000181100"/20, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000208500000004"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8ffffffb702000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r4}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000080)='9p_client_res\x00', r3}, 0x10) r5 = dup(r2) io_uring_register$IORING_REGISTER_RESTRICTIONS(r5, 0xb, &(0x7f0000000240)=[@ioring_restriction_sqe_flags_allowed={0x2, 0xd}, @ioring_restriction_sqe_flags_required={0x3, 0x13}, @ioring_restriction_register_op={0x0, 0x7}], 0x3) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="7451616e733566642c7266646e6f3dbaaa2226697f023f5a80afeca3863699374595a36f9f2c83678944667f68caeafa3b9a88389a3b90c15c9fc3f9cf22b7c57d1552d895076cbd0184bd8d0a1ac4fbaf3940a8dc51798eda5f7441745b1741f5ee3be7aa876fac21696f02eeaeacc1cc885c4ec119397850a5840a3d9df33d33996113edf71ed81a8dae8c208dc3f2a2ee24d019", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r5, @ANYBLOB=',loose,dfltuid=', @ANYRESHEX=0x0, @ANYBLOB=',cache=readahead,dfltuid=', @ANYRESHEX, @ANYBLOB=',k']) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000040), 0xfea7) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000003e040000000000003f00000000000000b604000001ed0a002500000017ffffffcc040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9e104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f1300010000949b3aab06b1e042ff2164d80c8ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1e0600bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee6330000000000000000000000000000000000004000000000000000038600008fb854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8265e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb66701f4578ba4cb9b706e605a88c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f6a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cf026657a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2cccb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400090300000021911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a8f01bc4b73cc31df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21c24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a3c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d68000000000099347593f67da85d1c962bfb320d1553a74ec3bf003ba62b1784dbf0168a7e85f28b77bdebce96bf386a6dd5df162a16f2b7e8a4de0ffc464a87f91f81866d2ef0af71ebb07a739c3cb1b7000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) ioctl$CEC_ADAP_G_CAPS(r6, 0xc04c6100, &(0x7f0000000140)) r8 = semget$private(0x0, 0x4000000009, 0x120) semop(r8, &(0x7f00000002c0)=[{0x0, 0xff}, {0x0, 0x1f}, {0x4, 0x202}, {0x0, 0x8, 0x1000}, {0x0, 0xfff}], 0x26) semctl$GETNCNT(r8, 0x0, 0xe, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r7, 0xffffffffffffffff, 0xc, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0xe0f, 0x0, 0x1}}, 0x40) 228.890114ms ago: executing program 0 (id=569): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1bd}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 130.733109ms ago: executing program 5 (id=570): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002536702500000000690000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000040)='percpu_alloc_percpu\x00', r0}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x8, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x20, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x9}, [@ldst={0x1, 0x3, 0x3, 0x0, 0x1, 0xc}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000280)='sched_switch\x00', r2}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="090000000800000004000000094000000a000000", @ANYRES32, @ANYBLOB="0000000000000800000000107c3000c18e98bc00c3498e9f30feec383ea7fb80db779368", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) 65.499326ms ago: executing program 3 (id=571): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='sched\x00') exit(0x1ff) (async) exit(0x1ff) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r2, 0x10e, 0x8, &(0x7f00000001c0)=""/42, &(0x7f0000000280)=0x2a) ioctl$SNAPSHOT_UNFREEZE(r1, 0x3302) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280), 0x13f}}, 0x20) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000280)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000000100)={0x15, 0x110, 0xfa00, {r4, 0x0, 0x0, 0x10, 0x0, @in={0x3, 0x0, @empty}, @in={0x2, 0x4e23, @multicast2}}}, 0x118) syz_usb_connect(0x3, 0x13e, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x92, 0x91, 0x82, 0x40, 0x6f8, 0x300c, 0x3964, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12c, 0x1, 0x0, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0x49, 0x0, 0x0, 0xe, 0x1, 0x0, 0x0, [@cdc_ncm={{0x8, 0x24, 0x6, 0x0, 0x1, 'icf'}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x7, 0x1ff, 0x7f, 0xd}, {0x6, 0x24, 0x1a, 0x401, 0x24}, [@mdlm_detail={0xe5, 0x24, 0x13, 0x4, "df8718dae13ad1c852d1dd9230d55590cfa934901a8433fa3144e068e94e97dcb330e7b369b37b15f300ab15ce75db13dece601a7b70d31c544afde316b19fb29692d52ffdfda5bc56dd7ff38643f9d3486d3e25b66ff7ac506a6c5fda9c38f416315a06e05780fbace8101fbb954ce81e5006a3d163a79e61d5ed939d7f63f1f176d50ee4a615f8278e2e667ef3914c559a98e5bf7d6d91bc148071cf77d28a78b85abe496d1594e241bff71ecb4c4989b5bbd838f3e37f1ac7796a1335da28001e1a7d84db6a6697ffc1300cf373f0d2ae4bf1564659b5d821056b491c1b3dff"}, @dmm={0x7, 0x24, 0x14, 0x7fb, 0x101}, @country_functional={0xa, 0x24, 0x7, 0x3, 0x8001, [0x6, 0x80]}, @acm={0x4, 0x24, 0x2, 0x8}]}]}}]}}]}}, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r1, 0x40309439, &(0x7f0000000240)={0x2, 0x0, 0x9}) lseek(r1, 0x4, 0x1) (async) lseek(r1, 0x4, 0x1) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x6, 0x25dfdc03, {0x2, 0x20, 0x20, 0x6, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@RTA_DST={0x5, 0x1d, @local}, @RTA_SPORT={0x6, 0x1c, 0x4e22}]}, 0x2c}}, 0x4040000) 0s ago: executing program 0 (id=572): r0 = syz_open_dev$vbi(&(0x7f0000000080), 0x1, 0x2) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000580)={0x0, @bt={0x13, 0x7c5, 0x2800, 0x2800, 0xd59f82, 0x2, 0x5, 0xb, 0x8, 0x0, 0xbef, 0x1, 0x7, 0x9, 0x2b, 0x4, {0xffff945a, 0x1}, 0x9, 0xf1}}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f00000000c0)=0xc) setpriority(0x1, r1, 0x1f7a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x40000000015, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x271e, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000200)=@get={0x1, 0x0, 0x7}) kernel console output (not intermixed with test programs): nterface not active [ 91.490669][ T5850] team0: Port device team_slave_1 added [ 91.514150][ T5842] team0: Port device team_slave_1 added [ 91.539354][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.547057][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.573751][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.664022][ T5835] hsr_slave_0: entered promiscuous mode [ 91.670513][ T5835] hsr_slave_1: entered promiscuous mode [ 91.688514][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.695624][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.722064][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.763777][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.770772][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.796957][ T5842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.820018][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.827165][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.854044][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.873911][ T5840] hsr_slave_0: entered promiscuous mode [ 91.880367][ T5840] hsr_slave_1: entered promiscuous mode [ 91.886903][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.895341][ T5840] Cannot create hsr debugfs directory [ 91.903213][ T5842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.910181][ T5842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.936419][ T5842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.044391][ T1209] cfg80211: failed to load regulatory.db [ 92.095932][ T5834] hsr_slave_0: entered promiscuous mode [ 92.102326][ T5834] hsr_slave_1: entered promiscuous mode [ 92.108518][ T5834] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.116211][ T5834] Cannot create hsr debugfs directory [ 92.170067][ T5842] hsr_slave_0: entered promiscuous mode [ 92.176841][ T5842] hsr_slave_1: entered promiscuous mode [ 92.183251][ T5842] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.190835][ T5842] Cannot create hsr debugfs directory [ 92.221557][ T5850] hsr_slave_0: entered promiscuous mode [ 92.227909][ T5850] hsr_slave_1: entered promiscuous mode [ 92.234960][ T5850] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 92.242602][ T5850] Cannot create hsr debugfs directory [ 92.903687][ T5840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.919454][ T5840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.942482][ T5840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.962547][ T5840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.018241][ T5842] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.032753][ T5842] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.049122][ T5842] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.069999][ T5842] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.148937][ T5835] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 93.160491][ T5835] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 93.163283][ T5846] Bluetooth: hci2: command tx timeout [ 93.167798][ T5856] Bluetooth: hci4: command tx timeout [ 93.172719][ T5854] Bluetooth: hci0: command tx timeout [ 93.178155][ T5856] Bluetooth: hci1: command tx timeout [ 93.199457][ T5835] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 93.210557][ T5835] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 93.242035][ T5856] Bluetooth: hci3: command tx timeout [ 93.362471][ T5834] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.396202][ T5834] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.406393][ T5834] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.446341][ T5834] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.553336][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.579213][ T5842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.596910][ T5850] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 93.616676][ T5850] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 93.647234][ T5850] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 93.660286][ T5850] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 93.689885][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.707374][ T5842] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.728802][ T146] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.736222][ T146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.772688][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.779870][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.789617][ T146] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.796866][ T146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.836748][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.843963][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.859977][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.956382][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.992031][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.999334][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.095225][ T5842] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 94.127633][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.134866][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.299038][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.350977][ T5834] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.395489][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.424507][ T146] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.431757][ T146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.483938][ T146] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.491191][ T146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.566047][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.592060][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.655734][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.662966][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.684178][ T5842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.760147][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.767409][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.911051][ T5840] veth0_vlan: entered promiscuous mode [ 94.949317][ T5842] veth0_vlan: entered promiscuous mode [ 94.967085][ T5840] veth1_vlan: entered promiscuous mode [ 94.994779][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.053061][ T5842] veth1_vlan: entered promiscuous mode [ 95.226840][ T5840] veth0_macvtap: entered promiscuous mode [ 95.252975][ T5856] Bluetooth: hci2: command tx timeout [ 95.258464][ T5856] Bluetooth: hci1: command tx timeout [ 95.261991][ T5846] Bluetooth: hci0: command tx timeout [ 95.269354][ T5854] Bluetooth: hci4: command tx timeout [ 95.278981][ T5842] veth0_macvtap: entered promiscuous mode [ 95.305834][ T5840] veth1_macvtap: entered promiscuous mode [ 95.322051][ T5854] Bluetooth: hci3: command tx timeout [ 95.330074][ T5842] veth1_macvtap: entered promiscuous mode [ 95.349054][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.386306][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.468765][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.530135][ T5840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.540444][ T5840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.555754][ T5840] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.565420][ T5840] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.607649][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.653611][ T5842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.679113][ T5842] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.692873][ T5842] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.702177][ T5842] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.711006][ T5842] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.776464][ T5834] veth0_vlan: entered promiscuous mode [ 95.838894][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.860094][ T1339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.860183][ T5834] veth1_vlan: entered promiscuous mode [ 95.877777][ T1339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.998361][ T3871] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.999008][ T5835] veth0_vlan: entered promiscuous mode [ 96.013085][ T3871] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.065241][ T3871] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.087098][ T3871] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.134852][ T5835] veth1_vlan: entered promiscuous mode [ 96.176202][ T5840] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 96.193856][ T5834] veth0_macvtap: entered promiscuous mode [ 96.208460][ T5834] veth1_macvtap: entered promiscuous mode [ 96.224616][ T146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.235761][ T5850] veth0_vlan: entered promiscuous mode [ 96.243526][ T146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.315323][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.343961][ T5850] veth1_vlan: entered promiscuous mode [ 96.359406][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.379344][ T5835] veth0_macvtap: entered promiscuous mode [ 96.444408][ T5850] veth0_macvtap: entered promiscuous mode [ 96.462191][ T5850] veth1_macvtap: entered promiscuous mode [ 96.502801][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.527653][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.545028][ T5850] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.558293][ T5850] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.567528][ T5850] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.588049][ T5850] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.609716][ T5834] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.619369][ T5834] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.628702][ T5834] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.637524][ T5834] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.695225][ T5835] veth1_macvtap: entered promiscuous mode [ 97.361365][ T5854] Bluetooth: hci4: command tx timeout [ 97.367557][ T5854] Bluetooth: hci0: command tx timeout [ 97.376410][ T5854] Bluetooth: hci1: command tx timeout [ 97.383670][ T5854] Bluetooth: hci2: command tx timeout [ 97.401261][ T5846] Bluetooth: hci3: command tx timeout [ 97.489884][ T5961] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 97.547317][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.582637][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 97.899062][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.958826][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.960945][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.143902][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 98.321878][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.333990][ T5835] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.335327][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.355248][ T5835] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.366510][ T5835] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.375363][ T5835] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.401487][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.429803][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.564913][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.581820][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.886718][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.896391][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.246519][ T5971] netlink: 'syz.1.2': attribute type 11 has an invalid length. [ 100.733478][ T5964] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.750854][ T5964] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.335688][ T24] libceph: connect (1)[c::]:6789 error -101 [ 101.773625][ T5995] ceph: No mds server is up or the cluster is laggy [ 101.786217][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 101.956053][ T6001] netlink: 4280 bytes leftover after parsing attributes in process `syz.2.11'. [ 102.049069][ T6001] netlink: 4280 bytes leftover after parsing attributes in process `syz.2.11'. [ 102.059749][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.061682][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.088904][ T6004] trusted_key: syz.1.10 sent an empty control message without MSG_MORE. [ 102.342099][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 102.351516][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.359857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.368848][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.377489][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.386159][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 103.092827][ T6011] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 103.174432][ T55] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 103.396211][ T55] usb 3-1: Using ep0 maxpacket: 32 [ 103.534245][ T55] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 103.730432][ T55] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.926636][ T55] usb 3-1: config 0 descriptor?? [ 104.166487][ T55] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 104.311043][ T6028] netlink: 'syz.3.16': attribute type 1 has an invalid length. [ 104.415329][ T55] usb 3-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 104.427749][ T55] usb 3-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 104.651769][ C1] Illegal XDP return value 16128 on prog (id 9) dev bond_slave_0, expect packet loss! [ 106.883395][ T6044] capability: warning: `syz.3.17' uses 32-bit capabilities (legacy support in use) [ 107.607009][ T6054] warning: `syz.1.20' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 107.806680][ T6054] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20'. [ 108.570501][ T6070] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 108.579988][ T6070] overlay: filesystem on ./bus not supported as upperdir [ 108.721199][ T6014] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 109.171177][ T6014] usb 5-1: device descriptor read/64, error -71 [ 109.461317][ T6014] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 109.630658][ T6014] usb 5-1: device descriptor read/64, error -71 [ 109.775550][ T6014] usb usb5-port1: attempt power cycle [ 109.941303][ T5847] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 110.051170][ T6010] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 110.073111][ T6085] netlink: 16 bytes leftover after parsing attributes in process `syz.1.30'. [ 110.111371][ T5847] usb 4-1: device descriptor read/64, error -71 [ 110.151412][ T6014] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 110.218805][ T6014] usb 5-1: device descriptor read/8, error -71 [ 110.258938][ T6010] usb 1-1: config 0 has an invalid interface number: 11 but max is 0 [ 110.281262][ T6010] usb 1-1: config 0 has no interface number 0 [ 110.287562][ T6010] usb 1-1: config 0 interface 11 altsetting 253 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 110.335564][ T6010] usb 1-1: config 0 interface 11 altsetting 253 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 110.808185][ T5847] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 110.893322][ T6010] usb 1-1: config 0 interface 11 altsetting 253 endpoint 0x86 has an invalid bInterval 0, changing to 10 [ 110.945848][ T6010] usb 1-1: config 0 interface 11 altsetting 253 endpoint 0x86 has invalid wMaxPacketSize 0 [ 110.981252][ T5847] usb 4-1: device descriptor read/64, error -71 [ 110.993225][ T6014] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 111.033436][ T6010] usb 1-1: config 0 interface 11 has no altsetting 0 [ 111.086331][ T6010] usb 1-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 111.091623][ T5847] usb usb4-port1: attempt power cycle [ 111.101641][ T6014] usb 5-1: device descriptor read/8, error -71 [ 111.125449][ T6010] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.142247][ T6010] usb 1-1: config 0 descriptor?? [ 111.197849][ T6083] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 111.217380][ T6010] keyspan 1-1:0.11: Keyspan 2 port adapter converter detected [ 111.225662][ T6014] usb usb5-port1: unable to enumerate USB device [ 111.233553][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 87 [ 111.534668][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 81 [ 111.555924][ T6097] netlink: 20 bytes leftover after parsing attributes in process `syz.1.33'. [ 111.632037][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 82 [ 111.675185][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 1 [ 111.694640][ T6097] xt_socket: unknown flags 0xd0 [ 111.707205][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 2 [ 111.748318][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 85 [ 111.777711][ T5847] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 111.785434][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 5 [ 111.789373][ T6010] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 111.856573][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 83 [ 111.865794][ T5847] usb 4-1: device descriptor read/8, error -71 [ 111.906955][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 84 [ 111.911131][ T6104] erspan0: entered promiscuous mode [ 111.941694][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 3 [ 111.980171][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 4 [ 112.061022][ T6104] erspan0: left promiscuous mode [ 112.068686][ T6108] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 112.101315][ T6010] keyspan 1-1:0.11: found no endpoint descriptor for endpoint 6 [ 112.119312][ T6010] usb 1-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 112.121238][ T5847] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 112.152352][ T6010] usb 1-1: USB disconnect, device number 2 [ 112.192576][ T5847] usb 4-1: device descriptor read/8, error -71 [ 112.321852][ T5847] usb usb4-port1: unable to enumerate USB device [ 112.394081][ T6010] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 112.492481][ T6010] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 112.532235][ T6010] keyspan 1-1:0.11: device disconnected [ 114.626299][ T6133] netlink: 'syz.1.42': attribute type 10 has an invalid length. [ 115.261256][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 115.271506][ T6136] netlink: 'syz.4.41': attribute type 4 has an invalid length. [ 115.450440][ T6136] netlink: 152 bytes leftover after parsing attributes in process `syz.4.41'. [ 115.511954][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 115.555305][ T6133] hsr0: entered promiscuous mode [ 115.563213][ T9] usb 1-1: config 5 has an invalid interface number: 35 but max is 0 [ 115.590206][ T6133] bond0: (slave hsr0): The slave device specified does not support setting the MAC address [ 115.591226][ T9] usb 1-1: config 5 has no interface number 0 [ 115.661313][ T9] usb 1-1: config 5 interface 35 altsetting 10 endpoint 0x5 has an invalid bInterval 64, changing to 10 [ 115.674140][ T9] usb 1-1: config 5 interface 35 has no altsetting 0 [ 115.685874][ T9] usb 1-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=d4.1b [ 115.711535][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.732634][ T6133] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 115.832017][ T6133] bond0: (slave hsr0): Error -22 calling dev_set_mtu [ 115.836225][ T9] usb 1-1: Product: syz [ 116.794151][ T9] usb 1-1: Manufacturer: syz [ 116.798816][ T9] usb 1-1: SerialNumber: syz [ 116.801525][ T6146] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 117.006628][ T9] usb 1-1: can't set config #5, error -71 [ 117.021820][ T5933] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 117.028878][ T6136] : renamed from bond0 (while UP) [ 117.115750][ T9] usb 1-1: USB disconnect, device number 3 [ 120.165714][ T6153] ALSA: mixer_oss: invalid OSS volume '~JfM/ R?/i"' [ 120.174510][ T6153] ALSA: mixer_oss: invalid OSS volume 'y)䏒o#B!IĨoc' [ 120.766316][ T5933] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 120.811247][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.819285][ T5933] usb 4-1: Product: syz [ 120.875766][ T5933] usb 4-1: Manufacturer: syz [ 120.903555][ T6165] netlink: 'syz.0.51': attribute type 5 has an invalid length. [ 120.928506][ T5933] usb 4-1: config 0 descriptor?? [ 120.989487][ T5933] usb 4-1: can't set config #0, error -71 [ 121.042025][ T5933] usb 4-1: USB disconnect, device number 6 [ 123.278413][ T6205] netlink: 24 bytes leftover after parsing attributes in process `syz.1.58'. [ 124.955768][ T6218] netlink: 'syz.4.61': attribute type 28 has an invalid length. [ 125.190882][ T6230] netlink: 'syz.0.63': attribute type 21 has an invalid length. [ 125.204221][ T6226] mmap: syz.2.64 (6226): VmData 37654528 exceed data ulimit 5. Update limits or use boot option ignore_rlimit_data. [ 125.289294][ T6230] netlink: 132 bytes leftover after parsing attributes in process `syz.0.63'. [ 125.301528][ T6014] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 125.509078][ T6014] usb 5-1: device descriptor read/64, error -71 [ 125.777473][ T6014] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 125.920403][ T6240] syz.1.66 uses obsolete (PF_INET,SOCK_PACKET) [ 125.943401][ T6014] usb 5-1: device descriptor read/64, error -71 [ 126.132681][ T6014] usb usb5-port1: attempt power cycle [ 126.271383][ T5913] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 126.534662][ T6014] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 126.568470][ T5913] usb 2-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 126.613012][ T5913] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.621432][ T5913] usb 2-1: Product: syz [ 126.625843][ T5913] usb 2-1: Manufacturer: syz [ 126.631231][ T6014] usb 5-1: device descriptor read/8, error -71 [ 126.638599][ T5913] usb 2-1: SerialNumber: syz [ 126.655688][ T5913] usb 2-1: config 0 descriptor?? [ 126.875899][ T5933] usb 2-1: USB disconnect, device number 2 [ 126.931740][ T6014] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 127.007576][ T6014] usb 5-1: device descriptor read/8, error -71 [ 127.131956][ T6014] usb usb5-port1: unable to enumerate USB device [ 127.213908][ T6243] netfs: Couldn't get user pages (rc=-14) [ 127.386100][ T6252] netlink: 132 bytes leftover after parsing attributes in process `syz.0.70'. [ 127.551585][ T6259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.71'. [ 127.560673][ T6259] netlink: 120 bytes leftover after parsing attributes in process `syz.3.71'. [ 127.569960][ T6259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.71'. [ 127.862510][ T6266] netlink: 24 bytes leftover after parsing attributes in process `syz.0.72'. [ 128.287921][ T6262] dummy0: entered promiscuous mode [ 128.472883][ T6262] vlan2: entered promiscuous mode [ 128.487374][ T6007] IPVS: starting estimator thread 0... [ 128.500003][ T6263] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 128.632407][ T6272] IPVS: using max 27 ests per chain, 64800 per kthread [ 128.838577][ T6278] random: crng reseeded on system resumption [ 129.275320][ T6291] ======================================================= [ 129.275320][ T6291] WARNING: The mand mount option has been deprecated and [ 129.275320][ T6291] and is ignored by this kernel. Remove the mand [ 129.275320][ T6291] option from the mount to silence this warning. [ 129.275320][ T6291] ======================================================= [ 129.321697][ T5926] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 129.481193][ T5926] usb 1-1: Using ep0 maxpacket: 8 [ 129.555503][ T5926] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 129.662884][ T5926] usb 1-1: config 0 has no interfaces? [ 129.725351][ T5926] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 129.781943][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.818824][ T5926] usb 1-1: config 0 descriptor?? [ 130.072523][ T5913] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 130.149282][ T6298] netlink: 16 bytes leftover after parsing attributes in process `syz.3.82'. [ 130.159104][ T6298] netlink: 40 bytes leftover after parsing attributes in process `syz.3.82'. [ 130.261403][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 130.283682][ T5913] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 130.311990][ T5913] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 130.329318][ T5913] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 130.362929][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.397844][ T6307] process 'syz.3.84' launched './file2' with NULL argv: empty string added [ 130.420548][ T5913] usb 5-1: config 0 descriptor?? [ 130.432878][ T6307] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 130.640672][ T6311] loop5: detected capacity change from 0 to 7 [ 130.763211][ T5836] Dev loop5: unable to read RDB block 7 [ 130.772066][ T5836] loop5: unable to read partition table [ 130.778124][ T5836] loop5: partition table beyond EOD, truncated [ 130.885830][ T6315] netlink: 24 bytes leftover after parsing attributes in process `syz.3.86'. [ 131.571397][ T6311] Dev loop5: unable to read RDB block 7 [ 131.578196][ T6311] loop5: unable to read partition table [ 131.606226][ T6311] loop5: partition table beyond EOD, truncated [ 131.631274][ T6311] loop_reread_partitions: partition scan of loop5 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 131.730149][ T6324] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 131.760639][ T5933] usb 1-1: USB disconnect, device number 4 [ 132.441291][ T5846] Bluetooth: hci0: command tx timeout [ 133.051990][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.062467][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.156042][ T6351] fuse: Unknown parameter '00000000000000000000003' [ 134.269897][ T5926] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 134.273701][ T6362] bridge_slave_0: left allmulticast mode [ 134.289081][ T6362] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.157119][ T6362] netlink: 40 bytes leftover after parsing attributes in process `syz.0.99'. [ 135.261607][ T5926] usb 4-1: Using ep0 maxpacket: 16 [ 135.272615][ T5926] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 135.289201][ T5926] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x33, changing to 0x3 [ 135.302612][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 135.327027][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 57408, setting to 1024 [ 135.350392][ T5926] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 1024 [ 135.379867][ T5926] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 135.528078][ T5926] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 135.537792][ T5926] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 135.547286][ T6370] sp0: Synchronizing with TNC [ 135.552852][ T5926] usb 4-1: Manufacturer: syz [ 135.646137][ T6373] netlink: 24 bytes leftover after parsing attributes in process `syz.1.100'. [ 136.357984][ T5926] usb 4-1: config 0 descriptor?? [ 136.626173][ T5933] usb 4-1: USB disconnect, device number 7 [ 137.104699][ T6389] veth0_to_team: entered promiscuous mode [ 137.110682][ T6389] veth0_to_team: entered allmulticast mode [ 138.222463][ T5846] Bluetooth: hci2: unexpected subevent 0x01 length: 11 < 18 [ 139.038374][ T5847] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 139.264830][ T5847] usb 4-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=7a.ac [ 139.311618][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=51, SerialNumber=161 [ 139.356768][ T5847] usb 4-1: Product: syz [ 139.369407][ T5847] usb 4-1: Manufacturer: syz [ 139.376323][ T5847] usb 4-1: SerialNumber: syz [ 139.454517][ T5847] usb 4-1: config 0 descriptor?? [ 139.833815][ T5847] usb 4-1: interface 1 not found [ 139.859662][ T5847] usb 4-1: USB disconnect, device number 8 [ 139.894168][ T6411] mmap: syz.1.108 (6411) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 139.976189][ T6397] netlink: 'syz.1.108': attribute type 12 has an invalid length. [ 141.106355][ T6423] netlink: 24 bytes leftover after parsing attributes in process `syz.3.113'. [ 142.172014][ T6436] netlink: 4 bytes leftover after parsing attributes in process `syz.3.117'. [ 142.741586][ T6449] netlink: 'syz.2.120': attribute type 10 has an invalid length. [ 142.758939][ T6450] netlink: 'syz.2.120': attribute type 3 has an invalid length. [ 142.769431][ T6450] netlink: 20 bytes leftover after parsing attributes in process `syz.2.120'. [ 142.996113][ T6449] veth0_macvtap: left promiscuous mode [ 143.039015][ T6449] batman_adv: batadv0: Adding interface: macvtap0 [ 143.054587][ T6449] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.056843][ T5847] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 143.083757][ T6449] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 143.347724][ T6456] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 143.464621][ T5847] usb 2-1: unable to get BOS descriptor or descriptor too short [ 143.477514][ T5847] usb 2-1: not running at top speed; connect to a high speed hub [ 143.490471][ T5847] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.505589][ T5847] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 143.521027][ T5847] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 143.530862][ T5847] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.542521][ T5847] usb 2-1: Product: syz [ 143.546824][ T5847] usb 2-1: Manufacturer: syz [ 143.552052][ T5847] usb 2-1: SerialNumber: syz [ 144.205545][ T30] audit: type=1326 audit(1754895705.774:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6463 comm="syz.3.125" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f752ab8ebe9 code=0x0 [ 144.382364][ T5847] usb 2-1: 0:2 : does not exist [ 144.612202][ T6468] overlayfs: missing 'lowerdir' [ 144.613928][ T5847] usb 2-1: USB disconnect, device number 3 [ 144.801405][ T6471] netlink: 24 bytes leftover after parsing attributes in process `syz.1.128'. [ 145.387748][ T6471] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 145.741721][ T5836] udevd[5836]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 145.875222][ T5854] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 145.884977][ T5854] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 145.894174][ T5854] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 145.922034][ T5854] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 145.930684][ T5854] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 146.182598][ T5847] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 146.371320][ T5847] usb 2-1: Using ep0 maxpacket: 16 [ 146.381561][ T5847] usb 2-1: config 0 has an invalid descriptor of length 183, skipping remainder of the config [ 146.399611][ T5847] usb 2-1: config 0 interface 0 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 146.414419][ T6483] chnl_net:caif_netlink_parms(): no params data found [ 146.418790][ T5847] usb 2-1: config 0 interface 0 has no altsetting 0 [ 146.428375][ T5847] usb 2-1: New USB device found, idVendor=0b05, idProduct=17e0, bcdDevice= 0.00 [ 146.442852][ T5847] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.459435][ T5847] usb 2-1: config 0 descriptor?? [ 146.485521][ T5847] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 146.709037][ T5847] usb 2-1: USB disconnect, device number 4 [ 147.451946][ T6515] overlayfs: missing 'lowerdir' [ 147.516115][ T6483] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.532029][ T6483] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.569683][ T6483] bridge_slave_0: entered allmulticast mode [ 147.585309][ T6519] Zero length message leads to an empty skb [ 147.592979][ T6483] bridge_slave_0: entered promiscuous mode [ 147.842333][ T6483] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.855705][ T6483] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.872839][ T6483] bridge_slave_1: entered allmulticast mode [ 147.955220][ T6525] netlink: 'syz.1.140': attribute type 8 has an invalid length. [ 148.005387][ T5854] Bluetooth: hci5: command tx timeout [ 148.188217][ T6483] bridge_slave_1: entered promiscuous mode [ 148.513067][ T6525] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 148.916983][ T6483] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.398068][ T6483] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.416809][ T5854] Bluetooth: hci5: command tx timeout [ 152.441196][ T5854] Bluetooth: hci5: command tx timeout [ 152.576362][ T6545] ubi31: attaching mtd0 [ 152.932979][ T6545] ubi31: scanning is finished [ 152.975004][ T6545] ubi31: empty MTD device detected [ 153.212066][ T6483] team0: Port device team_slave_0 added [ 153.263876][ T6483] team0: Port device team_slave_1 added [ 153.388941][ T6545] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 153.461570][ T6545] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 153.468944][ T6545] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 153.533773][ T6545] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 153.566228][ T6545] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 153.601288][ T6545] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 153.651246][ T6545] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2499879688 [ 153.674149][ T6483] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 153.689104][ T6545] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 153.699292][ T6483] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 153.699358][ T6483] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 153.711820][ T6483] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 153.841245][ T6556] ubi31: background thread "ubi_bgt31d" started, PID 6556 [ 153.848761][ T6483] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.154275][ T6483] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.169319][ T6558] netlink: 84 bytes leftover after parsing attributes in process `syz.1.147'. [ 154.521584][ T5854] Bluetooth: hci5: command tx timeout [ 154.937953][ T6573] overlayfs: missing 'lowerdir' [ 155.201306][ T6576] netlink: 24 bytes leftover after parsing attributes in process `syz.3.151'. [ 155.290491][ T6483] hsr_slave_0: entered promiscuous mode [ 155.332711][ T6483] hsr_slave_1: entered promiscuous mode [ 155.339365][ T6483] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 155.375317][ T6483] Cannot create hsr debugfs directory [ 155.725944][ T6586] netlink: 'syz.1.152': attribute type 8 has an invalid length. [ 156.207404][ T6586] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 161.695581][ T6620] mkiss: ax0: crc mode is auto. [ 161.831267][ T6483] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 161.848611][ T6483] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 161.878910][ T6483] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 161.889938][ T6483] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 162.541594][ T6483] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.567551][ T6483] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.479601][ T6321] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.486900][ T6321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.590856][ T6321] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.598260][ T6321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.921266][ T5846] Bluetooth: hci5: command 0x0405 tx timeout [ 164.083603][ T6646] (syz.3.167,6646,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 164.128267][ T6646] (syz.3.167,6646,1):ocfs2_fill_super:1177 ERROR: status = -22 [ 164.322096][ T6648] 9pnet_virtio: no channels available for device syz [ 165.241543][ T6663] hub 8-0:1.0: USB hub found [ 165.256869][ T6663] hub 8-0:1.0: 1 port detected [ 165.991428][ T6483] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 168.905754][ T55] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 169.104474][ T55] dvb_usb_az6027 3-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 169.158851][ T6698] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 169.176716][ T6698] 9pnet: Unknown protocol version 9p [ 169.726657][ T6699] netlink: 'syz.0.180': attribute type 4 has an invalid length. [ 169.734430][ T6699] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.180'. [ 170.363238][ T55] usb 3-1: USB disconnect, device number 2 [ 171.686280][ T6483] veth0_vlan: entered promiscuous mode [ 171.717935][ T6483] veth1_vlan: entered promiscuous mode [ 171.919053][ T6483] veth0_macvtap: entered promiscuous mode [ 171.939878][ T6483] veth1_macvtap: entered promiscuous mode [ 172.019737][ T6483] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 172.106235][ T6483] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 172.157587][ T6483] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.197070][ T6483] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.201786][ T6007] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 172.230900][ T6483] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.248284][ T6483] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 172.391596][ T6007] usb 4-1: config 0 interface 0 altsetting 253 endpoint 0x81 has an invalid bInterval 36, changing to 9 [ 172.654906][ T6007] usb 4-1: config 0 interface 0 altsetting 253 endpoint 0x81 has invalid wMaxPacketSize 0 [ 172.781741][ T6007] usb 4-1: config 0 interface 0 has no altsetting 0 [ 172.789638][ T6007] usb 4-1: New USB device found, idVendor=0810, idProduct=0002, bcdDevice= 0.00 [ 172.936234][ T6007] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.010411][ T6007] usb 4-1: config 0 descriptor?? [ 173.263949][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.275957][ T5926] usb 5-1: USB disconnect, device number 10 [ 173.341243][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.358587][ T6007] pantherlord 0003:0810:0002.0001: unknown global tag 0xc [ 173.377299][ T6007] pantherlord 0003:0810:0002.0001: item 0 4 1 12 parsing failed [ 173.405042][ T6007] pantherlord 0003:0810:0002.0001: parse failed [ 173.436456][ T6732] Bluetooth: MGMT ver 1.23 [ 173.450570][ T6007] pantherlord 0003:0810:0002.0001: probe with driver pantherlord failed with error -22 [ 173.666040][ T36] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.728639][ T6018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 173.738428][ T6018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 173.837126][ T6735] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 173.863274][ C0] vkms_vblank_simulate: vblank timer overrun [ 173.918387][ T6735] CIFS mount error: No usable UNC path provided in device string! [ 173.918387][ T6735] [ 173.933698][ T6735] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 175.664393][ T36] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.919429][ T9] usb 4-1: USB disconnect, device number 9 [ 175.977485][ T36] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.723724][ T43] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 177.407696][ T36] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 177.781337][ T5933] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 177.791238][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 177.797747][ T43] usb 1-1: too many configurations: 219, using maximum allowed: 8 [ 177.815208][ T43] usb 1-1: config index 0 descriptor too short (expected 19455, got 36) [ 177.830687][ T43] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 105 [ 177.858125][ T43] usb 1-1: can't read configurations, error -22 [ 177.979510][ T6770] netlink: 56 bytes leftover after parsing attributes in process `syz.1.199'. [ 177.988871][ T5933] usb 4-1: device descriptor read/64, error -71 [ 178.011258][ T43] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 178.252913][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 178.307009][ T43] usb 1-1: too many configurations: 219, using maximum allowed: 8 [ 178.365400][ T6771] delete_channel: no stack [ 178.419443][ T5933] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 178.500149][ T43] usb 1-1: config index 0 descriptor too short (expected 19455, got 36) [ 178.661306][ T43] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 105 [ 178.741832][ T36] bridge_slave_1: left allmulticast mode [ 178.752222][ T43] usb 1-1: can't read configurations, error -22 [ 178.779468][ T36] bridge_slave_1: left promiscuous mode [ 178.803432][ T5933] usb 4-1: device descriptor read/64, error -71 [ 178.812067][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.824680][ T43] usb usb1-port1: attempt power cycle [ 178.951626][ T36] bridge_slave_0: left allmulticast mode [ 178.957368][ T36] bridge_slave_0: left promiscuous mode [ 178.990145][ T5933] usb usb4-port1: attempt power cycle [ 179.024728][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.172453][ T6780] FAULT_INJECTION: forcing a failure. [ 179.172453][ T6780] name failslab, interval 1, probability 0, space 0, times 1 [ 179.208862][ T6780] CPU: 1 UID: 0 PID: 6780 Comm: syz.2.202 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 179.208892][ T6780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 179.208903][ T6780] Call Trace: [ 179.208911][ T6780] [ 179.208921][ T6780] dump_stack_lvl+0x189/0x250 [ 179.208951][ T6780] ? __pfx____ratelimit+0x10/0x10 [ 179.208974][ T6780] ? __pfx_dump_stack_lvl+0x10/0x10 [ 179.208997][ T6780] ? __pfx__printk+0x10/0x10 [ 179.209030][ T6780] ? __pfx___might_resched+0x10/0x10 [ 179.209050][ T6780] ? fs_reclaim_acquire+0x7d/0x100 [ 179.209080][ T6780] should_fail_ex+0x414/0x560 [ 179.209107][ T6780] should_failslab+0xa8/0x100 [ 179.209132][ T6780] __kmalloc_noprof+0xcb/0x4f0 [ 179.209150][ T6780] ? kfree+0x4d/0x440 [ 179.209176][ T6780] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 179.209208][ T6780] tomoyo_realpath_from_path+0xe3/0x5d0 [ 179.209235][ T6780] ? tomoyo_domain+0xda/0x130 [ 179.209277][ T6780] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 179.209300][ T6780] tomoyo_path_number_perm+0x1e8/0x5a0 [ 179.209325][ T6780] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 179.209368][ T6780] ? __lock_acquire+0xab9/0xd20 [ 179.209413][ T6780] ? __fget_files+0x2a/0x420 [ 179.209440][ T6780] ? __fget_files+0x2a/0x420 [ 179.209460][ T6780] ? __fget_files+0x3a0/0x420 [ 179.209481][ T6780] ? __fget_files+0x2a/0x420 [ 179.209508][ T6780] security_file_ioctl+0xcb/0x2d0 [ 179.209532][ T6780] __se_sys_ioctl+0x47/0x170 [ 179.209566][ T6780] do_syscall_64+0xfa/0x3b0 [ 179.209587][ T6780] ? lockdep_hardirqs_on+0x9c/0x150 [ 179.209608][ T6780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.209628][ T6780] ? clear_bhb_loop+0x60/0xb0 [ 179.209653][ T6780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.209672][ T6780] RIP: 0033:0x7f643058ebe9 [ 179.209691][ T6780] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 179.209707][ T6780] RSP: 002b:00007f64314df038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 179.209728][ T6780] RAX: ffffffffffffffda RBX: 00007f64307b5fa0 RCX: 00007f643058ebe9 [ 179.209743][ T6780] RDX: 0000200000000140 RSI: 00000000c008551c RDI: 0000000000000003 [ 179.209756][ T6780] RBP: 00007f64314df090 R08: 0000000000000000 R09: 0000000000000000 [ 179.209768][ T6780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 179.209779][ T6780] R13: 00007f64307b6038 R14: 00007f64307b5fa0 R15: 00007ffe854a5728 [ 179.209813][ T6780] [ 179.211003][ T6780] ERROR: Out of memory at tomoyo_realpath_from_path. [ 179.391258][ T5933] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 179.423135][ T5933] usb 4-1: device descriptor read/8, error -71 [ 181.265844][ T6805] FAULT_INJECTION: forcing a failure. [ 181.265844][ T6805] name failslab, interval 1, probability 0, space 0, times 0 [ 181.317097][ T6805] CPU: 1 UID: 0 PID: 6805 Comm: syz.3.208 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 181.317125][ T6805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 181.317136][ T6805] Call Trace: [ 181.317144][ T6805] [ 181.317153][ T6805] dump_stack_lvl+0x189/0x250 [ 181.317183][ T6805] ? __pfx____ratelimit+0x10/0x10 [ 181.317205][ T6805] ? __pfx_dump_stack_lvl+0x10/0x10 [ 181.317227][ T6805] ? __pfx__printk+0x10/0x10 [ 181.317259][ T6805] ? __pfx___might_resched+0x10/0x10 [ 181.317281][ T6805] ? fs_reclaim_acquire+0x7d/0x100 [ 181.317321][ T6805] should_fail_ex+0x414/0x560 [ 181.317349][ T6805] should_failslab+0xa8/0x100 [ 181.317373][ T6805] __kmalloc_noprof+0xcb/0x4f0 [ 181.317391][ T6805] ? kfree+0x4d/0x440 [ 181.317416][ T6805] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 181.317448][ T6805] tomoyo_realpath_from_path+0xe3/0x5d0 [ 181.317475][ T6805] ? tomoyo_domain+0xda/0x130 [ 181.317506][ T6805] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 181.317529][ T6805] tomoyo_path_number_perm+0x1e8/0x5a0 [ 181.317554][ T6805] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 181.317595][ T6805] ? __lock_acquire+0xab9/0xd20 [ 181.317640][ T6805] ? __fget_files+0x2a/0x420 [ 181.317667][ T6805] ? __fget_files+0x2a/0x420 [ 181.317687][ T6805] ? __fget_files+0x3a0/0x420 [ 181.317708][ T6805] ? __fget_files+0x2a/0x420 [ 181.317736][ T6805] security_file_ioctl+0xcb/0x2d0 [ 181.317761][ T6805] __se_sys_ioctl+0x47/0x170 [ 181.317793][ T6805] do_syscall_64+0xfa/0x3b0 [ 181.317814][ T6805] ? lockdep_hardirqs_on+0x9c/0x150 [ 181.317835][ T6805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.317854][ T6805] ? clear_bhb_loop+0x60/0xb0 [ 181.317879][ T6805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 181.317898][ T6805] RIP: 0033:0x7f752ab8ebe9 [ 181.317916][ T6805] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 181.317932][ T6805] RSP: 002b:00007f752b9fb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 181.317954][ T6805] RAX: ffffffffffffffda RBX: 00007f752adb5fa0 RCX: 00007f752ab8ebe9 [ 181.317968][ T6805] RDX: 0000200000000140 RSI: 00000000c008551c RDI: 0000000000000003 [ 181.317981][ T6805] RBP: 00007f752b9fb090 R08: 0000000000000000 R09: 0000000000000000 [ 181.317992][ T6805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 181.318003][ T6805] R13: 00007f752adb6038 R14: 00007f752adb5fa0 R15: 00007ffd4b9d0078 [ 181.318037][ T6805] [ 181.318045][ T6805] ERROR: Out of memory at tomoyo_realpath_from_path. [ 181.553972][ T6814] ieee802154 phy0 wpan0: encryption failed: -22 [ 182.142767][ T6007] IPVS: starting estimator thread 0... [ 182.275893][ T6817] IPVS: using max 46 ests per chain, 110400 per kthread [ 184.616920][ T36]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 184.629568][ T36]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 184.652397][ T36]  (unregistering): Released all slaves [ 184.730925][ T9] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 184.921158][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 184.942862][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 184.973224][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 184.995201][ T9] usb 4-1: config 1 has no interface number 1 [ 185.015592][ T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 185.042077][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.050992][ T9] usb 4-1: Product: syz [ 185.055586][ T9] usb 4-1: Manufacturer: syz [ 185.066436][ T9] usb 4-1: SerialNumber: syz [ 185.161194][ T5933] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 185.326628][ T5933] usb 1-1: Using ep0 maxpacket: 32 [ 185.356673][ T6823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.396718][ T5933] usb 1-1: config 0 interface 0 has no altsetting 0 [ 185.426589][ T5933] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 185.450869][ T5933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.469349][ T6823] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.500003][ T9] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 185.529506][ T5933] usb 1-1: config 0 descriptor?? [ 185.541416][ T9] usb 4-1: 2:1: invalid format type 0x1002 is detected, processed as PCM [ 185.563841][ T9] usb 4-1: 2:1 : sample bitwidth 71 in over sample bytes 5 [ 185.581172][ T9] usb 4-1: 2:1 : unsupported sample bitwidth 71 in 5 bytes [ 185.709246][ T9] usb 4-1: USB disconnect, device number 14 [ 185.771465][ T5999] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 185.815855][ T36] hsr_slave_0: left promiscuous mode [ 185.839989][ T6486] udevd[6486]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 185.856604][ T36] hsr_slave_1: left promiscuous mode [ 185.889670][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 186.101572][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 186.108194][ T5999] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 186.292755][ T5999] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 186.300948][ T5999] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 186.370778][ T5999] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 186.372708][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 186.397649][ T5999] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 186.427618][ T5933] usbhid 1-1:0.0: can't add hid device: -71 [ 186.439047][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 186.515299][ T5933] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 186.528119][ T5999] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 246 [ 186.572558][ T5933] usb 1-1: USB disconnect, device number 8 [ 186.579230][ T5999] usb 6-1: string descriptor 0 read error: -22 [ 186.586980][ T5999] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 186.627139][ T5999] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.646591][ T36] veth1_macvtap: left promiscuous mode [ 186.696751][ T5999] usb 6-1: config 0 descriptor?? [ 186.711733][ T36] veth0_macvtap: left promiscuous mode [ 186.733301][ T5999] hub 6-1:0.0: bad descriptor, ignoring hub [ 186.746640][ T36] veth1_vlan: left promiscuous mode [ 186.763170][ T5999] hub 6-1:0.0: probe with driver hub failed with error -5 [ 186.770708][ T36] veth0_vlan: left promiscuous mode [ 187.181217][ T5913] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 188.249649][ T5999] usb 6-1: USB disconnect, device number 2 [ 188.302091][ T5913] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 188.327825][ T5913] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 188.337987][ T55] usb 4-1: new full-speed USB device number 15 using dummy_hcd [ 188.380825][ T5913] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 188.428649][ T5913] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 188.485760][ T6848] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 188.513538][ T5913] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 188.552837][ T55] usb 4-1: config 1 interface 0 has no altsetting 0 [ 188.585958][ T55] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 188.611175][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 188.620166][ T55] usb 4-1: Product: syz [ 188.641715][ T5999] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 188.642014][ T55] usb 4-1: Manufacturer: syz [ 188.655348][ T55] usb 4-1: SerialNumber: syz [ 188.811398][ T5999] usb 1-1: device descriptor read/64, error -71 [ 188.895376][ T5913] usb 2-1: USB disconnect, device number 5 [ 189.086749][ T5999] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 189.221168][ T5999] usb 1-1: device descriptor read/64, error -71 [ 189.331785][ T5999] usb usb1-port1: attempt power cycle [ 189.415283][ T55] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 15 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 189.687914][ T5999] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 189.705223][ T36] team0 (unregistering): Port device team_slave_1 removed [ 189.748982][ T5999] usb 1-1: device descriptor read/8, error -71 [ 189.866446][ T36] team0 (unregistering): Port device team_slave_0 removed [ 190.001430][ T5999] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 190.062873][ T5999] usb 1-1: device descriptor read/8, error -71 [ 190.193572][ T5999] usb usb1-port1: unable to enumerate USB device [ 190.227810][ T6883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.237024][ T6883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.254537][ T6883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 190.270248][ T6883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 190.321267][ T5933] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 190.494078][ T5933] usb 6-1: Using ep0 maxpacket: 32 [ 190.503038][ T5933] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 190.514268][ T5933] usb 6-1: config 0 has no interface number 0 [ 190.524967][ T5933] usb 6-1: config 0 interface 12 has no altsetting 0 [ 190.537247][ T5933] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 190.556008][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 190.568139][ T5933] usb 6-1: Product: syz [ 190.577710][ T5933] usb 6-1: Manufacturer: syz [ 190.586411][ T5933] usb 6-1: SerialNumber: syz [ 190.634002][ T5933] usb 6-1: config 0 descriptor?? [ 191.290137][ C0] usblp0: nonzero write bulk status received: -71 [ 191.301872][ T5847] usb 4-1: USB disconnect, device number 15 [ 191.396297][ T5847] usblp0: removed [ 191.834090][ T5933] f81534 6-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 191.933616][ T5933] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 192.014007][ T5933] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 192.110905][ T5933] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 192.712303][ T5933] usb 6-1: USB disconnect, device number 3 [ 194.531849][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.538265][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.432160][ T5913] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 196.969036][ T6943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.235'. [ 197.512598][ T6945] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 197.659212][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 197.792634][ T5913] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 197.940378][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 198.064498][ T5913] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 198.213393][ T5913] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 198.307035][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.524623][ T5913] usb 4-1: config 0 descriptor?? [ 198.823927][ T5913] hdpvr 4-1:0.0: firmware version 0x1e dated q|RC@22[7BD^jvi0 [ 198.823927][ T5913] pY [ 198.908235][ T6957] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 198.932378][ T30] audit: type=1326 audit(1754895760.454:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6930 comm="syz.3.232" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f752ab8ebe9 code=0x0 [ 199.094931][ T5913] hdpvr 4-1:0.0: device init failed [ 199.114154][ T5913] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 199.187155][ T5913] usb 4-1: USB disconnect, device number 16 [ 199.260757][ T6955] Cannot find add_set index 0 as target [ 199.847155][ T30] audit: type=1804 audit(1754895761.414:4): pid=6979 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.5.243" name="/newroot/9/file0" dev="tmpfs" ino=64 res=1 errno=0 [ 199.941298][ T5913] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 200.371707][ T5913] usb 4-1: device descriptor read/64, error -71 [ 200.631316][ T5913] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 200.895627][ T5913] usb 4-1: device descriptor read/64, error -71 [ 201.095114][ T5913] usb usb4-port1: attempt power cycle [ 202.411399][ T5913] usb 4-1: new full-speed USB device number 19 using dummy_hcd [ 203.624636][ T55] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 204.095745][ T5913] usb 4-1: device descriptor read/8, error -71 [ 204.114687][ T7001] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 204.320262][ T7008] block nbd2: NBD_DISCONNECT [ 204.351260][ T55] usb 6-1: Using ep0 maxpacket: 32 [ 204.364214][ T55] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 204.374830][ T55] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 16384, setting to 64 [ 204.416013][ T55] usb 6-1: config 0 interface 0 has no altsetting 1 [ 204.438322][ T55] usb 6-1: New USB device found, idVendor=1199, idProduct=9004, bcdDevice= f.8c [ 204.466019][ T55] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.476755][ T55] usb 6-1: Product: syz [ 204.483974][ T55] usb 6-1: Manufacturer: syz [ 204.488731][ T55] usb 6-1: SerialNumber: syz [ 204.507040][ T55] usb 6-1: config 0 descriptor?? [ 204.518627][ T55] qmi_wwan 6-1:0.0: probe with driver qmi_wwan failed with error -22 [ 204.651161][ T5913] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 204.694874][ T5913] usb 4-1: config index 0 descriptor too short (expected 65069, got 45) [ 204.720333][ T5913] usb 4-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 204.773918][ T55] usb 6-1: USB disconnect, device number 4 [ 204.958671][ T5913] usb 4-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 255 [ 204.978363][ T5913] usb 4-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 204.988743][ T5913] usb 4-1: config 0 has no interfaces? [ 204.994393][ T5913] usb 4-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 205.004798][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.024656][ T5913] usb 4-1: config 0 descriptor?? [ 207.397375][ T5999] usb 4-1: USB disconnect, device number 20 [ 207.576573][ T5913] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 207.893239][ T7051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.902458][ T7051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.605996][ T5913] usb 6-1: unable to get BOS descriptor or descriptor too short [ 208.652734][ T5913] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 208.660471][ T5913] usb 6-1: can't read configurations, error -71 [ 209.176911][ T7073] syzkaller0: entered promiscuous mode [ 209.200290][ T7073] syzkaller0: entered allmulticast mode [ 209.211164][ T55] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 209.222382][ T7084] Smack: duplicate mount options [ 209.421378][ T55] usb 2-1: Using ep0 maxpacket: 16 [ 209.906326][ T55] usb 2-1: unable to get BOS descriptor or descriptor too short [ 210.558789][ T55] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 210.716362][ T55] usb 2-1: can't read configurations, error -71 [ 211.943336][ T5841] Bluetooth: hci4: command 0x0406 tx timeout [ 211.951306][ T5841] Bluetooth: hci2: command 0x0406 tx timeout [ 211.957483][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 217.866826][ T7131] ptrace attach of "./syz-executor exec"[5840] was attempted by "./syz-executor exec"[7131] [ 217.881119][ T6010] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 218.184570][ T6010] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 218.197119][ T6010] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 218.221093][ T6010] usb 3-1: config 0 has no interface number 0 [ 218.227292][ T6010] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 218.241555][ T6010] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 218.273728][ T6010] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 218.283322][ T6010] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.301382][ T6010] usb 3-1: Product: syz [ 218.305611][ T6010] usb 3-1: Manufacturer: syz [ 218.310234][ T6010] usb 3-1: SerialNumber: syz [ 218.342487][ T6010] usb 3-1: config 0 descriptor?? [ 218.378095][ T5999] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 219.223639][ T5999] usb 4-1: Using ep0 maxpacket: 8 [ 219.378446][ T5999] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 219.481308][ T5999] usb 4-1: config 0 has no interface number 0 [ 219.516012][ T5999] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 219.626871][ T5999] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 219.654675][ T5999] usb 4-1: Product: syz [ 219.834092][ T5999] usb 4-1: Manufacturer: syz [ 219.839584][ T5999] usb 4-1: SerialNumber: syz [ 219.856506][ T5999] usb 4-1: config 0 descriptor?? [ 220.984540][ T5999] usb 4-1: can't set config #0, error -71 [ 221.014854][ T5999] usb 4-1: USB disconnect, device number 21 [ 221.771189][ T5999] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 222.176866][ T5933] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 223.465013][ T5999] usb 6-1: no configurations [ 223.469768][ T5999] usb 6-1: can't read configurations, error -22 [ 224.016513][ T6010] usbtouchscreen 3-1:0.117: probe with driver usbtouchscreen failed with error -110 [ 224.256850][ T7181] netlink: 4 bytes leftover after parsing attributes in process `syz.0.285'. [ 225.043198][ T6010] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 225.315882][ T6010] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 225.456616][ T6010] usb 1-1: config 0 has no interface number 0 [ 225.622605][ T6010] usb 1-1: config 0 interface 29 has no altsetting 0 [ 225.714431][ T6010] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 225.744114][ T6010] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 225.792277][ T6010] usb 1-1: Product: syz [ 225.796614][ T6010] usb 1-1: Manufacturer: syz [ 225.975038][ T6010] usb 1-1: SerialNumber: syz [ 226.927747][ T6010] usb 1-1: config 0 descriptor?? [ 227.023360][ T7199] tmpfs: Bad value for 'mpol' [ 227.431855][ T5933] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 227.709459][ T6010] usb 1-1: can't set config #0, error -71 [ 227.764109][ T6010] usb 1-1: USB disconnect, device number 13 [ 227.820544][ T5933] usb 2-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=e8.cf [ 227.856073][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.886664][ T5933] usb 2-1: Product: syz [ 227.917659][ T5933] usb 2-1: Manufacturer: syz [ 227.943715][ T5933] usb 2-1: SerialNumber: syz [ 228.159430][ T5933] usb 2-1: config 0 descriptor?? [ 228.164743][ T5999] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 228.708200][ T5999] usb 6-1: Using ep0 maxpacket: 32 [ 228.723333][ T5933] cypress_cy7c63 2-1:0.0: Cypress CY7C63xxx device now attached [ 228.951668][ T5999] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 228.967505][ T5999] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 229.013205][ T5999] usb 6-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 229.069140][ T5999] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 229.106980][ T5999] usb 6-1: config 0 descriptor?? [ 229.327905][ T6010] usb 3-1: USB disconnect, device number 3 [ 229.339386][ T7213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.384611][ T7213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.536375][ T5999] usbhid 6-1:0.0: can't add hid device: -71 [ 229.633513][ T5933] usb 2-1: USB disconnect, device number 8 [ 229.639872][ T5933] cypress_cy7c63 2-1:0.0: Cypress CY7C63xxx device now disconnected [ 229.655428][ T5999] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 229.687256][ T5999] usb 6-1: USB disconnect, device number 9 [ 229.701558][ T5847] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 229.739105][ T7224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.777540][ T7224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.973309][ T5847] usb 4-1: config 0 has an invalid interface number: 110 but max is 0 [ 229.988971][ T5847] usb 4-1: config 0 has no interface number 0 [ 229.999142][ T5847] usb 4-1: config 0 interface 110 altsetting 0 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 230.023282][ T5847] usb 4-1: config 0 interface 110 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 10 [ 230.046982][ T7227] openvswitch: netlink: Tunnel attr 16383 out of range max 16 [ 230.056672][ T5847] usb 4-1: config 0 interface 110 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 230.087173][ T5847] usb 4-1: config 0 interface 110 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 230.111503][ T5847] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=17.65 [ 230.120613][ T5847] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.156815][ T5847] usb 4-1: config 0 descriptor?? [ 230.162265][ T5999] usb 6-1: new full-speed USB device number 10 using dummy_hcd [ 230.183658][ T7218] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 230.199006][ T5847] adutux 4-1:0.110: interrupt endpoints not found [ 230.353860][ T5999] usb 6-1: unable to get BOS descriptor or descriptor too short [ 230.372806][ T5999] usb 6-1: not running at top speed; connect to a high speed hub [ 230.403819][ T5999] usb 6-1: config 1 interface 0 altsetting 222 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 230.452366][ T5999] usb 6-1: config 1 interface 0 has no altsetting 0 [ 230.460106][ T7218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.491730][ T7218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 230.496880][ T5999] usb 6-1: New USB device found, idVendor=0c45, idProduct=5112, bcdDevice= 0.40 [ 230.513829][ T5999] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 230.529335][ T5847] usb 4-1: USB disconnect, device number 23 [ 230.575798][ T5999] usb 6-1: Product: syz [ 230.590294][ T5999] usb 6-1: Manufacturer: syz [ 230.604209][ T5999] usb 6-1: SerialNumber: syz [ 230.632910][ T7223] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 230.680735][ T7238] netlink: 88 bytes leftover after parsing attributes in process `syz.1.298'. [ 232.994152][ T5999] usbhid 6-1:1.0: can't add hid device: -71 [ 233.280944][ T7249] fuse: Bad value for 'fd' [ 234.064767][ T5999] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 234.291168][ T7252] netlink: 24 bytes leftover after parsing attributes in process `syz.1.300'. [ 234.307722][ T5999] usb 6-1: USB disconnect, device number 10 [ 234.628323][ T7267] 9pnet_virtio: no channels available for device syz [ 237.051660][ T43] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 237.251693][ T43] usb 1-1: device descriptor read/64, error -71 [ 237.674719][ T43] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 237.953437][ T43] usb 1-1: device descriptor read/64, error -71 [ 238.151538][ T43] usb usb1-port1: attempt power cycle [ 238.238636][ T7281] netlink: 88 bytes leftover after parsing attributes in process `syz.0.308'. [ 238.341479][ T55] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 238.511748][ T55] usb 4-1: Using ep0 maxpacket: 8 [ 238.552981][ T55] usb 4-1: unable to get BOS descriptor set [ 238.593270][ T55] usb 4-1: config 0 has no interfaces? [ 238.641305][ T5999] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 238.647092][ T55] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=a9.dc [ 239.127360][ T55] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 239.391109][ T5933] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 239.465520][ T5999] usb 3-1: device descriptor read/64, error -71 [ 239.493562][ T55] usb 4-1: Product: syz [ 239.497805][ T55] usb 4-1: Manufacturer: syz [ 239.505366][ T55] usb 4-1: SerialNumber: syz [ 239.515559][ T55] r8152-cfgselector 4-1: Unknown version 0x0000 [ 239.525791][ T55] r8152-cfgselector 4-1: config 0 descriptor?? [ 239.601454][ T5933] usb 6-1: device descriptor read/64, error -71 [ 239.750974][ T55] r8152-cfgselector 4-1: USB disconnect, device number 24 [ 239.753485][ T5999] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 239.808474][ T7306] netlink: 24 bytes leftover after parsing attributes in process `syz.1.312'. [ 239.858827][ T7306] netlink: 48 bytes leftover after parsing attributes in process `syz.1.312'. [ 239.869524][ T5933] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 239.951503][ T5999] usb 3-1: device descriptor read/64, error -71 [ 240.041365][ T5933] usb 6-1: device descriptor read/64, error -71 [ 240.074666][ T5999] usb usb3-port1: attempt power cycle [ 240.111470][ T6007] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 240.166709][ T5933] usb usb6-port1: attempt power cycle [ 240.221345][ T9] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 240.271633][ T6007] usb 2-1: Using ep0 maxpacket: 16 [ 240.302953][ T6007] usb 2-1: too many configurations: 129, using maximum allowed: 8 [ 240.322246][ T6007] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 240.329896][ T6007] usb 2-1: can't read configurations, error -61 [ 240.401927][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 240.412578][ T9] usb 1-1: config 0 has an invalid interface number: 214 but max is 0 [ 240.429156][ T9] usb 1-1: config 0 has no interface number 0 [ 240.450170][ T9] usb 1-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 240.461798][ T5999] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 240.478485][ T9] usb 1-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 240.494802][ T6007] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 240.496878][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 240.512800][ T5999] usb 3-1: device descriptor read/8, error -71 [ 240.519906][ T9] usb 1-1: Product: syz [ 240.529645][ T9] usb 1-1: Manufacturer: syz [ 240.538477][ T5933] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 240.546654][ T9] usb 1-1: SerialNumber: syz [ 240.565170][ T9] usb 1-1: config 0 descriptor?? [ 240.574818][ T5933] usb 6-1: device descriptor read/8, error -71 [ 240.681488][ T6007] usb 2-1: Using ep0 maxpacket: 16 [ 240.699972][ T6007] usb 2-1: too many configurations: 129, using maximum allowed: 8 [ 240.713928][ T6007] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 240.751343][ T6007] usb 2-1: can't read configurations, error -61 [ 240.771649][ T6007] usb usb2-port1: attempt power cycle [ 240.772297][ T5999] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 240.807277][ T9] usbtouchscreen 1-1:0.214: Failed to read FW rev: -32 [ 240.814927][ T9] usbtouchscreen 1-1:0.214: probe with driver usbtouchscreen failed with error -32 [ 240.835973][ T9] usb 1-1: USB disconnect, device number 17 [ 240.842842][ T5999] usb 3-1: device descriptor read/8, error -71 [ 240.871134][ T5933] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 240.903001][ T5933] usb 6-1: device descriptor read/8, error -71 [ 240.961679][ T5999] usb usb3-port1: unable to enumerate USB device [ 241.021826][ T5933] usb usb6-port1: unable to enumerate USB device [ 241.161253][ T6007] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 243.572381][ T6007] usb 2-1: device descriptor read/8, error -71 [ 243.729227][ T5847] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 244.643962][ T5847] usb 4-1: Using ep0 maxpacket: 32 [ 244.798115][ T5847] usb 4-1: device descriptor read/all, error -71 [ 245.068772][ T7371] netlink: 'syz.3.323': attribute type 11 has an invalid length. [ 245.871613][ T5847] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 246.062467][ T5847] usb 4-1: not running at top speed; connect to a high speed hub [ 246.074975][ T5847] usb 4-1: config 1 has an invalid interface number: 221 but max is 1 [ 246.124926][ T5847] usb 4-1: config 1 has an invalid interface number: 142 but max is 1 [ 246.147058][ T5847] usb 4-1: config 1 has no interface number 0 [ 246.154808][ T5847] usb 4-1: config 1 has no interface number 1 [ 246.160975][ T5847] usb 4-1: config 1 interface 221 has no altsetting 0 [ 246.169779][ T5847] usb 4-1: config 1 interface 142 has no altsetting 0 [ 246.183692][ T5847] usb 4-1: New USB device found, idVendor=046d, idProduct=0920, bcdDevice=fa.f1 [ 246.193117][ T5847] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.207363][ T5847] usb 4-1: Product: syz [ 246.217571][ T5847] usb 4-1: Manufacturer: syz [ 246.224818][ T5847] usb 4-1: SerialNumber: syz [ 246.281886][ T5933] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 246.556993][ T7413] netlink: 'syz.5.330': attribute type 1 has an invalid length. [ 246.597895][ T7413] netlink: 232 bytes leftover after parsing attributes in process `syz.5.330'. [ 246.638715][ T5933] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 246.651892][ T5847] usb 4-1: USB disconnect, device number 26 [ 246.661121][ T5933] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 246.678026][ T5933] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 246.696393][ T7413] netlink: 8 bytes leftover after parsing attributes in process `syz.5.330'. [ 246.717832][ T7415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.331'. [ 246.766325][ T5933] usb 3-1: config 0 descriptor?? [ 246.785344][ T5933] pwc: Askey VC010 type 2 USB webcam detected. [ 246.984754][ T5999] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 247.151124][ T5999] usb 2-1: Using ep0 maxpacket: 16 [ 247.176854][ T5999] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 247.197770][ T7395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 247.238675][ T7395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.253905][ T5999] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 247.269417][ T5933] pwc: recv_control_msg error -32 req 02 val 2b00 [ 247.277165][ T5933] pwc: recv_control_msg error -32 req 02 val 2700 [ 247.277596][ T30] audit: type=1800 audit(1754895808.824:5): pid=7425 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.5.333" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 247.321462][ T5933] pwc: recv_control_msg error -32 req 02 val 2c00 [ 247.383094][ T5999] usb 2-1: config 0 has no interface number 0 [ 247.389830][ T5933] pwc: recv_control_msg error -32 req 04 val 1000 [ 247.813606][ T5933] pwc: recv_control_msg error -32 req 04 val 1300 [ 247.822594][ T5999] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 247.894929][ T5999] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.904697][ T5933] pwc: recv_control_msg error -32 req 04 val 1400 [ 247.942399][ T5933] pwc: recv_control_msg error -32 req 02 val 2000 [ 247.979491][ T5999] usb 2-1: Product: syz [ 247.984188][ T5933] pwc: recv_control_msg error -32 req 02 val 2100 [ 247.990891][ T5999] usb 2-1: Manufacturer: syz [ 248.007515][ T5999] usb 2-1: SerialNumber: syz [ 248.053094][ T5933] pwc: recv_control_msg error -32 req 04 val 1500 [ 248.102148][ T5999] usb 2-1: config 0 descriptor?? [ 248.111887][ T5933] pwc: recv_control_msg error -32 req 02 val 2500 [ 248.482221][ T5933] pwc: recv_control_msg error -32 req 02 val 2400 [ 248.502093][ T5999] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 248.509673][ T5999] usb 2-1: No valid video chain found. [ 248.704446][ T5933] pwc: recv_control_msg error -32 req 02 val 2900 [ 248.742379][ T5933] pwc: recv_control_msg error -32 req 02 val 2800 [ 248.998972][ T5933] pwc: recv_control_msg error -71 req 04 val 1200 [ 251.482803][ T5933] pwc: Registered as video103. [ 251.491665][ T5999] usb 2-1: USB disconnect, device number 13 [ 251.498403][ T5933] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input7 [ 251.542480][ T5933] usb 3-1: USB disconnect, device number 8 [ 251.690510][ T7463] xt_CT: You must specify a L4 protocol and not use inversions on it [ 251.791399][ T7468] netlink: 'syz.1.341': attribute type 21 has an invalid length. [ 251.858911][ T7468] netlink: 132 bytes leftover after parsing attributes in process `syz.1.341'. [ 252.257444][ T7478] Invalid logical block size (2051) [ 253.711320][ T6010] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 254.411569][ T5933] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 254.623581][ T6010] usb 6-1: unable to get BOS descriptor or descriptor too short [ 254.651414][ T6010] usb 6-1: not running at top speed; connect to a high speed hub [ 254.689342][ T6010] usb 6-1: config 9 has an invalid interface number: 153 but max is 0 [ 254.709331][ T6010] usb 6-1: config 9 has an invalid descriptor of length 1, skipping remainder of the config [ 254.728178][ T6010] usb 6-1: config 9 has no interface number 0 [ 254.748471][ T6010] usb 6-1: config 9 interface 153 altsetting 128 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 254.781330][ T6010] usb 6-1: config 9 interface 153 has no altsetting 0 [ 254.886746][ T7505] openvswitch: netlink: IPv6 tunnel dst address is zero [ 254.905071][ T6010] usb 6-1: New USB device found, idVendor=0711, idProduct=0920, bcdDevice=d5.b6 [ 254.933738][ T6010] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.971220][ T5933] usb 3-1: Using ep0 maxpacket: 8 [ 254.988181][ T5933] usb 3-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 255.010517][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 255.011161][ T6010] usb 6-1: Product: syz [ 255.039152][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 255.048582][ T6010] usb 6-1: Manufacturer: syz [ 255.063929][ T6010] usb 6-1: SerialNumber: syz [ 255.069570][ T5933] usb 3-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 255.084202][ T5999] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 255.226037][ T5933] usb 3-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 255.261873][ T5999] usb 1-1: Using ep0 maxpacket: 8 [ 255.281298][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 255.300659][ T5999] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 255.318725][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 255.331567][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 255.360290][ T5933] usb 3-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 255.375889][ T5999] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 255.391439][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 255.407688][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 255.502091][ T5933] usb 3-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 255.520160][ T6010] sisusb 6-1:9.153: Invalid USB2VGA device [ 255.527864][ T6010] sisusb 6-1:9.153: probe with driver sisusb failed with error -22 [ 255.537003][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 255.537040][ T5933] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 255.537065][ T5933] usb 3-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 255.546534][ T5933] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 255.558513][ T6010] usb 6-1: USB disconnect, device number 15 [ 255.640054][ T5999] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 255.662359][ T5933] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.757035][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 255.875566][ T5933] usb 3-1: Product: syz [ 255.886117][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.893148][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.995887][ T5933] usb 3-1: Manufacturer: syz [ 256.067313][ T5999] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 256.111757][ T5933] usb 3-1: SerialNumber: syz [ 256.291344][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 256.339718][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 256.384194][ T5933] adutux 3-1:168.0: interrupt endpoints not found [ 256.406235][ T5999] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 256.423710][ T7525] netlink: 256 bytes leftover after parsing attributes in process `syz.1.353'. [ 256.461442][ T7527] fuse: Bad value for 'fd' [ 256.461442][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 256.461476][ T5999] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 256.492742][ T5933] usb 3-1: USB disconnect, device number 9 [ 256.693142][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 256.808573][ T5999] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 256.838857][ T5999] usb 1-1: string descriptor 0 read error: -22 [ 256.848235][ T5999] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 256.931106][ T5999] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.112443][ T5999] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 257.369095][ T5999] usb 1-1: USB disconnect, device number 18 [ 257.382240][ T7540] tipc: Enabling of bearer rejected, failed to enable media [ 258.348130][ T7564] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 258.357631][ T7564] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 258.367336][ T7564] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 259.545604][ T7577] netlink: 72 bytes leftover after parsing attributes in process `syz.0.363'. [ 259.600409][ T7576] veth1_macvtap: left promiscuous mode [ 260.731333][ T9] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 260.797349][ T7589] tmpfs: Unknown parameter 'quo' [ 260.874151][ T7593] netlink: 8 bytes leftover after parsing attributes in process `syz.0.368'. [ 260.974647][ T9] usb 6-1: New USB device found, idVendor=0c45, idProduct=628f, bcdDevice=1f.44 [ 261.021141][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.080813][ T9] usb 6-1: config 0 descriptor?? [ 261.279482][ T9] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:628f [ 261.314848][ T9] gspca_sn9c20x: Write register 1000 failed -71 [ 261.328561][ T9] gspca_sn9c20x: Device initialization failed [ 261.339750][ T9] gspca_sn9c20x 6-1:0.0: probe with driver gspca_sn9c20x failed with error -71 [ 261.385363][ T9] usb 6-1: USB disconnect, device number 16 [ 261.421264][ T6010] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 261.581144][ T6010] usb 4-1: Using ep0 maxpacket: 8 [ 261.626153][ T6010] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 261.696373][ T6010] usb 4-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 261.751434][ T6010] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.776545][ T6010] usb 4-1: config 0 descriptor?? [ 261.808542][ T6010] cdc_acm 4-1:0.0: skipping garbage [ 262.021729][ T43] usb 4-1: USB disconnect, device number 27 [ 262.121218][ T6010] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 262.309638][ T6010] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.02 [ 262.329078][ T6010] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 262.356391][ T6010] usb 1-1: Product: syz [ 262.368317][ T6010] usb 1-1: Manufacturer: syz [ 262.379209][ T6010] usb 1-1: SerialNumber: syz [ 262.409691][ T6010] usb 1-1: config 0 descriptor?? [ 264.515047][ T7643] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 264.523686][ T7643] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock [ 264.534529][ T7643] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 264.542584][ T7643] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 265.448303][ T43] usb 1-1: USB disconnect, device number 19 [ 265.654203][ T7657] loop6: detected capacity change from 0 to 63 [ 265.663957][ T7657] Buffer I/O error on dev loop6, logical block 0, async page read [ 265.673599][ T7657] Buffer I/O error on dev loop6, logical block 1, async page read [ 265.681589][ T7657] Buffer I/O error on dev loop6, logical block 2, async page read [ 265.689496][ T7657] Buffer I/O error on dev loop6, logical block 3, async page read [ 265.697688][ T7657] Buffer I/O error on dev loop6, logical block 0, async page read [ 265.705627][ T7657] Buffer I/O error on dev loop6, logical block 1, async page read [ 265.713604][ T7657] Buffer I/O error on dev loop6, logical block 2, async page read [ 265.721597][ T7657] Buffer I/O error on dev loop6, logical block 3, async page read [ 265.729850][ T7657] Buffer I/O error on dev loop6, logical block 0, async page read [ 265.737881][ T7657] Buffer I/O error on dev loop6, logical block 1, async page read [ 266.700404][ T7666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.384'. [ 266.731316][ T7666] netlink: 20 bytes leftover after parsing attributes in process `syz.3.384'. [ 266.760707][ T7667] netlink: 12 bytes leftover after parsing attributes in process `syz.3.384'. [ 266.790742][ T7667] netlink: 20 bytes leftover after parsing attributes in process `syz.3.384'. [ 268.087099][ T7684] netlink: 2 bytes leftover after parsing attributes in process `syz.3.387'. [ 268.363116][ T5854] Bluetooth: hci5: command 0x0405 tx timeout [ 268.431252][ T5933] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 268.701240][ T5933] usb 2-1: device descriptor read/64, error -71 [ 268.974703][ T5933] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 273.680122][ T7710] netlink: 'syz.0.393': attribute type 2 has an invalid length. [ 273.841420][ T9] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 273.849765][ T7716] netlink: 120 bytes leftover after parsing attributes in process `syz.1.392'. [ 274.044883][ T9] usb 4-1: config 150 has an invalid interface number: 204 but max is 1 [ 274.073978][ T9] usb 4-1: config 150 has no interface number 0 [ 274.121389][ T9] usb 4-1: config 150 interface 204 has no altsetting 0 [ 274.149985][ T9] usb 4-1: config 150 interface 1 has no altsetting 0 [ 274.176235][ T9] usb 4-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 274.201111][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 274.229700][ T9] usb 4-1: Product: syz [ 274.249806][ T9] usb 4-1: Manufacturer: syz [ 274.267904][ T9] usb 4-1: SerialNumber: syz [ 274.291124][ T5933] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 274.463530][ T7729] 9pnet_virtio: no channels available for device syz [ 275.136745][ T9] xr_serial 4-1:150.204: xr_serial converter detected [ 275.181189][ T5933] usb 2-1: Using ep0 maxpacket: 32 [ 275.197384][ T5933] usb 2-1: config 0 has an invalid interface number: 66 but max is 0 [ 275.261172][ T5933] usb 2-1: config 0 has no interface number 0 [ 275.412600][ T5933] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 275.456775][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.476466][ T5933] usb 2-1: Product: syz [ 275.520003][ T5933] usb 2-1: Manufacturer: syz [ 275.538985][ T5933] usb 2-1: SerialNumber: syz [ 275.571491][ T5933] usb 2-1: config 0 descriptor?? [ 275.899493][ T5933] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 275.900046][ T5933] dvb-usb: bulk message failed: -22 (2/0) [ 276.213679][ T5933] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 276.218889][ T5933] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 276.218972][ T5933] usb 2-1: media controller created [ 276.269325][ T9] usb 4-1: xr_serial converter now attached to ttyUSB0 [ 276.365110][ T5933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 276.418497][ T5933] cxusb: set interface failed [ 276.418512][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 276.549272][ T43] usb 4-1: USB disconnect, device number 28 [ 276.582001][ T43] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 276.583534][ T43] xr_serial 4-1:150.204: device disconnected [ 276.797482][ T5933] DVB: Unable to find symbol lgdt330x_attach() [ 276.797503][ T5933] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 277.121137][ T5933] rc_core: IR keymap rc-dvico-portable not found [ 277.221183][ T5933] Registered IR keymap rc-empty [ 277.257145][ T5933] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 277.326286][ T5933] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input9 [ 277.346270][ T7757] netlink: 344 bytes leftover after parsing attributes in process `syz.0.399'. [ 277.396839][ T5933] dvb-usb: schedule remote query interval to 100 msecs. [ 277.436497][ T5933] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 277.570569][ T5933] usb 2-1: USB disconnect, device number 16 [ 278.744807][ T5933] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 280.130741][ T7787] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 280.130741][ T7787] program syz.1.406 not setting count and/or reply_len properly [ 280.605803][ T7795] 9pnet_virtio: no channels available for device syz [ 281.109813][ T7793] netlink: 'syz.5.408': attribute type 27 has an invalid length. [ 282.223398][ T5933] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 282.512195][ T5933] usb 6-1: New USB device found, idVendor=07c9, idProduct=0012, bcdDevice=c2.f4 [ 282.556059][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.612153][ T5933] usb 6-1: Product: syz [ 282.616441][ T5933] usb 6-1: Manufacturer: syz [ 282.665432][ T5933] usb 6-1: SerialNumber: syz [ 282.702479][ T5933] usb 6-1: config 0 descriptor?? [ 282.835506][ T7815] openvswitch: netlink: Message has 1 unknown bytes. [ 282.881138][ T7815] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 284.165571][ T6010] usb 6-1: USB disconnect, device number 17 [ 284.268196][ T7840] netlink: 16 bytes leftover after parsing attributes in process `syz.0.417'. [ 284.586055][ T7841] netlink: 8 bytes leftover after parsing attributes in process `syz.3.409'. [ 284.846453][ T7851] netlink: 'syz.0.420': attribute type 10 has an invalid length. [ 285.617391][ T7849] 9pnet_virtio: no channels available for device syz [ 285.823521][ T7821] netlink: 'syz.1.414': attribute type 12 has an invalid length. [ 285.857284][ T7821] netlink: 8 bytes leftover after parsing attributes in process `syz.1.414'. [ 286.061318][ T7821] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 287.407857][ T7843] netlink: 'syz.5.418': attribute type 83 has an invalid length. [ 289.402084][ T7878] binder: Unknown parameter 'func' [ 291.501439][ T7888] netlink: 16 bytes leftover after parsing attributes in process `syz.0.425'. [ 291.869640][ T7890] netlink: 4 bytes leftover after parsing attributes in process `syz.3.426'. [ 295.551632][ T6007] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 295.585062][ T7931] random: crng reseeded on system resumption [ 295.661303][ T43] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 295.741087][ T6007] usb 3-1: Using ep0 maxpacket: 8 [ 295.753770][ T6007] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 295.781091][ T6007] usb 3-1: config 179 has no interface number 0 [ 295.798861][ T6007] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 295.810587][ T43] usb 6-1: device descriptor read/64, error -71 [ 295.837536][ T6007] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 295.868804][ T6007] usb 3-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 296.116967][ T6007] usb 3-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 296.147947][ T6007] usb 3-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 296.157293][ T6007] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.951302][ T43] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 297.057116][ T7923] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 297.229523][ T43] usb 6-1: device descriptor read/64, error -71 [ 297.270265][ T7952] fuse: Unknown parameter 'f' [ 297.572414][ T6007] usb 3-1: USB disconnect, device number 10 [ 297.613377][ T43] usb usb6-port1: attempt power cycle [ 298.063658][ T7973] lo speed is unknown, defaulting to 1000 [ 298.070137][ T7973] lo speed is unknown, defaulting to 1000 [ 298.085181][ T7973] lo speed is unknown, defaulting to 1000 [ 298.120693][ T7973] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 298.229912][ T7973] infiniband s: RDMA CMA: cma_listen_on_dev, error -98 [ 298.365595][ T5913] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 298.397187][ T7973] lo speed is unknown, defaulting to 1000 [ 298.415635][ T7973] lo speed is unknown, defaulting to 1000 [ 298.434952][ T7973] lo speed is unknown, defaulting to 1000 [ 298.456435][ T7973] lo speed is unknown, defaulting to 1000 [ 298.475226][ T7973] lo speed is unknown, defaulting to 1000 [ 299.012530][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 299.130584][ T5913] usb 4-1: config index 0 descriptor too short (expected 25627, got 27) [ 299.160379][ T5913] usb 4-1: config 0 has too many interfaces: 179, using maximum allowed: 32 [ 299.304218][ T5913] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 179 [ 299.314299][ T5913] usb 4-1: config 0 has no interface number 0 [ 299.335825][ T7981] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 299.357083][ T5913] usb 4-1: config 0 interface 4 has no altsetting 0 [ 300.294192][ T5913] usb 4-1: config 0 interface 4 has no altsetting 1 [ 300.305736][ T5913] usb 4-1: New USB device found, idVendor=eb1a, idProduct=2750, bcdDevice=e2.82 [ 300.314899][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.332628][ T5913] usb 4-1: config 0 descriptor?? [ 300.558678][ T5913] usb 4-1: string descriptor 0 read error: -71 [ 300.612152][ T5913] usb 4-1: USB disconnect, device number 29 [ 301.008581][ T8004] ntfs3(nullb0): Primary boot signature is not NTFS. [ 301.018358][ T8004] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 301.554257][ T7981] netlink: 'syz.2.447': attribute type 1 has an invalid length. [ 301.600915][ T7981] netlink: 232 bytes leftover after parsing attributes in process `syz.2.447'. [ 301.641158][ T7981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.447'. [ 301.720890][ T8009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.453'. [ 301.751245][ T8009] netlink: 20 bytes leftover after parsing attributes in process `syz.3.453'. [ 302.335530][ T8022] 9pnet_fd: Insufficient options for proto=fd [ 302.599912][ T8033] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 302.600348][ T8026] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 304.617943][ T8063] netlink: 'syz.1.468': attribute type 1 has an invalid length. [ 304.648603][ T8065] ALSA: mixer_oss: invalid index 40000 [ 304.654366][ T8065] ALSA: mixer_oss: invalid OSS volume '' [ 304.698314][ T8063] netlink: 20 bytes leftover after parsing attributes in process `syz.1.468'. [ 304.901783][ T5933] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 305.253207][ T5933] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 305.262421][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 305.282549][ T5933] usb 4-1: config 0 descriptor?? [ 305.358403][ T8079] 9pnet_virtio: no channels available for device syz [ 306.200505][ T8074] xt_hashlimit: max too large, truncated to 1048576 [ 306.218134][ T5933] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 306.564727][ T8085] 9pnet_virtio: no channels available for device syz [ 307.221095][ T5933] [drm:udl_init] *ERROR* Selecting channel failed [ 307.398233][ T5933] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 307.469895][ T5933] [drm] Initialized udl on minor 2 [ 307.499131][ T5933] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 307.554292][ T5933] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 307.627239][ T9] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 307.662025][ T8091] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 307.678629][ T9] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 307.688341][ T5933] usb 4-1: USB disconnect, device number 30 [ 309.749257][ T8114] netlink: 'syz.0.480': attribute type 10 has an invalid length. [ 310.968549][ T8118] workqueue: name exceeds WQ_NAME_LEN. Truncating to: !寿$ULvyآDUDw}z [ 311.616532][ T8136] 9pnet_virtio: no channels available for device syz [ 312.248656][ T5854] Bluetooth: hci5: command 0x0405 tx timeout [ 312.896941][ T8142] delete_channel: no stack [ 317.338714][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.349990][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.728684][ T8182] program syz.3.494 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 317.797662][ T8183] netlink: 4 bytes leftover after parsing attributes in process `syz.3.494'. [ 318.222513][ T8183] team0: Port device team_slave_0 removed [ 318.634347][ T8202] 9pnet_virtio: no channels available for device syz [ 319.487425][ T6007] usb 1-1: new full-speed USB device number 20 using dummy_hcd [ 319.691598][ T6007] usb 1-1: device descriptor read/64, error -71 [ 319.961388][ T6007] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 320.131083][ T6007] usb 1-1: device descriptor read/64, error -71 [ 320.254969][ T43] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 320.302147][ T6007] usb usb1-port1: attempt power cycle [ 320.392777][ T8219] 9pnet_fd: Insufficient options for proto=fd [ 320.439338][ T43] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 320.542732][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 320.941194][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 320.975153][ T6007] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 320.993657][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.013601][ T6007] usb 1-1: device descriptor read/8, error -71 [ 321.032520][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 321.065425][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 321.189158][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.222232][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 321.244954][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 321.307655][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.328386][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 321.359299][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 321.387320][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.402232][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 321.422559][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 321.433869][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 321.455330][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 321.517211][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 321.972016][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 322.130525][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 322.153834][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 322.409148][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 322.418221][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 322.427915][ T43] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 322.438964][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 322.453064][ T43] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 322.462248][ T43] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 322.471461][ T43] usb 3-1: Product: syz [ 322.475760][ T43] usb 3-1: Manufacturer: syz [ 322.481406][ T43] usb 3-1: SerialNumber: syz [ 322.491990][ T43] usb 3-1: config 0 descriptor?? [ 322.512251][ T43] yurex 3-1:0.0: USB YUREX device now attached to Yurex #0 [ 322.864986][ T9] usb 3-1: USB disconnect, device number 11 [ 322.871094][ T43] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 323.021694][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 323.082448][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 323.088608][ T9] yurex 3-1:0.0: USB YUREX #0 now disconnected [ 323.197927][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 323.266020][ T43] usb 2-1: New USB device found, idVendor=056a, idProduct=033d, bcdDevice= 0.00 [ 323.340168][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 323.874623][ T8255] loop2: detected capacity change from 0 to 14 [ 323.887107][ T43] usb 2-1: config 0 descriptor?? [ 323.907587][ T8255] Dev loop2: unable to read RDB block 14 [ 323.931218][ T8255] loop2: AHDI p1 p2 p3 [ 323.939547][ T8255] loop2: partition table partially beyond EOD, truncated [ 323.987818][ T8255] loop2: p1 start 1601398130 is beyond EOD, truncated [ 324.018991][ T8255] loop2: p2 start 1702059890 is beyond EOD, truncated [ 324.142255][ T6007] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 324.311181][ T5933] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 324.331498][ T5205] Dev loop2: unable to read RDB block 14 [ 324.337414][ T5205] loop2: AHDI p1 p2 p3 [ 324.376219][ T5205] loop2: partition table partially beyond EOD, truncated [ 324.391586][ T5205] loop2: p1 start 1601398130 is beyond EOD, truncated [ 324.418234][ T5205] loop2: p2 start 1702059890 is beyond EOD, truncated [ 324.441157][ T6007] usb 1-1: Using ep0 maxpacket: 8 [ 324.485716][ T6007] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 324.506210][ T5933] usb 6-1: Using ep0 maxpacket: 16 [ 324.517212][ T6007] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 324.528573][ T5933] usb 6-1: config 0 has an invalid interface number: 18 but max is 0 [ 324.557614][ T6007] usb 1-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.40 [ 324.561438][ T5933] usb 6-1: config 0 has no interface number 0 [ 324.573463][ T6007] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.601510][ T5933] usb 6-1: config 0 interface 18 has no altsetting 0 [ 324.606137][ T6007] usb 1-1: Product: syz [ 324.611318][ T5933] usb 6-1: New USB device found, idVendor=55aa, idProduct=a103, bcdDevice=7a.1a [ 324.625893][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.626416][ T6007] usb 1-1: Manufacturer: syz [ 324.635111][ T5933] usb 6-1: Product: syz [ 324.648417][ T5933] usb 6-1: Manufacturer: syz [ 324.659754][ T5933] usb 6-1: SerialNumber: syz [ 324.664762][ T6007] usb 1-1: SerialNumber: syz [ 324.675792][ T5933] usb 6-1: config 0 descriptor?? [ 324.713446][ T5205] Dev loop2: unable to read RDB block 14 [ 324.720553][ T5933] ums-sddr55 6-1:0.18: USB Mass Storage device detected [ 324.729473][ T5205] loop2: AHDI p1 p2 p3 [ 324.739637][ T5205] loop2: partition table partially beyond EOD, truncated [ 324.767731][ T5205] loop2: p1 start 1601398130 is beyond EOD, truncated [ 324.776956][ T5205] loop2: p2 start 1702059890 is beyond EOD, truncated [ 324.912211][ T5933] usb 6-1: USB disconnect, device number 21 [ 324.926947][ T8254] netlink: 'syz.0.510': attribute type 10 has an invalid length. [ 324.935132][ T8254] netlink: 40 bytes leftover after parsing attributes in process `syz.0.510'. [ 324.946438][ T8254] batman_adv: batadv0: Adding interface: virt_wifi0 [ 324.953135][ T8254] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 324.978846][ C1] vkms_vblank_simulate: vblank timer overrun [ 324.987533][ T8254] batman_adv: batadv0: Interface activated: virt_wifi0 [ 325.083506][ T9] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 325.341947][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 325.377181][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 325.435687][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 325.485363][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 325.519497][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.547092][ T9] usb 3-1: Product: syz [ 325.558787][ T9] usb 3-1: Manufacturer: syz [ 325.559074][ T6007] usbhid 1-1:1.0: can't add hid device: -22 [ 325.569122][ T9] usb 3-1: SerialNumber: syz [ 325.600575][ T6007] usbhid 1-1:1.0: probe with driver usbhid failed with error -22 [ 325.604799][ T9] usb 3-1: config 0 descriptor?? [ 325.630234][ T8281] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(13) [ 325.637037][ T8281] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 325.645917][ T8281] vhci_hcd vhci_hcd.0: Device attached [ 325.672254][ T9] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 325.691318][ T9] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 325.703620][ T6007] usb 1-1: USB disconnect, device number 24 [ 326.121240][ T5933] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 326.158262][ T43] usbhid 2-1:0.0: can't add hid device: -71 [ 326.196586][ T43] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 326.220913][ T43] usb 2-1: USB disconnect, device number 17 [ 326.342555][ T9] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 326.378222][ T9] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 326.395236][ T9] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 326.395262][ T9] em28xx 3-1:0.0: No AC97 audio processor [ 326.401553][ T8282] vhci_hcd: connection reset by peer [ 326.417254][ T49] vhci_hcd: stop threads [ 326.417802][ T49] vhci_hcd: release socket [ 326.418660][ T49] vhci_hcd: disconnect device [ 326.459474][ T8294] netlink: 'syz.1.516': attribute type 1 has an invalid length. [ 326.500061][ T8294] netlink: 224 bytes leftover after parsing attributes in process `syz.1.516'. [ 326.618435][ T30] audit: type=1326 audit(1754895893.188:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8297 comm="syz.5.518" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f263c98ebe9 code=0x7fc00000 [ 326.695832][ T30] audit: type=1326 audit(1754895893.268:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.696180][ T30] audit: type=1326 audit(1754895893.268:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=40 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.696393][ T30] audit: type=1326 audit(1754895893.268:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.696842][ T30] audit: type=1326 audit(1754895893.268:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.697053][ T30] audit: type=1326 audit(1754895893.268:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=213 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.697379][ T30] audit: type=1326 audit(1754895893.268:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.697559][ T30] audit: type=1326 audit(1754895893.268:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.697887][ T30] audit: type=1326 audit(1754895893.268:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=233 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 326.698097][ T30] audit: type=1326 audit(1754895893.268:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8301 comm="syz.0.519" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43e3b8ebe9 code=0x7ffc0000 [ 327.225415][ C1] vkms_vblank_simulate: vblank timer overrun [ 327.439282][ T5913] usb 3-1: USB disconnect, device number 12 [ 327.493524][ C1] vkms_vblank_simulate: vblank timer overrun [ 328.392881][ T5913] em28xx 3-1:0.0: Disconnecting em28xx [ 328.656940][ T5913] em28xx 3-1:0.0: Freeing device [ 330.916587][ T8344] netlink: 'syz.1.527': attribute type 10 has an invalid length. [ 331.971576][ T5933] vhci_hcd: vhci_device speed not set [ 332.039234][ T8344] team0: Port device wlan1 added [ 332.671239][ T6007] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 332.883912][ T6007] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 332.901128][ T6007] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.987769][ T6007] usb 1-1: Product: syz [ 333.024470][ T6007] usb 1-1: Manufacturer: syz [ 333.029122][ T6007] usb 1-1: SerialNumber: syz [ 333.380905][ T8367] tmpfs: Unknown parameter 'gquota_block_hardlimit' [ 333.761262][ T6007] usb 1-1: config 0 descriptor?? [ 334.038663][ T8353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.092174][ T8353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.129088][ T6007] hso 1-1:0.0: Failed to find BULK IN ep [ 334.477107][ T6007] usb-storage 1-1:0.0: USB Mass Storage device detected [ 334.806426][ T8380] netlink: 14 bytes leftover after parsing attributes in process `syz.3.537'. [ 334.821809][ T6007] usb 1-1: USB disconnect, device number 25 [ 336.355263][ T8394] 9pnet_virtio: no channels available for device syz [ 336.407572][ T8390] netlink: 'syz.0.541': attribute type 11 has an invalid length. [ 336.769877][ T8380] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 336.866204][ T8380] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 336.924740][ T8380] bond0 (unregistering): Released all slaves [ 338.272549][ T43] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 338.362170][ T8430] netlink: 96 bytes leftover after parsing attributes in process `syz.3.546'. [ 338.971272][ T43] usb 3-1: config 0 has an invalid interface number: 139 but max is 0 [ 339.030245][ T43] usb 3-1: config 0 has no interface number 0 [ 339.055191][ T43] usb 3-1: config 0 interface 139 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 339.220437][ T5933] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 339.241254][ T43] usb 3-1: config 0 interface 139 altsetting 0 has an endpoint descriptor with address 0xBD, changing to 0x8D [ 339.271591][ T43] usb 3-1: config 0 interface 139 altsetting 0 endpoint 0x8D has invalid maxpacket 14158, setting to 64 [ 339.290809][ T43] usb 3-1: config 0 interface 139 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 339.346305][ T43] usb 3-1: New USB device found, idVendor=0711, idProduct=0210, bcdDevice=fd.d6 [ 339.376055][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.392200][ T43] usb 3-1: Product: syz [ 339.401201][ T43] usb 3-1: Manufacturer: syz [ 339.406132][ T43] usb 3-1: SerialNumber: syz [ 339.431983][ T43] usb 3-1: config 0 descriptor?? [ 339.448304][ T8419] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 339.470714][ T8419] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 339.484955][ T5933] usb 2-1: Using ep0 maxpacket: 16 [ 339.511074][ T5933] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 339.529722][ T5913] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 339.533411][ T5933] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 339.582929][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.620689][ T5933] usb 2-1: Product: syz [ 339.625112][ T5933] usb 2-1: Manufacturer: syz [ 339.629751][ T5933] usb 2-1: SerialNumber: syz [ 339.654565][ T5933] usb 2-1: config 0 descriptor?? [ 339.692649][ T5913] usb 4-1: Using ep0 maxpacket: 32 [ 339.710794][ T5933] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 339.728092][ T5933] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 339.731405][ T5913] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 339.774103][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.792410][ T43] mct_u232 3-1:0.139: MCT U232 converter detected [ 339.830253][ T5913] usb 4-1: config 0 descriptor?? [ 339.849643][ T43] usb 3-1: MCT U232 converter now attached to ttyUSB0 [ 339.903176][ T43] usb 3-1: USB disconnect, device number 13 [ 339.968957][ T43] mct_u232 ttyUSB0: MCT U232 converter now disconnected from ttyUSB0 [ 340.016259][ T43] mct_u232 3-1:0.139: device disconnected [ 340.067378][ T5913] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 340.127534][ T5913] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 340.185024][ T5913] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 340.212007][ T5913] usb 4-1: media controller created [ 340.275642][ T5933] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 340.277900][ T8429] netlink: 4 bytes leftover after parsing attributes in process `syz.1.547'. [ 340.353020][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 341.245598][ T5913] az6027: usb out operation failed. (-71) [ 341.272705][ T5913] az6027: usb out operation failed. (-71) [ 341.274983][ T5933] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 341.278481][ T5913] stb0899_attach: Driver disabled by Kconfig [ 341.278497][ T5913] az6027: no front-end attached [ 341.278497][ T5913] [ 341.280565][ T5913] az6027: usb out operation failed. (-71) [ 341.306243][ T5913] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 341.318582][ T5913] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input11 [ 341.342829][ T5913] dvb-usb: schedule remote query interval to 400 msecs. [ 341.360829][ T5913] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 341.373441][ T5913] usb 4-1: USB disconnect, device number 31 [ 341.408594][ T5933] em28xx 2-1:0.0: board has no eeprom [ 341.589258][ T5933] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 341.607105][ T5933] em28xx 2-1:0.0: dvb set to bulk mode. [ 341.631112][ T9] em28xx 2-1:0.0: Binding DVB extension [ 341.730490][ T8467] netlink: 1284 bytes leftover after parsing attributes in process `syz.2.554'. [ 341.761802][ T5933] usb 2-1: USB disconnect, device number 18 [ 341.936102][ T5933] em28xx 2-1:0.0: Disconnecting em28xx [ 341.992840][ T5913] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 342.011189][ T8474] syz.3.555 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 342.635672][ T6010] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 342.853852][ T6010] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 342.888938][ T9] em28xx 2-1:0.0: Registering input extension [ 342.898158][ T5933] em28xx 2-1:0.0: Closing input extension [ 342.931311][ T6010] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 343.007129][ T6010] usb 6-1: config 0 descriptor?? [ 343.060415][ T5933] em28xx 2-1:0.0: Freeing device [ 343.279448][ T6010] usb 6-1: Cannot read MAC address [ 343.292034][ T6010] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 343.933561][ T6010] usb 6-1: USB disconnect, device number 22 [ 346.656125][ T8508] ================================================================== [ 346.664272][ T8508] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 [ 346.672504][ T8508] Read of size 1 at addr ffff8880282604b0 by task syz.1.566/8508 [ 346.680262][ T8508] [ 346.682624][ T8508] CPU: 0 UID: 0 PID: 8508 Comm: syz.1.566 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 346.682650][ T8508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 346.682664][ T8508] Call Trace: [ 346.682672][ T8508] [ 346.682681][ T8508] dump_stack_lvl+0x189/0x250 [ 346.682708][ T8508] ? rcu_is_watching+0x15/0xb0 [ 346.682731][ T8508] ? __kasan_check_byte+0x12/0x40 [ 346.682754][ T8508] ? __pfx_dump_stack_lvl+0x10/0x10 [ 346.682774][ T8508] ? rcu_is_watching+0x15/0xb0 [ 346.682796][ T8508] ? lock_release+0x4b/0x3e0 [ 346.682818][ T8508] ? __virt_addr_valid+0x1c8/0x5c0 [ 346.682842][ T8508] ? __virt_addr_valid+0x4a5/0x5c0 [ 346.682868][ T8508] print_report+0xca/0x240 [ 346.682897][ T8508] ? _raw_spin_lock_irqsave+0xa7/0xf0 [ 346.682928][ T8508] kasan_report+0x118/0x150 [ 346.682950][ T8508] ? _raw_spin_lock_irqsave+0xa7/0xf0 [ 346.682984][ T8508] ? remove_wait_queue+0x24/0x120 [ 346.683009][ T8508] __kasan_check_byte+0x2a/0x40 [ 346.683030][ T8508] lock_acquire+0x8d/0x360 [ 346.683047][ T8508] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 346.683076][ T8508] _raw_spin_lock_irqsave+0xa7/0xf0 [ 346.683107][ T8508] ? remove_wait_queue+0x24/0x120 [ 346.683135][ T8508] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 346.683166][ T8508] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 346.683198][ T8508] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 346.683233][ T8508] remove_wait_queue+0x24/0x120 [ 346.683262][ T8508] poll_freewait+0xb1/0x240 [ 346.683284][ T8508] do_select+0x172f/0x17e0 [ 346.683308][ T8508] ? do_select+0xbb1/0x17e0 [ 346.683338][ T8508] ? __pfx_do_select+0x10/0x10 [ 346.683357][ T8508] ? tun_get_user+0x2549/0x3ce0 [ 346.683390][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683412][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683435][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683457][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683488][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683510][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683532][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683562][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683584][ T8508] ? __pfx_pollwake+0x10/0x10 [ 346.683617][ T8508] core_sys_select+0x6dd/0xa20 [ 346.683644][ T8508] ? __pfx_core_sys_select+0x10/0x10 [ 346.683677][ T8508] ? __pfx_set_user_sigmask+0x10/0x10 [ 346.683698][ T8508] ? smack_file_ioctl+0x24a/0x340 [ 346.683724][ T8508] __se_sys_pselect6+0x27a/0x300 [ 346.683747][ T8508] ? __pfx___se_sys_pselect6+0x10/0x10 [ 346.683768][ T8508] ? rcu_is_watching+0x15/0xb0 [ 346.683793][ T8508] ? __x64_sys_pselect6+0x21/0xf0 [ 346.683815][ T8508] do_syscall_64+0xfa/0x3b0 [ 346.683835][ T8508] ? lockdep_hardirqs_on+0x9c/0x150 [ 346.683855][ T8508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.683876][ T8508] ? clear_bhb_loop+0x60/0xb0 [ 346.683899][ T8508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.683919][ T8508] RIP: 0033:0x7f909f78ebe9 [ 346.683938][ T8508] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 346.683957][ T8508] RSP: 002b:00007f90a0521038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 346.683980][ T8508] RAX: ffffffffffffffda RBX: 00007f909f9b5fa0 RCX: 00007f909f78ebe9 [ 346.683997][ T8508] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000040 [ 346.684011][ T8508] RBP: 00007f909f811e19 R08: 0000000000000000 R09: 0000000000000000 [ 346.684031][ T8508] R10: 0000200000000540 R11: 0000000000000246 R12: 0000000000000000 [ 346.684045][ T8508] R13: 00007f909f9b6038 R14: 00007f909f9b5fa0 R15: 00007ffeda0238e8 [ 346.684070][ T8508] [ 346.684077][ T8508] [ 347.031666][ T8508] Allocated by task 8422: [ 347.036011][ T8508] kasan_save_track+0x3e/0x80 [ 347.040718][ T8508] __kasan_kmalloc+0x93/0xb0 [ 347.045312][ T8508] __kmalloc_cache_noprof+0x230/0x3d0 [ 347.050804][ T8508] comedi_device_postconfig+0x4a8/0xc90 [ 347.056365][ T8508] comedi_device_attach+0x53a/0x670 [ 347.061572][ T8508] comedi_unlocked_ioctl+0x686/0xfc0 [ 347.066861][ T8508] __se_sys_ioctl+0xfc/0x170 [ 347.071478][ T8508] do_syscall_64+0xfa/0x3b0 [ 347.075988][ T8508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.081976][ T8508] [ 347.084306][ T8508] Freed by task 8514: [ 347.088300][ T8508] kasan_save_track+0x3e/0x80 [ 347.092995][ T8508] kasan_save_free_info+0x46/0x50 [ 347.098037][ T8508] __kasan_slab_free+0x62/0x70 [ 347.102808][ T8508] kfree+0x18e/0x440 [ 347.106722][ T8508] comedi_device_detach+0x372/0x720 [ 347.111931][ T8508] comedi_unlocked_ioctl+0xbd2/0xfc0 [ 347.117305][ T8508] __se_sys_ioctl+0xfc/0x170 [ 347.121906][ T8508] do_syscall_64+0xfa/0x3b0 [ 347.126434][ T8508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.132341][ T8508] [ 347.134672][ T8508] The buggy address belongs to the object at ffff888028260400 [ 347.134672][ T8508] which belongs to the cache kmalloc-256 of size 256 [ 347.148732][ T8508] The buggy address is located 176 bytes inside of [ 347.148732][ T8508] freed 256-byte region [ffff888028260400, ffff888028260500) [ 347.162532][ T8508] [ 347.164870][ T8508] The buggy address belongs to the physical page: [ 347.171286][ T8508] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28260 [ 347.180056][ T8508] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 347.188707][ T8508] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 347.196283][ T8508] page_type: f5(slab) [ 347.200282][ T8508] raw: 00fff00000000040 ffff88801a441b40 dead000000000100 dead000000000122 [ 347.208887][ T8508] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 347.217498][ T8508] head: 00fff00000000040 ffff88801a441b40 dead000000000100 dead000000000122 [ 347.226184][ T8508] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 347.234863][ T8508] head: 00fff00000000001 ffffea0000a09801 00000000ffffffff 00000000ffffffff [ 347.243540][ T8508] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 347.252214][ T8508] page dumped because: kasan: bad access detected [ 347.258697][ T8508] page_owner tracks the page as allocated [ 347.264415][ T8508] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11987290152, free_ts 0 [ 347.284182][ T8508] post_alloc_hook+0x240/0x2a0 [ 347.288967][ T8508] get_page_from_freelist+0x21d5/0x22b0 [ 347.294528][ T8508] __alloc_frozen_pages_noprof+0x181/0x370 [ 347.300346][ T8508] alloc_pages_mpol+0x232/0x4a0 [ 347.305202][ T8508] allocate_slab+0x8a/0x3b0 [ 347.309719][ T8508] ___slab_alloc+0xbfc/0x1480 [ 347.314401][ T8508] __kmalloc_cache_noprof+0x296/0x3d0 [ 347.319783][ T8508] bus_add_driver+0x162/0x640 [ 347.324472][ T8508] driver_register+0x23a/0x320 [ 347.329240][ T8508] usb_register_device_driver+0x14e/0x1f0 [ 347.334971][ T8508] do_one_initcall+0x233/0x820 [ 347.339749][ T8508] do_initcall_level+0x137/0x1f0 [ 347.344695][ T8508] do_initcalls+0x69/0xd0 [ 347.349030][ T8508] kernel_init_freeable+0x3d9/0x570 [ 347.354240][ T8508] kernel_init+0x1d/0x1d0 [ 347.358577][ T8508] ret_from_fork+0x3fc/0x770 [ 347.363178][ T8508] page_owner free stack trace missing [ 347.368550][ T8508] [ 347.370877][ T8508] Memory state around the buggy address: [ 347.376513][ T8508] ffff888028260380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.384691][ T8508] ffff888028260400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 347.392761][ T8508] >ffff888028260480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 347.400820][ T8508] ^ [ 347.406456][ T8508] ffff888028260500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.414544][ T8508] ffff888028260580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 347.422640][ T8508] ================================================================== [ 347.430714][ T8508] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 347.437920][ T8508] CPU: 0 UID: 0 PID: 8508 Comm: syz.1.566 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 347.447827][ T8508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 347.457889][ T8508] Call Trace: [ 347.461178][ T8508] [ 347.464125][ T8508] dump_stack_lvl+0x99/0x250 [ 347.468732][ T8508] ? __asan_memcpy+0x40/0x70 [ 347.473340][ T8508] ? __pfx_dump_stack_lvl+0x10/0x10 [ 347.478553][ T8508] ? __pfx__printk+0x10/0x10 [ 347.483156][ T8508] panic+0x2db/0x790 [ 347.487064][ T8508] ? __pfx_panic+0x10/0x10 [ 347.491500][ T8508] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 347.497425][ T8508] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 347.503773][ T8508] ? print_memory_metadata+0x314/0x400 [ 347.509246][ T8508] ? _raw_spin_lock_irqsave+0xa7/0xf0 [ 347.514634][ T8508] check_panic_on_warn+0x89/0xb0 [ 347.519584][ T8508] ? _raw_spin_lock_irqsave+0xa7/0xf0 [ 347.524978][ T8508] end_report+0x78/0x160 [ 347.529238][ T8508] kasan_report+0x129/0x150 [ 347.533754][ T8508] ? _raw_spin_lock_irqsave+0xa7/0xf0 [ 347.539163][ T8508] ? remove_wait_queue+0x24/0x120 [ 347.544214][ T8508] __kasan_check_byte+0x2a/0x40 [ 347.549094][ T8508] lock_acquire+0x8d/0x360 [ 347.553526][ T8508] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 347.558923][ T8508] _raw_spin_lock_irqsave+0xa7/0xf0 [ 347.564147][ T8508] ? remove_wait_queue+0x24/0x120 [ 347.569189][ T8508] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 347.575453][ T8508] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 347.581363][ T8508] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 347.587713][ T8508] remove_wait_queue+0x24/0x120 [ 347.592705][ T8508] poll_freewait+0xb1/0x240 [ 347.597221][ T8508] do_select+0x172f/0x17e0 [ 347.601653][ T8508] ? do_select+0xbb1/0x17e0 [ 347.606182][ T8508] ? __pfx_do_select+0x10/0x10 [ 347.610952][ T8508] ? tun_get_user+0x2549/0x3ce0 [ 347.615828][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.620550][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.625236][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.629920][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.634609][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.639293][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.643983][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.648665][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.653357][ T8508] ? __pfx_pollwake+0x10/0x10 [ 347.658056][ T8508] core_sys_select+0x6dd/0xa20 [ 347.662830][ T8508] ? __pfx_core_sys_select+0x10/0x10 [ 347.668130][ T8508] ? __pfx_set_user_sigmask+0x10/0x10 [ 347.673531][ T8508] ? smack_file_ioctl+0x24a/0x340 [ 347.678575][ T8508] __se_sys_pselect6+0x27a/0x300 [ 347.683522][ T8508] ? __pfx___se_sys_pselect6+0x10/0x10 [ 347.689008][ T8508] ? rcu_is_watching+0x15/0xb0 [ 347.693800][ T8508] ? __x64_sys_pselect6+0x21/0xf0 [ 347.698842][ T8508] do_syscall_64+0xfa/0x3b0 [ 347.703642][ T8508] ? lockdep_hardirqs_on+0x9c/0x150 [ 347.708858][ T8508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.714937][ T8508] ? clear_bhb_loop+0x60/0xb0 [ 347.719634][ T8508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 347.725542][ T8508] RIP: 0033:0x7f909f78ebe9 [ 347.729971][ T8508] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 347.749691][ T8508] RSP: 002b:00007f90a0521038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 347.758120][ T8508] RAX: ffffffffffffffda RBX: 00007f909f9b5fa0 RCX: 00007f909f78ebe9 [ 347.766107][ T8508] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000040 [ 347.774086][ T8508] RBP: 00007f909f811e19 R08: 0000000000000000 R09: 0000000000000000 [ 347.782064][ T8508] R10: 0000200000000540 R11: 0000000000000246 R12: 0000000000000000 [ 347.790040][ T8508] R13: 00007f909f9b6038 R14: 00007f909f9b5fa0 R15: 00007ffeda0238e8 [ 347.798029][ T8508] [ 347.801312][ T8508] Kernel Offset: disabled [ 347.805638][ T8508] Rebooting in 86400 seconds..