last executing test programs: 14.133048372s ago: executing program 0 (id=294): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) r0 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 13.155698024s ago: executing program 0 (id=296): socket$inet(0x2, 0x4, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x3, 0x0, &(0x7f0000000300)) timer_settime(0x0, 0x0, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000180)=@secondary) r1 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 10.678874522s ago: executing program 1 (id=299): keyctl$setperm(0x5, 0x0, 0x4221030) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1a1740, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x2, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0xf, 0x7, 0x40100000003, 0x68, 0x9, 0x8, 0xcf, 0x0, 0x1800000000000000, 0x7ffffffffffffffc, 0x6, 0x2, 0x5, 0x7fff, 0x80], 0x0, 0x1819c4}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 10.678753032s ago: executing program 2 (id=300): socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffff9c, &(0x7f00000003c0), 0xa00, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000f40)={0x1000008, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r3}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r0, r1, 0x0) 9.499004929s ago: executing program 0 (id=303): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x1000, 0x101c, 0x10, 0x4, 0x401, 0x100, 0xa, 0x0, 0x52, 0x43, 0x7e9, 0x401, 0x9aa5, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) close_range(r0, 0xffffffffffffffff, 0x0) 7.910454666s ago: executing program 1 (id=305): openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x2980, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$xdp(0x2c, 0x3, 0x0) r1 = userfaultfd(0x80001) syz_emit_ethernet(0x1e, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x2000000}, 0x40080c0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x9, 0x8000000000000002, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000100)={0x1ff, 0x0, 0x4, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 7.890891706s ago: executing program 0 (id=306): socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x20000000, 0x100, 0x4, 0x63dd1ea1, 0x1}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e30600"/16], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x3ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f0000003100)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000030c0)={&(0x7f0000003140)=@delchain={0x24, 0x65, 0x10, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x5, 0x7}, {0xffff, 0xd}, {0x2, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8044}, 0x40008c5) openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev/mtdblock0\x00', 0x8800, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r5, r4, 0x0, 0x20000) 6.791186522s ago: executing program 1 (id=307): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x9) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) 6.542330458s ago: executing program 2 (id=308): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r0, &(0x7f0000000480)={0x2020}, 0x2020) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@code={0xa, 0x18, {"b80000c0fe3acb80"}}], 0xd3}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000340)={[{0x22e, 0x2, 0xfe, 0x0, 0x0, 0x88, 0x0, 0x0, 0x5, 0xff, 0x1f}, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfd, 0x0, 0x4, 0x20, 0xfd, 0x1000000}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.512008988s ago: executing program 1 (id=309): openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/test_subsys/namespaces/1/ana_grpid\x00', 0x2, 0x0) 6.343205393s ago: executing program 0 (id=310): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1d000000070000000800000022", @ANYBLOB], 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_trace_dev_match', 0x100, 0xa5) read$FUSE(r4, &(0x7f0000003b40)={0x2020}, 0x2020) 6.290971903s ago: executing program 1 (id=311): socket$inet(0x2, 0x4, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x3, 0x0, &(0x7f0000000300)) timer_settime(0x0, 0x0, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r2, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 6.287180974s ago: executing program 3 (id=312): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_usb_connect(0x2, 0x24, &(0x7f0000001b40)={{0x12, 0x1, 0x300, 0xaa, 0x7c, 0x5f, 0x20, 0xeb1, 0x7007, 0x208, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x35, 0x2, 0x50, 0xa0, "", [{{0x9, 0x4, 0x9a, 0x4, 0x0, 0x66, 0x97, 0x5c, 0x1}}]}}]}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3f31f000a0000000001060001"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)="f5", 0x1}], 0x1, 0x0, 0x0, 0x4044040}}], 0x1, 0x40015) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x24008000}, 0x4040000) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8931, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000) 4.668025051s ago: executing program 0 (id=313): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) writev(r0, &(0x7f0000006280)=[{&(0x7f00000041c0)="d2", 0x1}], 0x1) 4.546679594s ago: executing program 2 (id=314): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x1000, 0x101c, 0x10, 0x4, 0x401, 0x100, 0xa, 0x0, 0x52, 0x43, 0x7e9, 0x401, 0x9aa5, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) close_range(r0, 0xffffffffffffffff, 0x0) 3.459888339s ago: executing program 2 (id=315): openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x2980, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$xdp(0x2c, 0x3, 0x0) userfaultfd(0x80001) syz_emit_ethernet(0x1e, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x2000000}, 0x40080c0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x9, 0x8000000000000002, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000100)={0x1ff, 0x0, 0x4, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 1.550364464s ago: executing program 3 (id=316): socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffff9c, &(0x7f00000003c0), 0xa00, 0x0) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x80580, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000f40)={0x1000008, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r3}) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r0, r1, 0x0) 1.235801031s ago: executing program 2 (id=317): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x9) syz_clone(0x2280700, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) 1.130746633s ago: executing program 3 (id=318): r0 = socket(0x400000000010, 0x2, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0x8, 0x9}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xe0000000, 0x5, 0xb7, 0x2, 0x2, 0x1, 0x4, 0x3, 0x1}}}}]}, 0x58}}, 0x4000) 921.198688ms ago: executing program 2 (id=319): socket$kcm(0x2b, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x8, 0x8ab5, 0x10001, 0x20000000, 0x100, 0x4, 0x63dd1ea1, 0x1}, 0x0, 0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e30600"/16], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000100)=""/222, &(0x7f0000000000)=0x3ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) r1 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000, 0x840) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$EVIOCRMFF(r1, 0x550c, 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400)='jffs2\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x20000000) sendmsg$nl_route_sched(r0, &(0x7f0000003100)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000030c0)={&(0x7f0000003140)=@delchain={0x24, 0x65, 0x10, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x5, 0x7}, {0xffff, 0xd}, {0x2, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x8044}, 0x40008c5) openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x42, 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/test\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) sendfile(r4, 0xffffffffffffffff, 0x0, 0x20000) 920.286548ms ago: executing program 3 (id=320): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f00000500070084000000060005"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x20000040) r0 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 706.901133ms ago: executing program 3 (id=321): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1d000000070000000800000022", @ANYBLOB], 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_trace_dev_match', 0x100, 0xa5) read$FUSE(r4, &(0x7f0000003b40)={0x2020}, 0x2020) 593.800156ms ago: executing program 1 (id=322): openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/test_subsys/namespaces/1/ana_grpid\x00', 0x2, 0x0) 0s ago: executing program 3 (id=323): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$can_j1939(0x1d, 0x2, 0x7) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) syz_clone3(0x0, 0x0) io_setup(0x8, &(0x7f0000000280)=0x0) io_submit(r5, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 59.047985][ T5435] 8021q: adding VLAN 0 to HW filter on device bond0 [ 59.068033][ T5435] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.49' (ED25519) to the list of known hosts. syzkaller login: [ 84.253018][ T5764] cgroup: Unknown subsys name 'net' [ 84.386150][ T5764] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.051435][ T5764] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.965002][ T5794] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.973820][ T5794] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.993220][ T5786] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.997651][ T5794] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.011960][ T5787] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.020339][ T5789] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.025365][ T5787] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.030475][ T5789] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.038185][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.044394][ T5789] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.049959][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.056999][ T5789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.066672][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.071383][ T5789] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 88.083744][ T5786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.089090][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 88.096151][ T5789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.102977][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.106799][ T5789] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.112857][ T5787] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.119738][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.133601][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 88.141842][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.150574][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.632834][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 88.722469][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 88.759760][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 88.857913][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.865847][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.873507][ T5779] bridge_slave_0: entered allmulticast mode [ 88.880707][ T5779] bridge_slave_0: entered promiscuous mode [ 88.916475][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.924163][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.931949][ T5779] bridge_slave_1: entered allmulticast mode [ 88.939150][ T5779] bridge_slave_1: entered promiscuous mode [ 89.019320][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.067647][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.077870][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.085076][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.092541][ T5776] bridge_slave_0: entered allmulticast mode [ 89.100166][ T5776] bridge_slave_0: entered promiscuous mode [ 89.108573][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 89.122593][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.129876][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.138221][ T5785] bridge_slave_0: entered allmulticast mode [ 89.145417][ T5785] bridge_slave_0: entered promiscuous mode [ 89.164907][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.172235][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.179930][ T5785] bridge_slave_1: entered allmulticast mode [ 89.186992][ T5785] bridge_slave_1: entered promiscuous mode [ 89.194236][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.202139][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.209525][ T5776] bridge_slave_1: entered allmulticast mode [ 89.216718][ T5776] bridge_slave_1: entered promiscuous mode [ 89.279056][ T5779] team0: Port device team_slave_0 added [ 89.318639][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.329539][ T5779] team0: Port device team_slave_1 added [ 89.341345][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.353508][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.398204][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.481522][ T5776] team0: Port device team_slave_0 added [ 89.499545][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.506567][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.533010][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.549104][ T5785] team0: Port device team_slave_0 added [ 89.560216][ T5776] team0: Port device team_slave_1 added [ 89.596632][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.604246][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.630847][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.651149][ T5785] team0: Port device team_slave_1 added [ 89.658397][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.665573][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.673166][ T5777] bridge_slave_0: entered allmulticast mode [ 89.680986][ T5777] bridge_slave_0: entered promiscuous mode [ 89.702967][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.710031][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.736410][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.750603][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.760973][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.787282][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.810475][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.817924][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.825081][ T5777] bridge_slave_1: entered allmulticast mode [ 89.833222][ T5777] bridge_slave_1: entered promiscuous mode [ 89.884959][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.892218][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.918288][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.974575][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.983130][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.012188][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.025866][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.044001][ T5776] hsr_slave_0: entered promiscuous mode [ 90.051871][ T5776] hsr_slave_1: entered promiscuous mode [ 90.065388][ T5779] hsr_slave_0: entered promiscuous mode [ 90.072224][ T5779] hsr_slave_1: entered promiscuous mode [ 90.078944][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.086840][ T5779] Cannot create hsr debugfs directory [ 90.100746][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.136514][ T5777] team0: Port device team_slave_0 added [ 90.146596][ T5777] team0: Port device team_slave_1 added [ 90.231768][ T5085] Bluetooth: hci2: command tx timeout [ 90.231787][ T51] Bluetooth: hci1: command tx timeout [ 90.232099][ T51] Bluetooth: hci3: command tx timeout [ 90.239204][ T5792] Bluetooth: hci0: command tx timeout [ 90.265761][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.273061][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.299517][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.357849][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.364852][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.397691][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.440918][ T5785] hsr_slave_0: entered promiscuous mode [ 90.448143][ T5785] hsr_slave_1: entered promiscuous mode [ 90.454551][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.462634][ T5785] Cannot create hsr debugfs directory [ 90.588383][ T5777] hsr_slave_0: entered promiscuous mode [ 90.597796][ T5777] hsr_slave_1: entered promiscuous mode [ 90.604429][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 90.613023][ T5777] Cannot create hsr debugfs directory [ 90.888495][ T5776] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.912437][ T5776] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.926659][ T5776] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.952483][ T5776] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 91.042835][ T5779] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.063459][ T5779] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.075635][ T5779] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.091414][ T5779] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.176899][ T5785] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.190485][ T5785] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.202441][ T5785] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.213358][ T5785] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.324256][ T5777] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.339708][ T5777] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 91.354767][ T5777] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 91.366493][ T5777] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.419994][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.465793][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.499636][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.506969][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.526271][ T3502] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.533497][ T3502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.573135][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.628853][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.683159][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.711610][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.731510][ T3502] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.738844][ T3502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.760867][ T3502] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.768055][ T3502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.796699][ T3502] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.803939][ T3502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.816296][ T3502] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.823480][ T3502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.923859][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.995922][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.020558][ T5785] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 92.073151][ T3502] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.080383][ T3502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.135609][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.142854][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.153451][ T9] cfg80211: failed to load regulatory.db [ 92.307444][ T5792] Bluetooth: hci0: command tx timeout [ 92.312936][ T5792] Bluetooth: hci3: command tx timeout [ 92.318857][ T5792] Bluetooth: hci2: command tx timeout [ 92.324292][ T5792] Bluetooth: hci1: command tx timeout [ 92.388980][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.491598][ T5776] veth0_vlan: entered promiscuous mode [ 92.542762][ T5776] veth1_vlan: entered promiscuous mode [ 92.654936][ T5776] veth0_macvtap: entered promiscuous mode [ 92.671292][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.692828][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.721903][ T5776] veth1_macvtap: entered promiscuous mode [ 92.770786][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.803282][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.825666][ T5776] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.835455][ T5776] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.845647][ T5776] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.856472][ T5776] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.952269][ T5779] veth0_vlan: entered promiscuous mode [ 93.014092][ T5785] veth0_vlan: entered promiscuous mode [ 93.031451][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.054521][ T5779] veth1_vlan: entered promiscuous mode [ 93.073963][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.098579][ T5779] veth0_macvtap: entered promiscuous mode [ 93.106664][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.129202][ T5785] veth1_vlan: entered promiscuous mode [ 93.143760][ T5779] veth1_macvtap: entered promiscuous mode [ 93.225695][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.236849][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.248867][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.258036][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.272273][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.307808][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.319148][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.331388][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.341694][ T5785] veth0_macvtap: entered promiscuous mode [ 93.360155][ T5779] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.372683][ T5779] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.382141][ T5779] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.392398][ T5779] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.408155][ T5785] veth1_macvtap: entered promiscuous mode [ 93.451173][ T5777] veth0_vlan: entered promiscuous mode [ 93.478829][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.490313][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.502592][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 93.514434][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.529975][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.579187][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.592640][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.608601][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.619321][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.631104][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.645860][ T5785] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.656142][ T5785] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.665419][ T5785] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.675611][ T5785] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.768424][ T5777] veth1_vlan: entered promiscuous mode [ 93.793156][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.810698][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.916428][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.941711][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.971711][ T5777] veth0_macvtap: entered promiscuous mode [ 93.984663][ T5777] veth1_macvtap: entered promiscuous mode [ 94.045790][ T3502] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.072641][ T3502] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.138147][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.159953][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.181390][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.198960][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.212125][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 94.223231][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.043626][ T5853] Bluetooth: MGMT ver 1.22 [ 96.257099][ T5792] Bluetooth: hci1: command tx timeout [ 96.260946][ T5786] Bluetooth: hci2: command tx timeout [ 96.268056][ T51] Bluetooth: hci3: command tx timeout [ 96.268360][ T5085] Bluetooth: hci0: command tx timeout [ 96.280163][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.388379][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.423134][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.447101][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.478844][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.507214][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 96.527587][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.550011][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.582638][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.607819][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.616605][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.647114][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.685971][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.714748][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.909952][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.924580][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.051634][ T1328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.079478][ T1328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.144792][ T5858] process 'syz.2.7' launched './file1' with NULL argv: empty string added [ 98.167015][ C1] sched: RT throttling activated [ 98.339482][ T5085] Bluetooth: hci0: command tx timeout [ 98.347279][ T5085] Bluetooth: hci1: command tx timeout [ 98.352806][ T5085] Bluetooth: hci2: command tx timeout [ 98.479544][ T5085] Bluetooth: hci3: command tx timeout [ 98.792674][ T5869] Zero length message leads to an empty skb [ 100.441057][ T5869] tipc: Started in network mode [ 100.446111][ T5869] tipc: Node identity 7f000001, cluster identity 4711 [ 100.464370][ T5869] tipc: New replicast peer: 127.0.0.1 [ 100.489586][ T5869] tipc: Enabled bearer , priority 10 [ 100.651684][ T5877] syz.3.4[5877]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 102.090123][ T8] tipc: Node number set to 2130706433 [ 103.657670][ T970] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 104.987293][ T970] usb 2-1: Using ep0 maxpacket: 16 [ 105.130253][ T970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.044942][ T970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.117292][ T970] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 106.133016][ T970] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 106.147344][ T970] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.206040][ T970] usb 2-1: config 0 descriptor?? [ 106.747158][ T970] usbhid 2-1:0.0: can't add hid device: -71 [ 106.753491][ T970] usbhid: probe of 2-1:0.0 failed with error -71 [ 106.798575][ T970] usb 2-1: USB disconnect, device number 2 [ 106.819632][ T5907] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20'. [ 107.411877][ T5907] team0 (unregistering): Port device team_slave_0 removed [ 107.865950][ T5912] dccp_v6_rcv: dropped packet with invalid checksum [ 107.936581][ T5914] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 107.967822][ T5907] team0 (unregistering): Port device team_slave_1 removed [ 108.922137][ T5925] loop3: detected capacity change from 0 to 128 [ 108.936461][ T5925] ======================================================= [ 108.936461][ T5925] WARNING: The mand mount option has been deprecated and [ 108.936461][ T5925] and is ignored by this kernel. Remove the mand [ 108.936461][ T5925] option from the mount to silence this warning. [ 108.936461][ T5925] ======================================================= [ 109.002857][ T5925] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 109.015160][ T5925] hpfs: filesystem error: improperly stopped [ 109.021342][ T5925] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 109.030952][ T5925] hpfs: You really don't want any checks? You are crazy... [ 109.038362][ T5925] hpfs: Code page index out of array [ 109.043734][ T5925] hpfs: code page support is disabled [ 109.077289][ T5925] hpfs: hpfs_map_4sectors(): unaligned read [ 109.084932][ T5925] hpfs: hpfs_map_4sectors(): unaligned read [ 109.091054][ T5925] hpfs: filesystem error: unable to find root dir [ 109.148173][ T5925] hpfs: hpfs_map_4sectors(): unaligned read [ 112.874622][ T5887] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 113.130004][ T5887] usb 3-1: Using ep0 maxpacket: 16 [ 113.157634][ T5887] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 113.177057][ T5887] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 113.209844][ T5887] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 113.229382][ T5887] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.262003][ T5887] usb 3-1: Product: syz [ 113.266266][ T5887] usb 3-1: Manufacturer: syz [ 113.292142][ T5887] usb 3-1: SerialNumber: syz [ 113.538767][ T5887] usb 3-1: 0:2 : does not exist [ 113.596850][ T5887] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 114.338968][ T5887] usb 3-1: USB disconnect, device number 2 [ 114.410421][ T5966] netlink: 40 bytes leftover after parsing attributes in process `syz.3.37'. [ 114.523574][ T5778] udevd[5778]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 117.386041][ T5998] loop2: detected capacity change from 0 to 128 [ 117.937834][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 118.347452][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 118.757063][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 119.038136][ T5994] FAT-fs (loop2): error, invalid access to FAT (entry 0x0fff0000) [ 119.046298][ T5994] FAT-fs (loop2): Filesystem has been set read-only [ 119.055385][ T5994] FAT-fs (loop2): error, invalid access to FAT (entry 0x0fff0000) [ 124.537455][ T5875] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 124.762540][ T5875] usb 2-1: unable to get BOS descriptor or descriptor too short [ 124.792520][ T5875] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 124.822399][ T5875] usb 2-1: can't read configurations, error -71 [ 128.177242][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 131.307697][ T6062] netlink: 40 bytes leftover after parsing attributes in process `syz.1.60'. [ 133.112271][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.119004][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.010364][ T6076] loop5: detected capacity change from 0 to 7 [ 135.504523][ T6076] Dev loop5: unable to read RDB block 7 [ 135.527680][ T6076] loop5: AHDI p1 p2 p3 [ 135.535016][ T6076] loop5: partition table partially beyond EOD, truncated [ 135.609961][ T6076] loop5: p1 start 1601398130 is beyond EOD, truncated [ 135.616782][ T6076] loop5: p2 start 1702059890 is beyond EOD, truncated [ 138.409899][ T6097] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 144.372419][ T6144] netlink: 32 bytes leftover after parsing attributes in process `syz.3.78'. [ 146.097165][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 148.621525][ T6170] netlink: 4 bytes leftover after parsing attributes in process `syz.0.90'. [ 148.630791][ T6170] bridge_slave_1: left allmulticast mode [ 148.636446][ T6170] bridge_slave_1: left promiscuous mode [ 148.642904][ T6170] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.685220][ T6170] bridge_slave_0: left allmulticast mode [ 148.691235][ T6170] bridge_slave_0: left promiscuous mode [ 148.697151][ T6170] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.386209][ T6183] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 152.037647][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 159.185516][ T6224] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 162.581516][ T6235] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 164.017270][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 166.916597][ T6290] netlink: 32 bytes leftover after parsing attributes in process `syz.2.124'. [ 171.697801][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 179.099655][ T6356] netlink: 32 bytes leftover after parsing attributes in process `syz.0.140'. [ 181.937167][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 182.137790][ T6339] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 184.097151][ T970] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 184.308400][ T970] usb 2-1: unable to get BOS descriptor or descriptor too short [ 184.322098][ T970] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 184.330104][ T970] usb 2-1: can't read configurations, error -71 [ 191.237366][ T5887] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 191.472515][ T5887] usb 4-1: unable to get BOS descriptor or descriptor too short [ 191.502342][ T5887] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 191.518361][ T6421] jffs2: notice: (6421) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 191.521495][ T5887] usb 4-1: can't read configurations, error -71 [ 195.567669][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.574050][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.387171][ T5887] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 201.155882][ T6471] netlink: 32 bytes leftover after parsing attributes in process `syz.2.167'. [ 203.636988][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 204.607094][ T6464] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 204.674875][ T5887] usb 1-1: unable to get BOS descriptor or descriptor too short [ 204.696689][ T5887] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 204.707088][ T5887] usb 1-1: can't read configurations, error -71 [ 204.959252][ T6487] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 208.129474][ T6509] netlink: 32 bytes leftover after parsing attributes in process `syz.0.182'. [ 210.247075][ T173] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 210.491025][ T173] usb 4-1: unable to get BOS descriptor or descriptor too short [ 210.538448][ T173] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 210.546098][ T173] usb 4-1: can't read configurations, error -71 [ 211.639021][ T6524] syzkaller0: entered promiscuous mode [ 211.644586][ T6524] syzkaller0: entered allmulticast mode [ 213.054934][ T5085] Bluetooth: hci0: command 0x0406 tx timeout [ 213.054959][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 213.055049][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 214.808057][ T5766] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 215.048861][ T5766] usb 1-1: unable to get BOS descriptor or descriptor too short [ 215.067967][ T5766] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 215.085897][ T5766] usb 1-1: can't read configurations, error -71 [ 215.134665][ T6551] syzkaller0: entered promiscuous mode [ 215.140555][ T6551] syzkaller0: entered allmulticast mode [ 216.702442][ T6563] netlink: 32 bytes leftover after parsing attributes in process `syz.3.196'. [ 218.352001][ T173] IPVS: starting estimator thread 0... [ 219.098143][ T6574] IPVS: using max 23 ests per chain, 55200 per kthread [ 219.976068][ T6582] syzkaller0: entered promiscuous mode [ 220.002138][ T6582] syzkaller0: entered allmulticast mode [ 222.547366][ T5825] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 223.837060][ T5825] usb 1-1: unable to get BOS descriptor or descriptor too short [ 223.854898][ T5825] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 223.862587][ T5825] usb 1-1: can't read configurations, error -71 [ 224.613468][ T5875] IPVS: starting estimator thread 0... [ 224.828799][ T6615] IPVS: using max 16 ests per chain, 38400 per kthread [ 225.500423][ T6624] netlink: 32 bytes leftover after parsing attributes in process `syz.0.217'. [ 226.769411][ T6634] syzkaller0: entered promiscuous mode [ 226.776662][ T6634] syzkaller0: entered allmulticast mode [ 229.677247][ T173] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 229.898380][ T173] usb 4-1: unable to get BOS descriptor or descriptor too short [ 229.946148][ T173] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 229.977770][ T173] usb 4-1: can't read configurations, error -71 [ 230.346162][ T6652] fuse: Bad value for 'fd' [ 233.147145][ T6679] netlink: 32 bytes leftover after parsing attributes in process `syz.0.233'. [ 233.359418][ T6684] fuse: Bad value for 'fd' [ 233.427221][ T5825] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 233.626741][ T5825] usb 3-1: unable to get BOS descriptor or descriptor too short [ 233.691370][ T5825] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 233.719337][ T5825] usb 3-1: can't read configurations, error -71 [ 239.662051][ T6709] fuse: Bad value for 'fd' [ 242.747144][ T5887] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 243.081949][ T5887] usb 4-1: unable to get BOS descriptor or descriptor too short [ 243.264750][ T5887] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 243.398736][ T5887] usb 4-1: can't read configurations, error -71 [ 245.039877][ T6749] netlink: 32 bytes leftover after parsing attributes in process `syz.3.253'. [ 252.327246][ T5826] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 253.316719][ T5826] usb 2-1: unable to get BOS descriptor or descriptor too short [ 253.349168][ T5826] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 253.373560][ T5826] usb 2-1: can't read configurations, error -71 [ 256.519518][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.526210][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 259.631566][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 259.699448][ T6811] netlink: 32 bytes leftover after parsing attributes in process `syz.1.271'. [ 261.567292][ T5875] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 261.777989][ T5875] usb 3-1: unable to get BOS descriptor or descriptor too short [ 261.810503][ T5875] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 261.847143][ T5875] usb 3-1: can't read configurations, error -71 [ 265.529267][ T6858] nvmet: adding nsid 1 to subsystem test_subsys [ 265.549054][ T28] audit: type=1800 audit(1786795641.086:2): pid=6858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.284" name="ana_grpid" dev="configfs" ino=10104 res=0 errno=0 [ 266.799657][ T6872] netlink: 32 bytes leftover after parsing attributes in process `syz.1.287'. [ 266.837202][ T6865] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 269.166164][ T6884] jffs2: notice: (6884) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 270.527047][ T970] IPVS: starting estimator thread 0... [ 270.647104][ T6894] IPVS: using max 18 ests per chain, 43200 per kthread [ 276.531953][ T6926] jffs2: notice: (6926) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 279.460943][ T27] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 282.111543][ T27] usb 4-1: unable to get BOS descriptor or descriptor too short [ 282.294066][ T27] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 282.342025][ T27] usb 4-1: can't read configurations, error -71 [ 283.648558][ T6975] jffs2: notice: (6975) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 283.793075][ T6989] ================================================================== [ 283.801184][ T6989] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc9/0x360 [ 283.808867][ T6989] Read of size 8 at addr ffff8880266ce618 by task syz.3.323/6989 [ 283.816593][ T6989] [ 283.818941][ T6989] CPU: 1 PID: 6989 Comm: syz.3.323 Not tainted syzkaller #0 [ 283.826267][ T6989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 283.836381][ T6989] Call Trace: [ 283.839697][ T6989] [ 283.842668][ T6989] dump_stack_lvl+0x18c/0x250 [ 283.847393][ T6989] ? read_lock_is_recursive+0x20/0x20 [ 283.852819][ T6989] ? show_regs_print_info+0x20/0x20 [ 283.858068][ T6989] ? load_image+0x420/0x420 [ 283.862621][ T6989] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 283.868134][ T6989] ? __virt_addr_valid+0x10c/0x380 [ 283.873294][ T6989] ? __virt_addr_valid+0x10c/0x380 [ 283.878452][ T6989] ? __virt_addr_valid+0x10c/0x380 [ 283.883621][ T6989] print_report+0xa8/0x210 [ 283.888086][ T6989] ? dvb_device_open+0xc9/0x360 [ 283.892979][ T6989] kasan_report+0x117/0x150 [ 283.897534][ T6989] ? chrdev_open+0x385/0x600 [ 283.902168][ T6989] ? dvb_device_open+0xc9/0x360 [ 283.907067][ T6989] dvb_device_open+0xc9/0x360 [ 283.911793][ T6989] chrdev_open+0x58c/0x600 [ 283.916260][ T6989] ? cd_forget+0x160/0x160 [ 283.920723][ T6989] ? fsnotify_perm+0x3ed/0x5e0 [ 283.925538][ T6989] do_dentry_open+0x880/0x14b0 [ 283.930360][ T6989] ? cd_forget+0x160/0x160 [ 283.934829][ T6989] path_openat+0x284f/0x3270 [ 283.939483][ T6989] ? do_sys_openat2+0xda/0x1d0 [ 283.944300][ T6989] ? __x64_sys_openat+0x139/0x160 [ 283.949374][ T6989] ? verify_lock_unused+0x140/0x140 [ 283.954617][ T6989] ? do_filp_open+0x430/0x430 [ 283.959344][ T6989] do_filp_open+0x1f2/0x430 [ 283.963890][ T6989] ? vfs_tmpfile+0x620/0x620 [ 283.968547][ T6989] ? _raw_spin_unlock+0x28/0x40 [ 283.973476][ T6989] ? alloc_fd+0x590/0x640 [ 283.977862][ T6989] do_sys_openat2+0x134/0x1d0 [ 283.982592][ T6989] ? do_sys_open+0xe0/0xe0 [ 283.987057][ T6989] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 283.993097][ T6989] ? lock_chain_count+0x20/0x20 [ 283.997997][ T6989] __x64_sys_openat+0x139/0x160 [ 284.002910][ T6989] do_syscall_64+0x55/0xb0 [ 284.007473][ T6989] ? clear_bhb_loop+0x40/0x90 [ 284.012205][ T6989] ? clear_bhb_loop+0x40/0x90 [ 284.016945][ T6989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.022929][ T6989] RIP: 0033:0x7f91abf5e90e [ 284.027399][ T6989] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 284.047052][ T6989] RSP: 002b:00007f91ace8cb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 284.055513][ T6989] RAX: ffffffffffffffda RBX: 00007f91ace8d6c0 RCX: 00007f91abf5e90e [ 284.063540][ T6989] RDX: 0000000000040002 RSI: 00007f91ace8cc00 RDI: ffffffffffffff9c [ 284.071564][ T6989] RBP: 00007f91ace8cc00 R08: 0000000000000000 R09: 0000000000000000 [ 284.079575][ T6989] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 284.088469][ T6989] R13: 00007f91ac226128 R14: 00007f91ac226090 R15: 00007ffec7bb34d8 [ 284.096497][ T6989] [ 284.099748][ T6989] [ 284.102136][ T6989] Allocated by task 1: [ 284.106231][ T6989] kasan_set_track+0x4e/0x70 [ 284.110878][ T6989] __kasan_kmalloc+0x8f/0xa0 [ 284.115521][ T6989] dvb_register_device+0x309/0x1df0 [ 284.120776][ T6989] dvb_register_frontend+0x62d/0x900 [ 284.126113][ T6989] vidtv_bridge_probe+0x9d6/0xf60 [ 284.131272][ T6989] platform_probe+0x13b/0x1c0 [ 284.135996][ T6989] really_probe+0x247/0xae0 [ 284.140551][ T6989] __driver_probe_device+0x1f5/0x390 [ 284.145891][ T6989] driver_probe_device+0x4f/0x420 [ 284.150954][ T6989] __driver_attach+0x444/0x6d0 [ 284.155777][ T6989] bus_for_each_dev+0x235/0x2b0 [ 284.160701][ T6989] bus_add_driver+0x340/0x630 [ 284.165442][ T6989] driver_register+0x23a/0x310 [ 284.170246][ T6989] vidtv_bridge_init+0x49/0x80 [ 284.175145][ T6989] do_one_initcall+0x242/0x790 [ 284.179953][ T6989] do_initcall_level+0x13d/0x1f0 [ 284.184961][ T6989] do_initcalls+0x69/0xd0 [ 284.189339][ T6989] kernel_init_freeable+0x3d9/0x560 [ 284.194603][ T6989] kernel_init+0x1d/0x1c0 [ 284.199441][ T6989] ret_from_fork+0x48/0x80 [ 284.203970][ T6989] ret_from_fork_asm+0x11/0x20 [ 284.208808][ T6989] [ 284.211181][ T6989] The buggy address belongs to the object at ffff8880266ce600 [ 284.211181][ T6989] which belongs to the cache kmalloc-256 of size 256 [ 284.225380][ T6989] The buggy address is located 24 bytes inside of [ 284.225380][ T6989] freed 256-byte region [ffff8880266ce600, ffff8880266ce700) [ 284.239150][ T6989] [ 284.241515][ T6989] The buggy address belongs to the physical page: [ 284.247986][ T6989] page:ffffea000099b380 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880266ce600 pfn:0x266ce [ 284.259501][ T6989] head:ffffea000099b380 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 284.268485][ T6989] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 284.276516][ T6989] page_type: 0xffffffff() [ 284.280911][ T6989] raw: 00fff00000000840 ffff888017c41b40 ffffea00008ef090 ffffea0001e10890 [ 284.289545][ T6989] raw: ffff8880266ce600 000000000010000f 00000001ffffffff 0000000000000000 [ 284.298263][ T6989] page dumped because: kasan: bad access detected [ 284.304733][ T6989] page_owner tracks the page as allocated [ 284.310485][ T6989] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 19645022844, free_ts 0 [ 284.330264][ T6989] post_alloc_hook+0x1c1/0x200 [ 284.335098][ T6989] get_page_from_freelist+0x2181/0x22a0 [ 284.340710][ T6989] __alloc_pages+0x1f0/0x460 [ 284.345385][ T6989] alloc_page_interleave+0x24/0x1e0 [ 284.350642][ T6989] alloc_slab_page+0x5d/0x180 [ 284.355375][ T6989] new_slab+0x87/0x2d0 [ 284.359496][ T6989] ___slab_alloc+0xc5c/0x12f0 [ 284.364221][ T6989] __kmem_cache_alloc_node+0x11f/0x250 [ 284.369768][ T6989] kmalloc_trace+0x2a/0xe0 [ 284.374251][ T6989] bus_add_driver+0x162/0x630 [ 284.378995][ T6989] driver_register+0x23a/0x310 [ 284.383820][ T6989] i2c_register_driver+0xba/0x160 [ 284.388934][ T6989] do_one_initcall+0x242/0x790 [ 284.393751][ T6989] do_initcall_level+0x13d/0x1f0 [ 284.398746][ T6989] do_initcalls+0x69/0xd0 [ 284.403130][ T6989] kernel_init_freeable+0x3d9/0x560 [ 284.408386][ T6989] page_owner free stack trace missing [ 284.413809][ T6989] [ 284.416187][ T6989] Memory state around the buggy address: [ 284.421864][ T6989] ffff8880266ce500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 284.429974][ T6989] ffff8880266ce580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 284.438084][ T6989] >ffff8880266ce600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 284.446194][ T6989] ^ [ 284.451090][ T6989] ffff8880266ce680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 284.459195][ T6989] ffff8880266ce700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 284.467294][ T6989] ================================================================== [ 284.486695][ T6989] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 284.493970][ T6989] CPU: 1 PID: 6989 Comm: syz.3.323 Not tainted syzkaller #0 [ 284.501302][ T6989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 284.511401][ T6989] Call Trace: [ 284.514762][ T6989] [ 284.517740][ T6989] dump_stack_lvl+0x18c/0x250 [ 284.522471][ T6989] ? show_regs_print_info+0x20/0x20 [ 284.527721][ T6989] ? load_image+0x420/0x420 [ 284.532290][ T6989] panic+0x2ca/0x720 [ 284.536242][ T6989] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 284.542451][ T6989] ? bpf_jit_dump+0xd0/0xd0 [ 284.547032][ T6989] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 284.553079][ T6989] ? _raw_spin_unlock+0x40/0x40 [ 284.557993][ T6989] ? dvb_device_open+0xc9/0x360 [ 284.562901][ T6989] check_panic_on_warn+0x84/0xa0 [ 284.567903][ T6989] ? dvb_device_open+0xc9/0x360 [ 284.572831][ T6989] end_report+0x6f/0x130 [ 284.577141][ T6989] kasan_report+0x128/0x150 [ 284.581703][ T6989] ? chrdev_open+0x385/0x600 [ 284.586357][ T6989] ? dvb_device_open+0xc9/0x360 [ 284.591298][ T6989] dvb_device_open+0xc9/0x360 [ 284.596048][ T6989] chrdev_open+0x58c/0x600 [ 284.600528][ T6989] ? cd_forget+0x160/0x160 [ 284.605003][ T6989] ? fsnotify_perm+0x3ed/0x5e0 [ 284.609837][ T6989] do_dentry_open+0x880/0x14b0 [ 284.614666][ T6989] ? cd_forget+0x160/0x160 [ 284.619231][ T6989] path_openat+0x284f/0x3270 [ 284.623921][ T6989] ? do_sys_openat2+0xda/0x1d0 [ 284.628749][ T6989] ? __x64_sys_openat+0x139/0x160 [ 284.633853][ T6989] ? verify_lock_unused+0x140/0x140 [ 284.639109][ T6989] ? do_filp_open+0x430/0x430 [ 284.643851][ T6989] do_filp_open+0x1f2/0x430 [ 284.648411][ T6989] ? vfs_tmpfile+0x620/0x620 [ 284.653142][ T6989] ? _raw_spin_unlock+0x28/0x40 [ 284.658046][ T6989] ? alloc_fd+0x590/0x640 [ 284.662431][ T6989] do_sys_openat2+0x134/0x1d0 [ 284.667161][ T6989] ? do_sys_open+0xe0/0xe0 [ 284.671670][ T6989] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 284.677696][ T6989] ? lock_chain_count+0x20/0x20 [ 284.682596][ T6989] __x64_sys_openat+0x139/0x160 [ 284.687504][ T6989] do_syscall_64+0x55/0xb0 [ 284.691960][ T6989] ? clear_bhb_loop+0x40/0x90 [ 284.696680][ T6989] ? clear_bhb_loop+0x40/0x90 [ 284.701403][ T6989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 284.707338][ T6989] RIP: 0033:0x7f91abf5e90e [ 284.711875][ T6989] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 284.731528][ T6989] RSP: 002b:00007f91ace8cb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 284.740012][ T6989] RAX: ffffffffffffffda RBX: 00007f91ace8d6c0 RCX: 00007f91abf5e90e [ 284.748024][ T6989] RDX: 0000000000040002 RSI: 00007f91ace8cc00 RDI: ffffffffffffff9c [ 284.756039][ T6989] RBP: 00007f91ace8cc00 R08: 0000000000000000 R09: 0000000000000000 [ 284.764053][ T6989] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 284.772068][ T6989] R13: 00007f91ac226128 R14: 00007f91ac226090 R15: 00007ffec7bb34d8 [ 284.780091][ T6989] [ 284.783302][ T6989] Kernel Offset: disabled [ 284.787648][ T6989] Rebooting in 86400 seconds..