last executing test programs: 16m15.462908657s ago: executing program 0 (id=136): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 16m14.583826378s ago: executing program 0 (id=147): timerfd_create(0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r0, &(0x7f00000040c0)={0x2020}, 0x2020) 16m13.501665184s ago: executing program 0 (id=148): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='raid1\n', 0x6) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000240)='2\n', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f00000003c0)='writemostly\n', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/component_size\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='1024\n', 0x5) 16m13.325431398s ago: executing program 0 (id=150): syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xddd4, 0x4000, 0x3}, &(0x7f0000000340), 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000300), 0x3, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000580)={0x400, 0x1, &(0x7f0000000180)=[r2], &(0x7f00000000c0)=[0x3], &(0x7f0000000640)=[r4, r3, r3], &(0x7f0000000340), 0x0, 0xffffffffffffffff}) 16m13.122446494s ago: executing program 0 (id=152): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, r0, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}]}]}, 0x20}}, 0x0) 16m12.933865388s ago: executing program 0 (id=153): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a0000001800000008000000400000", @ANYRES32=0x1, @ANYBLOB], 0x50) 15m56.580900194s ago: executing program 32 (id=153): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0a0000001800000008000000400000", @ANYRES32=0x1, @ANYBLOB], 0x50) 11m51.023073877s ago: executing program 1 (id=756): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x40840) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) eventfd2(0x90, 0x180801) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x48, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000002280)=ANY=[@ANYBLOB='d\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000a000000500004800000010073797a30000000000e44d2"], 0x64}}, 0x0) r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) close(r3) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r4 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) r5 = eventfd(0x80000001) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_RESET_OWNER(r4, 0xaf02, 0x0) 11m50.122555769s ago: executing program 1 (id=758): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000016c0)=@newtaction={0x14, 0x30, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x80800) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) socket$inet(0x2, 0x6, 0x3f5) setsockopt$bt_hci_HCI_TIME_STAMP(r4, 0x0, 0x14, 0x0, 0x0) mount(&(0x7f00000001c0)=@sr0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000200)='ext2\x00', 0x21000d, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x4000) socket$phonet_pipe(0x23, 0x5, 0x2) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x800448d7, &(0x7f0000000040)) 11m46.960086596s ago: executing program 1 (id=771): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001b80)=ANY=[], &(0x7f0000000340)='GPL\x00'}, 0x94) socket(0xa, 0x3, 0x3a) r0 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000700), &(0x7f00000004c0), 0x1000, r1}, 0x38) ioctl$FBIOBLANK(0xffffffffffffffff, 0x4611, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2500}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40001}, 0x20004090) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) mkdir(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r8 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x18) renameat2(0xffffffffffffffff, &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r8, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x10000004, 0x0, r11}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x20, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000040)={'\be \x00', 0x0, 0x5, 0x2, 0x0, 0xc, "00000000020000000000002100", '\x00', "0052008f", '\x00', ["fdfeffbf84a438dfc5d5c010", "0000000000000400", "0000efffffffffffbfff00", "000003cefd70f14003556000"]}) 11m44.569628205s ago: executing program 1 (id=775): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/ocfs2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node1/ipv4_address\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='127.0.0.1', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/ocfs2/node/node1/ipv4_port\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='77', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/cluster/ocfs2/node/node1/num\x00', 0x2, 0x0) write(r2, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000a00)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/cluster/ocfs2/node/node2\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/cluster/ocfs2/node/node2/ipv4_address\x00', 0x2, 0x0) write(r3, &(0x7f0000000d00)='127.0.0.2', 0x9) 11m44.294057601s ago: executing program 1 (id=776): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc_mnt\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount$bind(&(0x7f0000000480)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', &(0x7f00000004c0)='./proc_mnt/sys/net/ipv4/conf/lo/forwarding\x00', 0x0, 0x221490, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x8922, &(0x7f0000000200)={'lo\x00', {0x2, 0x0, @rand_addr=0xff}}) 11m44.062242297s ago: executing program 1 (id=777): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x40840) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) eventfd2(0x90, 0x180801) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x48, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000002280)=ANY=[@ANYBLOB='d\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000a000000500004800000010073797a30000000000e44d2"], 0x64}}, 0x0) r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) close(r3) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) eventfd(0x80000001) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, 0x0) ioctl$VHOST_RESET_OWNER(r4, 0xaf02, 0x0) 11m28.439987619s ago: executing program 33 (id=777): bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x40840) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) eventfd2(0x90, 0x180801) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x48, 0x1, 0x0, 0xb47, 0x9, 0x0, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x3f00) r2 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000002280)=ANY=[@ANYBLOB='d\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000000a000000500004800000010073797a30000000000e44d2"], 0x64}}, 0x0) r3 = openat$binfmt(0xffffffffffffff9c, r2, 0x42, 0x1ff) close(r3) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) eventfd(0x80000001) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, 0x0) ioctl$VHOST_RESET_OWNER(r4, 0xaf02, 0x0) 35.399468995s ago: executing program 2 (id=2688): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000640)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x58}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) 34.956566066s ago: executing program 2 (id=2692): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000440)={@private0={0xfc, 0x0, '\x00', 0x2}, 0x51, r1}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="8500000056000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x98) fcntl$setlease(r3, 0x400, 0x1) fcntl$setlease(r2, 0x400, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/max_speed\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='super-speed-plus', 0x10) 34.294066512s ago: executing program 2 (id=2695): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="01000000"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 33.96199712s ago: executing program 2 (id=2698): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 33.811967363s ago: executing program 2 (id=2699): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)) sendmsg$BATADV_CMD_SET_MESH(r0, 0x0, 0x18) 33.624835718s ago: executing program 2 (id=2700): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) 12.338657349s ago: executing program 4 (id=2763): r0 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) fallocate(0xffffffffffffffff, 0x11, 0x0, 0x5345) r5 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0x0, 0x101, @loopback, 0xa3c}, {0xa, 0xfffe, 0xfffffffd, @dev, 0x4}, 0x1000, {[0x9, 0x0, 0xfffffffe, 0xfffffef9, 0x0, 0x1, 0x2]}}, 0x5c) 10.977785762s ago: executing program 4 (id=2765): mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) listen(r1, 0x1) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000019080)={{0x2, 0x4e23, @loopback}, {0x6, @local}, 0x22, {0x2, 0x4e22, @multicast1}, 'bridge0\x00'}) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3c, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x400, 0x5, 0x10000000000000, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0x7f, 0xff}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x32}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x37}, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe4) link(&(0x7f0000000040)='./file0\x00', &(0x7f0000019100)='./file1\x00') r3 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffedc) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000080)=ANY=[@ANYRES32=r3, @ANYRES32, @ANYBLOB='/\x00'/12, @ANYRES32=r3, @ANYBLOB="2979c0a009a2d9953312ae6d3a883fefcd3aa122", @ANYRES64=0x0], 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./proc\x00', 0x80800, 0x0) 10.968219242s ago: executing program 3 (id=2766): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) listen(r0, 0xa) sendmsg(r0, 0x0, 0x0) r1 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=0x0, &(0x7f0000001108)=0x0, &(0x7f0000001110)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r0, 0x0, 0x0}) syz_io_uring_submit(r2, r3, r4, 0x0) io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r5, &(0x7f0000000040)='add syz0 ::1\n', 0xd) openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0) 8.740014116s ago: executing program 3 (id=2768): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/42, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 8.613138229s ago: executing program 4 (id=2769): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0xc08, 0x80}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c8c0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001780)=@newlink={0x28, 0x10, 0x403, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x429a4}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x8000) 8.288448407s ago: executing program 3 (id=2770): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) prlimit64(0x0, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, 0x0, &(0x7f0000001200)='syzkaller\x00'}, 0x94) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r2, r4}, 0x10) fsopen(&(0x7f0000000100)='cgroup2\x00', 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x961a02, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x5453, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) 7.058367987s ago: executing program 3 (id=2772): memfd_create(&(0x7f0000000180)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xecz\xabq\x95t*T9\xa9\b X \x04\"\x17\xbf\xcb\xccF\xda\xcf\xdd^\xa0\x15\xc0\xcb^h>\x1b\xb5d\xc7\x7f0\x9a&\xb0\x12#\x9c`\xa6\xed\x05\x95g\a\xccYb\xaf\xe9\xb6G?\x9f\xf5\xfe\xc1\xc0JJ\xc8\xd9d\x80\x13\x8fX\xb4\x19\xc4\\\xcb\x89-)\x90\x01\v\xac^\xdbBQ|\xaej;\x92\\\xf8u\x19Y\xee\x99EI\xf1t\xadn<\x9b\xc9\x87\xd0\xa7\x1a\x81\xb9\xc87sq\xd7\x15\xd6\x91O\x9c\x99!9>\xff\xa8\xfa\xe6=d\xcf\xca\xa9\xc61!\xc6P\x13\xd0\x88gZ\xbe\xdfl\xfa\xff\xb0m;d07tx\xbb\xabd\xe5\x16\xc4\xae\xf0', 0x0) write(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYRES32=r0, @ANYRESDEC=r0, @ANYRES64, @ANYBLOB="8f5958836f71f3606ccae97100006ec89690990294084adef6d1dfa43496a63d142d7684c668de6b31cfef08ca1d571e8f923f9d443990619994c5c3fb1776e03b913ba208e0d132cc8b3a150000000000"], 0x48}}, 0x8044) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2400000011005f0414f9f4070009041f810000000e000000000000ea08000f0001000000", 0x24) 6.331175585s ago: executing program 4 (id=2773): read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r4 = accept$alg(r3, 0x0, 0x0) sendmsg$alg(r4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4080}, 0x8000) 4.246104986s ago: executing program 5 (id=2776): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r0, &(0x7f0000000000)='7', 0x1) prlimit64(0x0, 0x7, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 3.944173654s ago: executing program 5 (id=2777): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/42, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 3.584852502s ago: executing program 5 (id=2778): mkdirat(0xffffffffffffffff, &(0x7f0000000140)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00', 0x1ed) mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)="006f00000000000000009faaf2406e945e108ae375fde523a122a43e88bdc93e0b6cef2f956615a668499e1357648c8984b9eb6f1fbad4a6ff4e4618f567bbd1c47783854bdbfaaabbc0165671c63000c63274c1c16bdd7852139862cbfed97ba4adf66db75f1d3f961cd20c6a8da8452b99f61c2c2e83ed0c65c1d41280cb5adda554d81cfc5d5efd990a2b10b18d", 0x8f) close(r1) write(0xffffffffffffffff, &(0x7f0000000b00)='0x0102\x00', 0x6) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x12a) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/fs/h\x00') symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(r0, 0x0, 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000001900)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001a00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000001b00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f00000000c0)='./file0\x00', 0xffffffffffffff9c, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x90) close(r2) r3 = syz_open_dev$video(0x0, 0xf, 0x2) ioctl$VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000c40)={0x2, @vbi={0x8, 0xd3, 0xd, 0x30314752, [0x10, 0x40], [0x5], 0x1}}) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000002400)={0x2, 0x2, 0x1}) 3.225251121s ago: executing program 5 (id=2779): r0 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000280), 0x10, 0x80082) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_misc(r5, &(0x7f0000000040), 0xe09) fallocate(r4, 0x11, 0x0, 0x5345) r6 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0x0, 0x101, @loopback, 0xa3c}, {0xa, 0xfffe, 0xfffffffd, @dev, 0x4}, 0x1000, {[0x9, 0x0, 0xfffffffe, 0xfffffef9, 0x0, 0x1, 0x2]}}, 0x5c) 2.424253101s ago: executing program 3 (id=2780): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0xc08, 0x80}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c8c0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001780)=@newlink={0x28, 0x10, 0x403, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x429a4}, [@IFLA_MASTER={0x8, 0xa, r2}]}, 0x28}}, 0x8000) 2.237004505s ago: executing program 4 (id=2781): fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$loop(&(0x7f0000000280), 0x10, 0x80082) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_misc(r4, &(0x7f0000000040), 0xe09) fallocate(r3, 0x11, 0x0, 0x5345) r5 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0x0, 0x101, @loopback, 0xa3c}, {0xa, 0xfffe, 0xfffffffd, @dev, 0x4}, 0x1000, {[0x9, 0x0, 0xfffffffe, 0xfffffef9, 0x0, 0x1, 0x2]}}, 0x5c) 2.150933957s ago: executing program 5 (id=2782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff5656d, 0x70bd29, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xb, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x8, 0x8, 0xfbee}, 0x5, 0x0, 0x3, 0x5, 0xf, 0x8, 0xd, 0x18, 0x6, 0x4, {0x5, 0xc, 0xfffffffc, 0x0, 0x9, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2404c8e4}, 0x44890) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.069331374s ago: executing program 4 (id=2783): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0\x00') r1 = accept(r0, 0x0, 0x0) recvfrom(r1, &(0x7f0000001000)=""/4096, 0x1000, 0x0, 0x0, 0x0) 739.269802ms ago: executing program 3 (id=2784): r0 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000280), 0x10, 0x80082) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0xc, 0x0, 0x0, 0x0, 0x1f, 0xd, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e68080b8785d960001000000000000000000007efff100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd5992861ac00", "f4bd000000017000", [0x7, 0x5980]}}) fallocate(r4, 0x11, 0x0, 0x5345) r6 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r6, 0x29, 0x22, &(0x7f0000000000)={{0xa, 0x0, 0x101, @loopback, 0xa3c}, {0xa, 0xfffe, 0xfffffffd, @dev, 0x4}, 0x1000, {[0x9, 0x0, 0xfffffffe, 0xfffffef9, 0x0, 0x1, 0x2]}}, 0x5c) 0s ago: executing program 5 (id=2785): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/45, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) kernel console output (not intermixed with test programs): 2] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 732.472458][T12322] RSP: 002b:00007fea29d150e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 732.480900][T12322] RAX: fffffffffffffe00 RBX: 00007fea29025fa8 RCX: 00007fea28d9e159 [ 732.488889][T12322] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fea29025fa8 [ 732.496870][T12322] RBP: 00007fea29025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 732.504857][T12322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 732.512838][T12322] R13: 00007fea29026038 R14: 00007ffd6ab2b980 R15: 00007ffd6ab2ba68 [ 732.520843][T12322] [ 735.149432][T12347] (null): rxe_set_mtu: Set mtu to 1024 [ 735.546563][T12347] rdma_rxe: rxe_newlink: failed to add team_slave_1 [ 737.647528][T12359] netlink: 'syz.3.1575': attribute type 1 has an invalid length. [ 737.786859][T12359] 8021q: adding VLAN 0 to HW filter on device bond2 [ 737.869893][T12372] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1576'. [ 737.940829][ T27] audit: type=1800 audit(2000000612.086:116): pid=12372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1576" name="ipv4_address" dev="configfs" ino=30077 res=0 errno=0 [ 737.973602][ T7091] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 738.185940][ T7091] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 738.230649][ T7091] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 738.284155][ T7091] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 738.322566][ T7091] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 738.369510][ T7091] usb 6-1: Product: syz [ 738.389372][ T7091] usb 6-1: Manufacturer: syz [ 738.412983][ T7091] usb 6-1: SerialNumber: syz [ 738.464202][ T7091] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 738.524629][ T7091] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 738.590770][ T7091] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 738.622650][T12392] random: crng reseeded on system resumption [ 738.832331][T12398] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1583'. [ 741.848323][T12403] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 742.253873][T12421] netlink: 'syz.3.1588': attribute type 1 has an invalid length. [ 742.407381][T12421] 8021q: adding VLAN 0 to HW filter on device bond3 [ 742.689415][T12361] ti_usb_3410_5052_2 ttyUSB0: ti_get_lsr - get port status command failed, -110 [ 744.713981][T12361] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -32 [ 744.884347][T12432] jffs2: notice: (12432) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 744.917832][ T7091] usb 6-1: USB disconnect, device number 19 [ 745.034961][ T7091] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 745.684285][ T7091] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 747.139256][ T7091] ti_usb_3410_5052 6-1:2.0: device disconnected [ 747.276097][T12448] syzkaller0: entered promiscuous mode [ 747.308918][T12448] syzkaller0: entered allmulticast mode [ 747.360132][T12448] tipc: Enabling of bearer rejected, failed to enable media [ 747.478732][T12454] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1593'. [ 747.493423][T12456] netlink: 'syz.3.1595': attribute type 29 has an invalid length. [ 747.539342][T12456] netlink: 'syz.3.1595': attribute type 29 has an invalid length. [ 747.553670][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.560057][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.598997][T12461] netlink: 'syz.3.1595': attribute type 29 has an invalid length. [ 747.614886][ T27] audit: type=1800 audit(2000000621.767:117): pid=12452 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1593" name="ipv4_address" dev="configfs" ino=30315 res=0 errno=0 [ 749.881932][T12470] fuse: Bad value for 'group_id' [ 749.995069][T12473] random: crng reseeded on system resumption [ 750.193162][T12481] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1597'. [ 750.210307][T12482] netlink: 'syz.2.1599': attribute type 1 has an invalid length. [ 752.276174][T12482] 8021q: adding VLAN 0 to HW filter on device bond3 [ 752.614384][T12497] jffs2: notice: (12497) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 754.791657][T12506] comedi comedi1: Minor 47 could not be opened [ 754.835826][T12506] netlink: 220 bytes leftover after parsing attributes in process `syz.2.1604'. [ 754.870009][T12487] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 755.176590][T12515] syzkaller0: entered promiscuous mode [ 755.200189][T12515] syzkaller0: entered allmulticast mode [ 755.216221][T12519] fuse: Bad value for 'group_id' [ 755.239111][T12515] tipc: Enabling of bearer rejected, failed to enable media [ 755.340242][T12521] netlink: 'syz.3.1610': attribute type 1 has an invalid length. [ 755.367825][T12521] netlink: 'syz.3.1610': attribute type 1 has an invalid length. [ 760.442348][T12565] comedi comedi1: Minor 47 could not be opened [ 760.475933][T12565] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1623'. [ 760.820570][T12575] random: crng reseeded on system resumption [ 760.897909][T12579] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 760.984782][T12581] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1626'. [ 763.887571][T12588] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 764.146280][T12599] tap0: tun_chr_ioctl cmd 1074025672 [ 764.151624][T12599] tap0: ignored: set checksum disabled [ 766.700652][T12614] fuse: Bad value for 'rootmode' [ 767.484366][T12630] random: crng reseeded on system resumption [ 767.516890][T12629] comedi comedi1: Minor 47 could not be opened [ 767.709090][T12635] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1639'. [ 768.591906][ T5928] usb 3-1: new full-speed USB device number 35 using dummy_hcd [ 768.629291][T12655] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 768.815621][ T5928] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 768.869428][ T5928] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 768.902882][T12648] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 768.968069][ T5928] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 769.011933][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.055220][ T5928] usb 3-1: Product: syz [ 769.078365][T12666] fuse: Bad value for 'rootmode' [ 769.098337][ T5928] usb 3-1: Manufacturer: syz [ 769.114491][ T5928] usb 3-1: SerialNumber: syz [ 769.151046][ T5928] usb 3-1: config 0 descriptor?? [ 769.255571][ T5928] snd-usb-audio: probe of 3-1:0.0 failed with error -22 [ 771.489893][T12652] udevd[12652]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 771.548721][T12672] 9pnet_fd: Insufficient options for proto=fd [ 771.566236][T12676] syzkaller0: entered promiscuous mode [ 771.607751][T12676] syzkaller0: entered allmulticast mode [ 771.979252][T12682] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1648'. [ 772.297193][T12690] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 772.382170][T12693] random: crng reseeded on system resumption [ 772.560252][T12699] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1651'. [ 772.666418][ T5928] usb 3-1: USB disconnect, device number 35 [ 772.952762][T12704] comedi comedi1: Minor 47 could not be opened [ 773.548871][T12714] fuse: Unknown parameter 'use00000000000000000000' [ 776.828021][T12733] jffs2: notice: (12733) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 779.504431][T12752] random: crng reseeded on system resumption [ 779.671370][T12755] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1664'. [ 780.027093][T12763] fuse: Bad value for 'fd' [ 780.172582][T12767] fuse: Bad value for 'fd' [ 780.259081][T12769] comedi comedi1: Minor 47 could not be opened [ 780.579303][T12777] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1671'. [ 785.003167][T12794] jffs2: notice: (12794) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 787.384271][T12812] random: crng reseeded on system resumption [ 787.516423][T12821] fuse: Bad value for 'fd' [ 787.547119][T12822] fuse: Bad value for 'fd' [ 787.579666][T12823] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1679'. [ 788.402316][T12841] netlink: 'syz.4.1683': attribute type 1 has an invalid length. [ 788.542543][T12841] 8021q: adding VLAN 0 to HW filter on device bond3 [ 789.008259][T12853] jffs2: notice: (12853) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 792.276442][T12858] comedi comedi1: Minor 47 could not be opened [ 792.693310][T12858] netlink: 220 bytes leftover after parsing attributes in process `syz.2.1688'. [ 793.141916][T12878] netlink: 'syz.3.1695': attribute type 1 has an invalid length. [ 793.178382][T12878] 8021q: adding VLAN 0 to HW filter on device bond4 [ 793.337187][T12884] netlink: 'syz.3.1697': attribute type 1 has an invalid length. [ 793.371182][ T6956] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 793.407973][T12884] 8021q: adding VLAN 0 to HW filter on device bond5 [ 793.572325][ T6956] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 793.613107][ T6956] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 793.639225][ T6956] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 793.668024][ T6956] usb 6-1: Product: syz [ 793.688253][ T6956] usb 6-1: Manufacturer: syz [ 793.712517][ T6956] usb 6-1: SerialNumber: syz [ 793.751732][ T6956] usb 6-1: config 0 descriptor?? [ 793.829369][ T6956] snd-usb-audio: probe of 6-1:0.0 failed with error -22 [ 793.962645][T12866] udevd[12866]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 794.089155][T12905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1703'. [ 794.164264][ T27] audit: type=1800 audit(2000000668.309:118): pid=12901 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1703" name="ipv4_address" dev="configfs" ino=31581 res=0 errno=0 [ 794.329645][T12911] netlink: 'syz.2.1705': attribute type 1 has an invalid length. [ 794.396723][T12914] 9pnet_fd: Insufficient options for proto=fd [ 794.445741][T12911] 8021q: adding VLAN 0 to HW filter on device bond4 [ 794.495875][T12917] syzkaller0: entered promiscuous mode [ 794.506226][T12917] syzkaller0: entered allmulticast mode [ 794.857101][T12928] comedi comedi1: Minor 47 could not be opened [ 794.875676][T12929] netlink: 'syz.2.1707': attribute type 1 has an invalid length. [ 794.904814][T12928] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1708'. [ 794.939208][T12933] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1709'. [ 795.021065][T12929] 8021q: adding VLAN 0 to HW filter on device bond5 [ 795.919734][T12955] syzkaller0: entered promiscuous mode [ 795.946848][T12955] syzkaller0: entered allmulticast mode [ 796.077626][T12959] netlink: 'syz.4.1717': attribute type 1 has an invalid length. [ 796.100596][ T5928] usb 6-1: USB disconnect, device number 20 [ 796.296123][T12959] 8021q: adding VLAN 0 to HW filter on device bond4 [ 796.348463][T12968] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1718'. [ 796.551594][T12974] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 796.876965][T12985] comedi comedi1: Minor 47 could not be opened [ 796.922190][T12985] netlink: 220 bytes leftover after parsing attributes in process `syz.5.1723'. [ 797.095061][T12993] syzkaller0: entered promiscuous mode [ 797.122452][T12993] syzkaller0: entered allmulticast mode [ 797.537463][T13004] netlink: 'syz.4.1729': attribute type 29 has an invalid length. [ 797.629539][T13004] netlink: 'syz.4.1729': attribute type 29 has an invalid length. [ 797.710226][ T7090] usb 4-1: new full-speed USB device number 43 using dummy_hcd [ 797.757499][T13007] netlink: 'syz.4.1729': attribute type 29 has an invalid length. [ 797.827089][T13010] netlink: 'syz.4.1729': attribute type 29 has an invalid length. [ 797.911994][ T7090] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 797.952571][ T7090] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 797.993213][ T7090] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.024720][ T7090] usb 4-1: Product: syz [ 798.048748][ T7090] usb 4-1: Manufacturer: syz [ 798.067856][ T7090] usb 4-1: SerialNumber: syz [ 798.104681][ T7090] usb 4-1: config 0 descriptor?? [ 798.159735][ T7090] snd-usb-audio: probe of 4-1:0.0 failed with error -22 [ 798.239368][T12866] udevd[12866]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 798.278317][T13019] syzkaller0: entered promiscuous mode [ 798.297240][T13019] syzkaller0: entered allmulticast mode [ 798.320095][ T5928] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 798.526592][ T5928] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 798.552154][ T5928] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 798.578798][ T5928] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 798.603556][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.635517][ T5928] usb 6-1: Product: syz [ 798.646713][ T5928] usb 6-1: Manufacturer: syz [ 798.664266][ T5928] usb 6-1: SerialNumber: syz [ 798.696702][ T5928] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 798.725071][T13025] 9pnet_fd: Insufficient options for proto=fd [ 798.754111][ T5928] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 798.795889][ T5928] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 798.925494][T13028] syzkaller0: entered promiscuous mode [ 798.957700][T13028] syzkaller0: entered allmulticast mode [ 800.415726][ T5928] usb 4-1: USB disconnect, device number 43 [ 800.510465][T13037] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 800.643465][T13054] syzkaller0: entered promiscuous mode [ 800.670509][T13054] syzkaller0: entered allmulticast mode [ 801.104603][ T6956] usb 6-1: USB disconnect, device number 21 [ 801.136097][T13063] jffs2: notice: (13063) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 801.177045][ T6956] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 801.242161][ T6956] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 802.448951][T13068] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 802.869321][ T6956] ti_usb_3410_5052 6-1:2.0: device disconnected [ 803.200640][T13068] infiniband s`z1: RDMA CMA: cma_listen_on_dev, error -98 [ 803.592114][T13079] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1755'. [ 803.656060][ T27] audit: type=1800 audit(2000000677.810:119): pid=13078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1755" name="ipv4_address" dev="configfs" ino=32103 res=0 errno=0 [ 805.829115][T13089] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1760'. [ 805.913045][T13087] syzkaller0: entered promiscuous mode [ 805.952328][T13087] syzkaller0: entered allmulticast mode [ 806.104504][T13098] fuse: Unknown parameter 'grou00000000000000000000' [ 806.187412][T13100] jffs2: notice: (13100) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 806.289558][ T7090] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 808.203249][ T7090] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 808.283199][ T7090] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 808.333332][ T7090] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 808.377148][ T7090] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 808.439741][ T7090] usb 4-1: Product: syz [ 808.443961][ T7090] usb 4-1: Manufacturer: syz [ 808.448592][ T7090] usb 4-1: SerialNumber: syz [ 808.505050][ T7090] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 808.566274][ T7090] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 808.646686][ T7090] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 808.964095][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.970631][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.219600][T13127] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1770'. [ 809.278101][ T27] audit: type=1800 audit(2000000683.430:120): pid=13127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1770" name="ipv4_address" dev="configfs" ino=32224 res=0 errno=0 [ 809.766180][ T6956] usb 4-1: USB disconnect, device number 44 [ 809.801802][T13139] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 809.825517][ T6956] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 809.913740][ T6956] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 810.007399][ T6956] ti_usb_3410_5052 4-1:2.0: device disconnected [ 810.130674][T13146] jffs2: notice: (13146) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 813.219250][ T6956] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 815.006181][ T6956] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 815.504341][ T6956] usb 5-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 815.657429][ T6956] usb 5-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 815.766177][ T6956] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.870820][ T6956] usb 5-1: Product: syz [ 815.932618][ T6956] usb 5-1: Manufacturer: syz [ 815.961464][ T6956] usb 5-1: SerialNumber: syz [ 816.042599][ T6956] usb 5-1: can't set config #2, error -71 [ 816.111045][T13200] jffs2: notice: (13200) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 816.128249][ T6956] usb 5-1: USB disconnect, device number 23 [ 818.503126][T13219] fuse: Unknown parameter '0x0000000000000003' [ 821.498928][ T7091] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 821.714217][ T7091] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 821.730597][T13252] jffs2: notice: (13252) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 821.777137][ T7091] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 821.823789][ T7091] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 822.954460][ T7091] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.768916][ T7091] usb 4-1: Product: syz [ 823.773255][ T7091] usb 4-1: Manufacturer: syz [ 823.799211][T13260] fuse: Unknown parameter '0x0000000000000003' [ 823.809492][ T7091] usb 4-1: SerialNumber: syz [ 823.858344][ T7091] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 823.912096][ T7091] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 823.963529][ T7091] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 824.608502][T13281] fuse: Unknown parameter '0x0000000000000003' [ 827.727409][ T7091] usb 4-1: USB disconnect, device number 45 [ 827.808756][ T7091] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 827.892110][ T7091] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 828.010790][ T7091] ti_usb_3410_5052 4-1:2.0: device disconnected [ 829.441445][T13334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1837'. [ 829.483034][ T27] audit: type=1800 audit(2000000703.631:121): pid=13333 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.1837" name="ipv4_address" dev="configfs" ino=32832 res=0 errno=0 [ 829.528415][ T7090] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 829.733836][ T7090] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 829.766230][ T7090] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 829.798430][ T7090] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 829.825085][ T7090] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 829.847699][ T7090] usb 6-1: Product: syz [ 829.857454][ T7090] usb 6-1: Manufacturer: syz [ 829.876938][ T7090] usb 6-1: SerialNumber: syz [ 829.908260][ T7090] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 829.959684][T13340] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1840'. [ 829.974139][ T7090] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 830.003080][ T7090] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 832.232667][ T7090] usb 6-1: USB disconnect, device number 22 [ 832.266874][ T7090] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 832.329104][ T7090] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 832.375242][ T7090] ti_usb_3410_5052 6-1:2.0: device disconnected [ 833.420513][T13371] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1851'. [ 833.429910][T13370] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1850'. [ 833.573264][T13374] netlink: 'syz.4.1853': attribute type 6 has an invalid length. [ 833.970110][ T7091] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 834.182240][ T7091] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 834.208111][T13396] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1863'. [ 834.239657][ T7091] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 834.268905][T13399] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1864'. [ 834.298796][ T7091] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 834.316965][ T7091] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 834.355925][ T7091] usb 4-1: Product: syz [ 834.378718][ T7091] usb 4-1: Manufacturer: syz [ 834.383420][ T7091] usb 4-1: SerialNumber: syz [ 834.448119][ T7091] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 834.505714][ T7091] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 834.555649][ T7091] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 835.078680][T13420] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1875'. [ 837.477365][ T7091] usb 4-1: USB disconnect, device number 46 [ 837.518492][ T7091] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 837.587839][ T7091] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 837.603969][ T5786] block nbd5: Receive control failed (result -32) [ 837.630340][T13434] block nbd5: shutting down sockets [ 837.691815][ T7091] ti_usb_3410_5052 4-1:2.0: device disconnected [ 837.917202][T13452] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1886'. [ 838.717832][ T7091] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 838.725709][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 840.377862][ T7091] usb 3-1: device descriptor read/64, error -32 [ 840.667581][ T7091] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 842.503758][ T5786] block nbd5: Receive control failed (result -32) [ 842.511978][T13474] block nbd5: shutting down sockets [ 842.569917][T13482] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 842.920901][T13491] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1898'. [ 842.957985][T13493] netlink: 277 bytes leftover after parsing attributes in process `syz.5.1899'. [ 845.475523][T13508] comedi comedi1: Minor 47 could not be opened [ 845.509759][T13508] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1906'. [ 845.743371][T13519] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1909'. [ 846.238553][T13534] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 846.330770][ T5786] block nbd5: Receive control failed (result -32) [ 846.339336][T13512] block nbd5: shutting down sockets [ 848.818772][T13552] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1921'. [ 848.960904][T13558] netlink: 'syz.5.1923': attribute type 29 has an invalid length. [ 849.014233][T13558] netlink: 'syz.5.1923': attribute type 29 has an invalid length. [ 849.097421][T13558] netlink: 'syz.5.1923': attribute type 29 has an invalid length. [ 849.162177][T13567] netlink: 'syz.5.1923': attribute type 29 has an invalid length. [ 851.568804][ T5786] block nbd4: Receive control failed (result -32) [ 851.618576][T13572] block nbd4: shutting down sockets [ 852.084279][T13596] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1934'. [ 854.728200][ T5786] block nbd3: Receive control failed (result -32) [ 854.739169][T13614] block nbd3: shutting down sockets [ 855.232805][T13633] tipc: Enabled bearer , priority 0 [ 856.456760][ T7092] tipc: Node number set to 2348961985 [ 856.680246][T13638] syzkaller0: entered promiscuous mode [ 856.704889][T13638] syzkaller0: entered allmulticast mode [ 856.746442][T13633] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 856.971896][T13638] tipc: Resetting bearer [ 857.043283][T13631] tipc: Resetting bearer [ 857.175123][T13631] tipc: Disabling bearer [ 857.468996][T13655] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1951'. [ 857.537812][T13655] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 860.033055][T13677] comedi comedi1: Minor 47 could not be opened [ 860.078361][T13677] netlink: 220 bytes leftover after parsing attributes in process `syz.5.1956'. [ 860.608725][ T5786] block nbd2: Receive control failed (result -32) [ 860.618260][T13670] block nbd2: shutting down sockets [ 860.885105][T13708] fuse: Bad value for 'fd' [ 860.972411][ T27] audit: type=1800 audit(2000000735.123:122): pid=13714 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1963" name="ipv4_address" dev="configfs" ino=34097 res=0 errno=0 [ 863.457458][T13735] comedi comedi1: Minor 47 could not be opened [ 863.502206][T13735] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1971'. [ 864.173870][T13760] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1977'. [ 864.303294][ T5786] block nbd3: Receive control failed (result -32) [ 864.311036][T13736] block nbd3: shutting down sockets [ 865.192276][T13785] comedi comedi1: Minor 47 could not be opened [ 865.224876][T13785] netlink: 220 bytes leftover after parsing attributes in process `syz.3.1986'. [ 865.340460][T13789] fuse: Bad value for 'fd' [ 865.442459][T13754] loop2: detected capacity change from 0 to 32768 [ 866.181192][T13791] block nbd5: shutting down sockets [ 868.235285][T13826] netlink: 'syz.5.1998': attribute type 1 has an invalid length. [ 868.385596][T13826] 8021q: adding VLAN 0 to HW filter on device bond6 [ 868.739445][T13832] 8021q: adding VLAN 0 to HW filter on device bond6 [ 868.778653][T13832] bond6: (slave wireguard0): The slave device specified does not support setting the MAC address [ 868.838794][T13832] bond6: (slave wireguard0): Error -95 calling set_mac_address [ 868.945171][T13823] bond6: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 870.080691][ T5786] block nbd2: Receive control failed (result -32) [ 870.092274][T13853] block nbd2: shutting down sockets [ 870.399317][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.578281][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 872.654202][T13900] netlink: 'syz.3.2015': attribute type 1 has an invalid length. [ 872.870887][T13900] 8021q: adding VLAN 0 to HW filter on device bond6 [ 873.237315][T13906] 8021q: adding VLAN 0 to HW filter on device bond6 [ 873.312490][T13906] bond6: (slave wireguard5): The slave device specified does not support setting the MAC address [ 873.397011][T13906] bond6: (slave wireguard5): Error -95 calling set_mac_address [ 873.519846][T13898] bond6: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 873.958030][T13931] loop2: detected capacity change from 0 to 128 [ 877.341601][T13967] netlink: 'syz.4.2033': attribute type 1 has an invalid length. [ 877.617561][T13967] 8021q: adding VLAN 0 to HW filter on device bond5 [ 877.747090][T13973] 8021q: adding VLAN 0 to HW filter on device bond5 [ 877.789140][T13973] bond5: (slave wireguard3): The slave device specified does not support setting the MAC address [ 877.988915][T13973] bond5: (slave wireguard3): Error -95 calling set_mac_address [ 878.011298][T13983] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2035'. [ 878.042824][T13975] bond5: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 878.343009][T13991] jffs2: notice: (13991) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 880.971384][T14013] fuse: Bad value for 'rootmode' [ 881.720412][T14021] netlink: 'syz.4.2047': attribute type 1 has an invalid length. [ 881.744476][T14023] jffs2: notice: (14023) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 883.353847][T14021] 8021q: adding VLAN 0 to HW filter on device bond6 [ 883.886948][T14033] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2049'. [ 883.921858][T14025] 8021q: adding VLAN 0 to HW filter on device bond6 [ 883.967676][T14025] bond6: (slave wireguard3): The slave device specified does not support setting the MAC address [ 884.033405][T14025] bond6: (slave wireguard3): Error -95 calling set_mac_address [ 884.138331][T14029] bond6: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 884.535373][T14045] retu-mfd 0-0001: could not read Retu revision: -5 [ 884.574269][T14045] retu-mfd: probe of 0-0001 failed with error -5 [ 884.631489][T14045] i2c i2c-0: new_device: Instantiated device retu at 0x01 [ 884.669713][T14046] retu-mfd 0-0002: could not read Tahvo revision: -5 [ 884.708491][T14046] retu-mfd: probe of 0-0002 failed with error -5 [ 884.748895][T14046] i2c i2c-0: new_device: Instantiated device tahvo at 0x02 [ 885.074689][T14060] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2059'. [ 885.301550][T14065] bond7: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 885.337350][T14065] bond7 (unregistering): Released all slaves [ 885.401694][T14069] netlink: 'syz.2.2063': attribute type 1 has an invalid length. [ 885.571527][T14069] 8021q: adding VLAN 0 to HW filter on device bond6 [ 885.588346][T14075] random: crng reseeded on system resumption [ 885.673619][T14080] Mass Storage Function, version: 2009/09/11 [ 885.708905][T14071] 8021q: adding VLAN 0 to HW filter on device bond6 [ 885.720849][T14080] LUN: removable file: (no medium) [ 885.775670][T14071] bond6: (slave wireguard5): The slave device specified does not support setting the MAC address [ 885.796594][T14083] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2065'. [ 885.856001][T14071] bond6: (slave wireguard5): Error -95 calling set_mac_address [ 886.073966][T14073] bond6: (slave wlan1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 886.259645][T14073] syz.2.2063 (14073) used greatest stack depth: 20688 bytes left [ 886.424759][T14094] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2072'. [ 887.662808][T14131] random: crng reseeded on system resumption [ 887.857385][T14136] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2086'. [ 888.592401][T14129] loop3: detected capacity change from 0 to 40427 [ 888.681707][T14129] F2FS-fs (loop3): invalid crc value [ 889.145371][T14129] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 889.159753][T14158] FAULT_INJECTION: forcing a failure. [ 889.159753][T14158] name failslab, interval 1, probability 0, space 0, times 0 [ 889.375031][T14158] CPU: 0 PID: 14158 Comm: syz.5.2096 Not tainted syzkaller #0 [ 889.382565][T14158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 889.392645][T14158] Call Trace: [ 889.395936][T14158] [ 889.398880][T14158] dump_stack_lvl+0x18c/0x250 [ 889.403582][T14158] ? show_regs_print_info+0x20/0x20 [ 889.408815][T14158] ? load_image+0x420/0x420 [ 889.413337][T14158] ? __might_sleep+0xe0/0xe0 [ 889.417945][T14158] ? __lock_acquire+0x7d80/0x7d80 [ 889.422992][T14158] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 889.428931][T14158] ? __might_sleep+0xe0/0xe0 [ 889.433558][T14158] should_fail_ex+0x394/0x4c0 [ 889.438260][T14158] should_failslab+0x9/0x20 [ 889.442778][T14158] slab_pre_alloc_hook+0x59/0x300 [ 889.447825][T14158] kmem_cache_alloc_lru+0x4d/0x2b0 [ 889.452956][T14158] ? sock_alloc_inode+0x28/0xc0 [ 889.457833][T14158] sock_alloc_inode+0x28/0xc0 [ 889.462524][T14158] ? sockfs_init_fs_context+0xb0/0xb0 [ 889.467910][T14158] new_inode_pseudo+0x63/0x1d0 [ 889.472689][T14158] sock_create_lite+0x8b/0x500 [ 889.477464][T14158] ? lockdep_hardirqs_on+0x98/0x150 [ 889.482681][T14158] __netlink_kernel_create+0xfb/0x7b0 [ 889.488149][T14158] ? netlink_set_err+0x3b0/0x3b0 [ 889.493105][T14158] ? __asan_memset+0x22/0x40 [ 889.497714][T14158] ? genl_pernet_init+0xa8/0x170 [ 889.502668][T14158] genl_pernet_init+0xba/0x170 [ 889.507442][T14158] ? ctrl_dumppolicy_put_op+0xa30/0xa30 [ 889.513003][T14158] ? genl_pernet_exit+0x60/0x60 [ 889.517875][T14158] ? genl_rcv+0x40/0x40 [ 889.522044][T14158] ? __raw_spin_lock_init+0x45/0x100 [ 889.527347][T14158] ? debug_mutex_init+0x38/0x70 [ 889.532216][T14158] ops_init+0x391/0x640 [ 889.536436][T14158] setup_net+0x3b6/0xa20 [ 889.540688][T14158] ? copy_net_ns+0x5d0/0x5d0 [ 889.545322][T14158] ? copy_net_ns+0x342/0x5d0 [ 889.549947][T14158] ? down_read_killable+0x1d0/0x340 [ 889.555190][T14158] copy_net_ns+0x35e/0x5d0 [ 889.559616][T14158] create_new_namespaces+0x3ce/0x700 [ 889.564921][T14158] unshare_nsproxy_namespaces+0x11a/0x160 [ 889.570681][T14158] ksys_unshare+0x4fa/0x8f0 [ 889.575246][T14158] ? sighand_ctor+0x50/0x50 [ 889.579764][T14158] ? lock_chain_count+0x20/0x20 [ 889.584630][T14158] ? syscall_enter_from_user_mode+0x25/0x80 [ 889.590543][T14158] __x64_sys_unshare+0x38/0x40 [ 889.595340][T14158] do_syscall_64+0x55/0xb0 [ 889.599767][T14158] ? clear_bhb_loop+0x40/0x90 [ 889.604459][T14158] ? clear_bhb_loop+0x40/0x90 [ 889.609149][T14158] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 889.615056][T14158] RIP: 0033:0x7fea28d9e159 [ 889.619502][T14158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 889.639137][T14158] RSP: 002b:00007fea29d15028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 889.647592][T14158] RAX: ffffffffffffffda RBX: 00007fea29025fa0 RCX: 00007fea28d9e159 [ 889.655576][T14158] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 889.663556][T14158] RBP: 00007fea28e35024 R08: 0000000000000000 R09: 0000000000000000 [ 889.671536][T14158] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 889.679516][T14158] R13: 00007fea29026038 R14: 00007fea29025fa0 R15: 00007ffd6ab2ba68 [ 889.687512][T14158] [ 891.138467][T14152] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 891.559360][T14171] random: crng reseeded on system resumption [ 891.702489][T14177] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2100'. [ 891.825843][ T27] audit: type=1800 audit(2000000765.985:123): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="ipv4_address" dev="configfs" ino=35501 res=0 errno=0 [ 891.954982][ T27] audit: type=1800 audit(2000000766.015:124): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="ipv4_port" dev="configfs" ino=35506 res=0 errno=0 [ 892.098918][ T27] audit: type=1800 audit(2000000766.015:125): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="num" dev="configfs" ino=35507 res=0 errno=0 [ 892.245861][ T27] audit: type=1800 audit(2000000766.025:126): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="local" dev="configfs" ino=35508 res=0 errno=0 [ 892.883354][ T27] audit: type=1800 audit(2000000766.025:127): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="ipv4_address" dev="configfs" ino=35509 res=0 errno=0 [ 894.291303][T14190] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2107'. [ 894.340914][ T27] audit: type=1800 audit(2000000766.025:128): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="ipv4_port" dev="configfs" ino=35510 res=0 errno=0 [ 894.433873][ T27] audit: type=1800 audit(2000000766.035:129): pid=14180 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2103" name="local" dev="configfs" ino=35511 res=0 errno=0 [ 896.473661][T14215] netlink: 'syz.5.2115': attribute type 39 has an invalid length. [ 899.067386][ T27] audit: type=1800 audit(2000000773.225:130): pid=14237 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2121" name="max_speed" dev="configfs" ino=35729 res=0 errno=0 [ 899.282237][T14239] loop5: detected capacity change from 0 to 2048 [ 899.436029][T14239] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 899.576439][T14238] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 899.816449][ T9106] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 902.525075][T14279] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2138'. [ 903.388165][ T27] audit: type=1800 audit(2000000777.525:131): pid=14297 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2144" name="memory_backed" dev="configfs" ino=36117 res=0 errno=0 [ 903.506608][ T27] audit: type=1800 audit(2000000777.535:132): pid=14297 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2144" name="zoned" dev="configfs" ino=36118 res=0 errno=0 [ 903.629026][T14303] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 903.764131][ T7091] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 903.955758][ T7091] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 903.978304][ T7091] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 903.991515][ T7091] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 904.001718][ T7091] usb 6-1: Product: syz [ 904.009716][ T7091] usb 6-1: Manufacturer: syz [ 904.014787][ T7091] usb 6-1: SerialNumber: syz [ 904.252610][T14302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 904.294640][T14302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 904.363470][ T7091] cdc_ether: probe of 6-1:1.0 failed with error -22 [ 904.434433][ T7091] usb 6-1: USB disconnect, device number 23 [ 904.699879][T14322] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2152'. [ 904.739468][T14323] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2150'. [ 904.934054][ T7091] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 905.214125][ T5786] Bluetooth: hci0: unexpected event for opcode 0x0c03 [ 905.505345][ T7091] usb 6-1: Using ep0 maxpacket: 8 [ 905.529086][ T7091] usb 6-1: config index 0 descriptor too short (expected 301, got 72) [ 905.553927][ T7091] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 905.604182][ T7091] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 905.640457][ T7091] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 905.667369][ T7091] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 905.700368][ T7091] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 905.744040][ T6956] usb 4-1: new low-speed USB device number 47 using dummy_hcd [ 905.763092][ T7091] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 905.799145][ T7091] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 905.849877][ T7091] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 905.883244][ T7091] usbtmc: probe of 6-1:16.0 failed with error -22 [ 906.530344][T14359] tipc: Started in network mode [ 906.543018][T14359] tipc: Node identity 324d21d250de, cluster identity 4711 [ 906.562920][T14359] tipc: Enabled bearer , priority 0 [ 906.583423][T14359] syzkaller0: entered promiscuous mode [ 906.591658][T14359] syzkaller0: entered allmulticast mode [ 906.618806][T14357] tipc: Resetting bearer [ 906.658957][T14357] tipc: Disabling bearer [ 907.111705][T14369] fuse: Unknown parameter 'user_i00000000000000000000' [ 907.734632][ T7091] usb 6-1: USB disconnect, device number 24 [ 907.891766][T14376] syzkaller0: entered promiscuous mode [ 907.900566][T14376] syzkaller0: entered allmulticast mode [ 908.152272][ T6956] usb 4-1: unable to get BOS descriptor or descriptor too short [ 908.207852][ T6956] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 908.248252][ T6956] usb 4-1: can't read configurations, error -71 [ 908.558996][T14389] device-mapper: ioctl: device name cannot be "control", ".", or ".." [ 909.844825][ T5786] block nbd5: Receive control failed (result -32) [ 910.191447][T14378] block nbd5: shutting down sockets [ 910.564594][T14391] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2176'. [ 913.223779][ T5928] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 913.299902][T14420] syzkaller0: entered promiscuous mode [ 913.323892][T14420] syzkaller0: entered allmulticast mode [ 913.424860][ T5928] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 915.269754][ T5928] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 915.300800][ T5928] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 915.327724][ T5928] usb 3-1: Product: syz [ 915.332142][ T5928] usb 3-1: Manufacturer: syz [ 915.339008][ T5928] usb 3-1: SerialNumber: syz [ 915.628930][ T5928] cdc_ether 3-1:1.0: skipping garbage [ 915.681888][ T5928] cdc_ether: probe of 3-1:1.0 failed with error -22 [ 915.748320][ T5928] usb 3-1: USB disconnect, device number 38 [ 915.767332][T14430] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2187'. [ 916.213266][ T5928] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 918.577252][T14451] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2192'. [ 919.813263][ T5928] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 921.807553][ T5928] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 921.923326][ T5928] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 922.027782][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.112950][ T5928] usb 6-1: Product: syz [ 922.151473][ T5928] usb 6-1: Manufacturer: syz [ 922.218788][ T5928] usb 6-1: SerialNumber: syz [ 922.278815][T14488] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2203'. [ 922.476287][ T5928] cdc_ether 6-1:1.0: skipping garbage [ 922.524904][ T5928] cdc_ether: probe of 6-1:1.0 failed with error -22 [ 922.560728][ T5928] usb 6-1: USB disconnect, device number 25 [ 923.063369][ T5928] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 923.256061][ T5928] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 923.287938][ T5928] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 923.307379][ T5928] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.328931][ T5928] usb 6-1: Product: syz [ 923.336253][ T5928] usb 6-1: Manufacturer: syz [ 923.341087][ T5928] usb 6-1: SerialNumber: syz [ 923.429493][ T5786] block nbd4: Receive control failed (result -32) [ 923.444667][T14493] block nbd4: shutting down sockets [ 923.557093][ T5928] cdc_ether 6-1:1.0: skipping garbage [ 923.584388][ T5928] cdc_ether: probe of 6-1:1.0 failed with error -22 [ 923.626704][ T5928] usb 6-1: USB disconnect, device number 26 [ 926.193640][T14519] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2215'. [ 926.341046][T14525] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2217'. [ 927.592751][ T7091] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 929.423140][T14544] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2226'. [ 929.494209][T14547] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2227'. [ 929.583919][ T7091] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 929.659764][ T7091] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 929.699798][ T7091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 929.743995][T14549] loop0: detected capacity change from 0 to 32768 [ 929.755674][ T7091] usb 3-1: Product: syz [ 929.759875][ T7091] usb 3-1: Manufacturer: syz [ 929.808638][ T7091] usb 3-1: SerialNumber: syz [ 929.962366][T14553] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2229'. [ 930.073104][ T7091] cdc_ether 3-1:1.0: skipping garbage [ 930.099262][ T7091] cdc_ether: probe of 3-1:1.0 failed with error -22 [ 930.131865][ T7091] usb 3-1: USB disconnect, device number 40 [ 930.622562][ T7091] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 930.841611][ T7091] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 930.891093][ T7091] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 930.924517][ T7091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.938350][T14559] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2232'. [ 930.962661][ T7091] usb 3-1: Product: syz [ 930.966896][ T7091] usb 3-1: Manufacturer: syz [ 931.012077][ T7091] usb 3-1: SerialNumber: syz [ 931.078515][T14557] loop4: detected capacity change from 0 to 32768 [ 931.264374][ T7091] cdc_ether 3-1:1.0: skipping garbage [ 931.306409][ T7091] cdc_ether: probe of 3-1:1.0 failed with error -22 [ 931.381001][ T7091] usb 3-1: USB disconnect, device number 41 [ 931.428365][T14557] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 931.847252][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.857342][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.954291][ T6773] ocfs2: Unmounting device (7,4) on (node local) [ 932.134618][T14572] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2237'. [ 932.455608][T14574] fuse: Unknown parameter '0x0000000000000005' [ 932.618512][T14578] netlink: 'syz.4.2235': attribute type 39 has an invalid length. [ 932.719385][T14566] block nbd5: shutting down sockets [ 938.330027][T14610] loop4: detected capacity change from 0 to 4096 [ 938.478186][T14610] ntfs3: loop4: Different NTFS sector size (1024) and media sector size (512). [ 938.690023][T13441] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 938.701872][T13441] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 938.714911][T13441] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 938.723142][T13441] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 938.730769][T13441] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 938.738826][T13441] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 939.130066][T14618] lo speed is unknown, defaulting to 1000 [ 939.940377][T14618] wg2 speed is unknown, defaulting to 1000 [ 940.128335][T13696] tipc: Left network mode [ 940.223620][T14628] block nbd5: shutting down sockets [ 940.669500][T14642] netlink: 'syz.2.2253': attribute type 1 has an invalid length. [ 940.796694][T13441] Bluetooth: hci3: command tx timeout [ 940.853967][T14642] 8021q: adding VLAN 0 to HW filter on device bond7 [ 941.022753][T14644] 8021q: adding VLAN 0 to HW filter on device bond7 [ 941.082457][T14644] bond7: (slave wireguard5): The slave device specified does not support setting the MAC address [ 941.138737][T14644] bond7: (slave wireguard5): Error -95 calling set_mac_address [ 941.270794][T14647] bond7: (slave wlan1): Enslaving as an active interface with an up link [ 941.618525][T14640] loop5: detected capacity change from 0 to 32768 [ 941.749015][T14640] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by syz.5.2252 (14640) [ 941.985559][T14640] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 942.058650][T14640] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 942.139635][T14640] BTRFS info (device loop5): using free space tree [ 942.198139][T14662] syzkaller0: entered promiscuous mode [ 942.249999][T14662] syzkaller0: entered allmulticast mode [ 942.411628][T14640] BTRFS info (device loop5): enabling ssd optimizations [ 942.449655][T14640] BTRFS info (device loop5): auto enabling async discard [ 942.875886][T13441] Bluetooth: hci3: command tx timeout [ 944.121749][ T27] audit: type=1800 audit(2000000818.278:133): pid=14700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2259" name="ipv4_address" dev="configfs" ino=37810 res=0 errno=0 [ 944.246117][T14699] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2259'. [ 944.349698][T14618] chnl_net:caif_netlink_parms(): no params data found [ 944.424111][T14702] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2261'. [ 944.550626][ T9106] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 944.952296][T13441] Bluetooth: hci3: command tx timeout [ 945.294146][ T7091] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 945.531142][ T7091] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x4F, skipping [ 945.662437][ T7091] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 945.719101][ T7091] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 945.790467][ T7091] usb 3-1: Product: syz [ 945.828327][ T7091] usb 3-1: Manufacturer: syz [ 945.881725][ T7091] usb 3-1: SerialNumber: syz [ 946.016914][ T7091] usb 3-1: config 0 descriptor?? [ 946.137093][T14618] bridge0: port 1(bridge_slave_0) entered blocking state [ 946.188143][T14733] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2265'. [ 946.207604][T14618] bridge0: port 1(bridge_slave_0) entered disabled state [ 946.243363][T14618] bridge_slave_0: entered allmulticast mode [ 946.320729][ T7091] snd-usb-audio: probe of 3-1:0.0 failed with error -22 [ 946.337232][T14618] bridge_slave_0: entered promiscuous mode [ 946.387417][T14722] syzkaller0: entered promiscuous mode [ 946.435577][T14722] syzkaller0: entered allmulticast mode [ 946.488724][T14618] bridge0: port 2(bridge_slave_1) entered blocking state [ 946.567147][T14618] bridge0: port 2(bridge_slave_1) entered disabled state [ 946.610206][T14314] udevd[14314]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 946.656558][T14618] bridge_slave_1: entered allmulticast mode [ 946.685913][T14618] bridge_slave_1: entered promiscuous mode [ 946.693786][T14739] 9pnet_fd: Insufficient options for proto=fd [ 946.958403][T13696] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 947.001321][T13696] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 947.031749][T13441] Bluetooth: hci3: command tx timeout [ 947.946367][ T7092] usb 3-1: USB disconnect, device number 42 [ 948.430887][T14757] md: could not open device unknown-block(7,0). [ 948.467820][T14759] loop5: detected capacity change from 0 to 16 [ 948.526658][T13696] bond6 (unregistering): Released all slaves [ 948.546540][T14759] erofs: (device loop5): mounted with root inode @ nid 36. [ 948.652770][T14759] erofs: (device loop5): z_erofs_read_folio: read error -117 @ 0 of nid 36 [ 949.274188][T13696] bond5 (unregistering): Released all slaves [ 949.599759][T13696] bond4 (unregistering): Released all slaves [ 950.100201][T13696] bond3 (unregistering): Released all slaves [ 950.388109][T13696] bond2 (unregistering): Released all slaves [ 950.598144][T13696] bond1 (unregistering): Released all slaves [ 951.368844][T13696] team0 (unregistering): Port device team_slave_1 removed [ 951.445642][T13696] team0 (unregistering): Port device team_slave_0 removed [ 951.511154][T13696] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 951.587765][T13696] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 952.125197][T13696] bond0 (unregistering): Released all slaves [ 952.256213][T14618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 952.312969][T14772] syzkaller0: entered promiscuous mode [ 952.364910][T14772] syzkaller0: entered allmulticast mode [ 952.389782][T14788] netlink: 'syz.5.2277': attribute type 39 has an invalid length. [ 952.496120][T14618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 952.515104][ T27] audit: type=1800 audit(2000000826.678:134): pid=14793 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2278" name="max_speed" dev="configfs" ino=38142 res=0 errno=0 [ 952.734883][T14618] team0: Port device team_slave_0 added [ 952.793484][T14618] team0: Port device team_slave_1 added [ 952.942985][T14798] jffs2: notice: (14798) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 953.011265][T14618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 953.018539][T14618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 953.247216][T14805] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2281'. [ 953.437488][T14618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 953.467400][T14808] md: could not open device unknown-block(7,0). [ 953.503845][T14618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 953.510828][T14618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 953.756468][T14618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 954.242881][T14618] hsr_slave_0: entered promiscuous mode [ 954.299917][T14618] hsr_slave_1: entered promiscuous mode [ 954.623653][T14832] netlink: 'syz.4.2287': attribute type 39 has an invalid length. [ 957.264999][T14857] md: could not open device unknown-block(7,0). [ 960.121818][T14886] random: crng reseeded on system resumption [ 960.341977][T14889] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2299'. [ 960.492852][T14618] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 960.539505][T14618] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 960.622991][T14618] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 960.677674][T14618] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 961.089119][T14899] loop4: detected capacity change from 0 to 4096 [ 961.132332][T14618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 961.247201][T14618] 8021q: adding VLAN 0 to HW filter on device team0 [ 961.373586][T13697] bridge0: port 1(bridge_slave_0) entered blocking state [ 961.380800][T13697] bridge0: port 1(bridge_slave_0) entered forwarding state [ 961.502133][T13697] bridge0: port 2(bridge_slave_1) entered blocking state [ 961.509303][T13697] bridge0: port 2(bridge_slave_1) entered forwarding state [ 961.595741][T14905] md: could not open device unknown-block(7,0). [ 962.055862][T14912] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 962.157626][T14914] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2304'. [ 964.738082][T14618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 965.105176][T14618] veth0_vlan: entered promiscuous mode [ 965.179639][T14618] veth1_vlan: entered promiscuous mode [ 965.197493][T14943] random: crng reseeded on system resumption [ 965.336924][T14618] veth0_macvtap: entered promiscuous mode [ 965.413143][T14618] veth1_macvtap: entered promiscuous mode [ 965.458358][T14948] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2309'. [ 965.537939][T14618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 965.595933][T14618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 965.633318][T14618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 967.561552][T14618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 967.619036][T14618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 967.668292][T14955] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2311'. [ 967.727943][T14618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 967.829696][T14618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 967.854383][T14618] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 967.898914][T14618] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 967.951892][T14618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 967.967489][T14961] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2312'. [ 968.005016][T14618] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.046362][T14618] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.100457][T14618] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.145886][T14618] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.478512][T14974] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2314'. [ 968.574443][ T27] audit: type=1800 audit(2000000842.739:135): pid=14973 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2313" name="ipv4_address" dev="configfs" ino=39083 res=0 errno=0 [ 968.603733][T14975] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2313'. [ 968.649027][T13696] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 968.686532][T13696] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 970.974958][ T6007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 971.050287][ T6007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 974.731378][T15012] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2320'. [ 976.528593][T15031] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2324'. [ 977.114208][T15050] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 978.605051][T15056] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2328'. [ 979.708216][T15075] md: could not open device unknown-block(7,0). [ 980.168105][T15082] loop5: detected capacity change from 0 to 4096 [ 980.506154][T15090] mac80211_hwsim hwsim15 wlan1: entered promiscuous mode [ 980.539737][T15095] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 981.117711][T15102] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2339'. [ 982.423310][T15109] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2340'. [ 982.601082][T15104] jffs2: notice: (15104) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 983.442876][T15114] CIFS: Attempting to mount //127.0.0.1/share [ 983.557867][T15117] md: could not open device unknown-block(7,0). [ 983.650516][T15114] CIFS: VFS: Unable to select appropriate authentication method! [ 983.702243][T15114] CIFS: VFS: \\127.0.0.1 Send error in SessSetup = -22 [ 983.776900][T15114] CIFS: VFS: cifs_mount failed w/return code = -22 [ 984.426018][T15134] loop2: detected capacity change from 0 to 4096 [ 984.469725][ T5928] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 984.551054][T15134] ntfs3: loop2: Different NTFS sector size (1024) and media sector size (512). [ 984.687448][ T5928] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 984.749755][ T5928] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 984.832493][ T5928] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 984.894046][T15142] loop4: detected capacity change from 0 to 4096 [ 984.901045][ T5928] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 984.974469][ T5928] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 985.198716][ T5928] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 985.273397][ T5928] usb 4-1: Product: syz [ 985.277635][ T5928] usb 4-1: Manufacturer: syz [ 985.350770][ T5928] usb 4-1: SerialNumber: syz [ 985.451714][ T5928] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 985.588613][ T5928] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 985.635574][T15135] ti_usb_3410_5052_2 ttyUSB0: ti_open - submit interrupt urb failed, -90 [ 985.672670][ T5928] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 985.755064][T15152] comedi comedi1: Minor 47 could not be opened [ 985.831199][T15152] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2351'. [ 986.664731][T15169] netlink: 'syz.4.2353': attribute type 39 has an invalid length. [ 986.718263][T15171] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2352'. [ 986.767371][ T27] audit: type=1800 audit(2000000860.930:136): pid=15171 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2352" name="ipv4_address" dev="configfs" ino=39631 res=0 errno=0 [ 987.237370][T14972] usb 4-1: USB disconnect, device number 49 [ 987.284519][T15179] 8021q: adding VLAN 0 to HW filter on device bond7 [ 987.307523][T14972] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 987.443731][T14972] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 987.506854][T15182] 8021q: adding VLAN 0 to HW filter on device bond7 [ 987.541204][T14972] ti_usb_3410_5052 4-1:2.0: device disconnected [ 987.585852][T15182] bond7: (slave wireguard3): The slave device specified does not support setting the MAC address [ 987.681471][T15182] bond7: (slave wireguard3): Error -95 calling set_mac_address [ 987.809552][T15183] bond7: (slave wlan1): Enslaving as an active interface with an up link [ 988.344352][T15200] comedi comedi1: Minor 47 could not be opened [ 988.397055][T15200] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2361'. [ 989.946378][T15207] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2362'. [ 990.367237][T15207] bridge_slave_1: left allmulticast mode [ 990.397761][T15207] bridge_slave_1: left promiscuous mode [ 990.462166][T15207] bridge0: port 2(bridge_slave_1) entered disabled state [ 990.533880][T15207] bridge_slave_0: left allmulticast mode [ 990.563756][T15207] bridge_slave_0: left promiscuous mode [ 990.587764][T15215] MTD: Couldn't look up './dev/mtdblock0': -2 [ 990.594717][T15207] bridge0: port 1(bridge_slave_0) entered disabled state [ 993.223934][T15251] random: crng reseeded on system resumption [ 993.264023][T15243] loop2: detected capacity change from 0 to 4096 [ 993.275823][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.282716][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.396965][T15243] ntfs3: loop2: Different NTFS sector size (1024) and media sector size (512). [ 993.427967][T15257] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2374'. [ 993.663549][T15262] fuse: Bad value for 'fd' [ 994.510030][T15272] comedi comedi1: Minor 47 could not be opened [ 994.551420][T15272] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2380'. [ 996.947634][T15276] loop4: detected capacity change from 0 to 4096 [ 997.150945][T15276] ntfs: volume version 3.1. [ 997.589497][T15290] netlink: 'syz.5.2386': attribute type 39 has an invalid length. [ 997.849998][T15295] md: could not open device unknown-block(7,0). [ 998.085687][T15299] random: crng reseeded on system resumption [ 998.180191][T15303] fuse: Bad value for 'fd' [ 998.245076][T15306] fuse: Bad value for 'fd' [ 998.298151][T15308] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2390'. [ 998.430544][T15308] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2390'. [ 998.585553][T15313] md0: can't set backlog, no write mostly device available [ 998.916241][T15317] loop3: detected capacity change from 0 to 512 [ 999.000751][T15317] EXT4-fs: Ignoring removed nobh option [ 999.118334][T15317] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 999.225956][T15317] ext4 filesystem being mounted at /26/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 999.441303][T14618] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 999.818778][T14972] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 999.976358][T15342] md: could not open device unknown-block(7,0). [ 1000.014347][T13441] block nbd4: Receive control failed (result -32) [ 1000.021996][T15327] block nbd4: shutting down sockets [ 1000.033669][T14972] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1000.076371][T14972] usb 6-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1000.130111][T15329] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1000.185579][T14972] usb 6-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 1000.220747][T14972] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.317766][T14972] usb 6-1: Product: syz [ 1000.342852][T14972] usb 6-1: Manufacturer: syz [ 1000.387499][T14972] usb 6-1: SerialNumber: syz [ 1000.425263][T14972] ti_usb_3410_5052 6-1:2.0: TI USB 5052 2 port adapter converter detected [ 1001.285396][T15350] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2405'. [ 1002.398571][T14972] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 1002.477761][T14972] usb 6-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 1002.497462][T15347] loop4: detected capacity change from 0 to 4096 [ 1002.672356][T14972] usb 6-1: USB disconnect, device number 27 [ 1002.740026][T14972] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 1002.893468][T14972] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 1002.987085][T14972] ti_usb_3410_5052 6-1:2.0: device disconnected [ 1003.157930][T15364] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2407'. [ 1003.248084][ T27] audit: type=1800 audit(2000000877.411:137): pid=15361 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2407" name="ipv4_address" dev="configfs" ino=40415 res=0 errno=0 [ 1003.834223][T15381] md: could not open device unknown-block(7,0). [ 1004.002413][T15385] md0: can't set backlog, no write mostly device available [ 1004.010324][T14972] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 1004.221666][T14972] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x4F, skipping [ 1004.262087][T14972] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1004.286764][T14972] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1005.180009][T13441] block nbd4: Receive control failed (result -32) [ 1005.794343][T15374] block nbd4: shutting down sockets [ 1005.858769][T15390] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2416'. [ 1006.267018][T14972] usb 6-1: Product: syz [ 1006.286869][T14972] usb 6-1: Manufacturer: syz [ 1006.325035][T14972] usb 6-1: SerialNumber: syz [ 1006.376448][T14972] usb 6-1: config 0 descriptor?? [ 1006.456112][T15392] netlink: 'syz.3.2418': attribute type 1 has an invalid length. [ 1006.481870][T14972] snd-usb-audio: probe of 6-1:0.0 failed with error -22 [ 1006.585702][T14314] udevd[14314]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1006.648973][T15392] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1006.765864][T15395] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1006.788766][T15395] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1007.163965][T15395] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 1007.274172][T15402] 9pnet_fd: Insufficient options for proto=fd [ 1007.367234][T15397] bond1: (slave wlan1): Enslaving as an active interface with an up link [ 1008.094151][T15419] syzkaller0: entered promiscuous mode [ 1008.107343][T15419] syzkaller0: entered allmulticast mode [ 1008.357639][ T7091] usb 6-1: USB disconnect, device number 28 [ 1012.677904][ T7091] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 1012.918995][ T7091] usb 6-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x4F, skipping [ 1012.987896][ T7091] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1013.007405][ T7091] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.071490][ T7091] usb 6-1: Product: syz [ 1013.087659][ T7091] usb 6-1: Manufacturer: syz [ 1013.114350][ T7091] usb 6-1: SerialNumber: syz [ 1013.160777][ T7091] usb 6-1: config 0 descriptor?? [ 1013.259594][ T7091] snd-usb-audio: probe of 6-1:0.0 failed with error -22 [ 1013.395224][T14314] udevd[14314]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1013.512848][T15472] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2447'. [ 1013.668508][T15476] bond7: (slave wlan1): Releasing backup interface [ 1013.686562][T15474] syzkaller0: entered promiscuous mode [ 1013.694333][T15474] syzkaller0: entered allmulticast mode [ 1013.812728][T15481] 9pnet_fd: Insufficient options for proto=fd [ 1014.404343][T15490] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1015.215053][ T5786] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1015.227490][ T5786] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1015.238043][ T5786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1015.246003][ T5786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1015.253812][ T5786] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1015.261368][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1015.352955][ T5928] usb 6-1: USB disconnect, device number 29 [ 1015.666424][T15497] lo speed is unknown, defaulting to 1000 [ 1015.749861][T15503] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1016.416395][ T6007] tipc: Left network mode [ 1016.829243][T15497] wg2 speed is unknown, defaulting to 1000 [ 1016.898612][T15524] comedi comedi1: Minor 47 could not be opened [ 1016.955554][T15513] syzkaller0: entered promiscuous mode [ 1016.990929][T15524] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2462'. [ 1017.000426][T15513] syzkaller0: entered allmulticast mode [ 1017.355711][ T5786] Bluetooth: hci0: command tx timeout [ 1017.608889][T15532] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1018.461161][T15548] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2466'. [ 1018.487957][ T27] audit: type=1800 audit(2000000892.662:138): pid=15544 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2466" name="ipv4_address" dev="configfs" ino=41386 res=0 errno=0 [ 1018.691083][ T6007] bond7: (slave wlan1): Releasing backup interface [ 1018.992982][ T27] audit: type=1800 audit(2000000893.162:139): pid=15558 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2469" name="max_speed" dev="configfs" ino=41418 res=0 errno=0 [ 1019.267752][T15557] syzkaller0: entered promiscuous mode [ 1019.273279][T15557] syzkaller0: entered allmulticast mode [ 1019.438704][ T5786] Bluetooth: hci0: command tx timeout [ 1019.482520][T15497] chnl_net:caif_netlink_parms(): no params data found [ 1019.646600][T15568] loop5: detected capacity change from 0 to 4096 [ 1019.741796][T15568] ntfs3: loop5: Different NTFS sector size (1024) and media sector size (512). [ 1020.566687][T15579] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1020.650115][ T6007] hsr_slave_0: left promiscuous mode [ 1020.751060][ T6007] hsr_slave_1: left promiscuous mode [ 1020.848374][ T6007] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1020.886495][ T6007] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1021.483508][T15570] loop2: detected capacity change from 0 to 32768 [ 1021.518515][ T5786] Bluetooth: hci0: command tx timeout [ 1021.595940][T15570] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2471 (15570) [ 1021.655930][T15595] jffs2: notice: (15595) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1021.790814][T15570] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1022.486498][T15598] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1023.587699][ T5786] Bluetooth: hci0: command tx timeout [ 1023.747599][T15570] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 1023.820174][T15570] BTRFS info (device loop2): using free space tree [ 1023.888087][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-worker": -EINTR [ 1023.941693][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 1024.040350][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-flush_delalloc": -EINTR [ 1024.123577][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-cache": -EINTR [ 1024.240223][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 1024.240828][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 1024.258907][ T6007] bond7 (unregistering): Released all slaves [ 1024.329584][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-meta": -EINTR [ 1024.343812][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-rmw": -EINTR [ 1024.438421][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-write": -EINTR [ 1024.488537][ T27] audit: type=1800 audit(2000000898.652:140): pid=15616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2479" name="ipv4_address" dev="configfs" ino=41506 res=0 errno=0 [ 1024.535935][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-compressed-write": -EINTR [ 1024.538796][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 1024.634218][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 1024.734196][T15570] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 1024.894857][T15570] BTRFS error (device loop2): open_ctree failed: -12 [ 1024.915273][T14314] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by udevd (14314) [ 1025.351297][ T6007] bond6 (unregistering): Released all slaves [ 1026.152442][ T6007] bond5 (unregistering): Released all slaves [ 1026.384962][T15623] loop2: detected capacity change from 0 to 32768 [ 1026.428382][T15623] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.2480 (15623) [ 1026.546124][T15623] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1026.580329][ T6007] bond4 (unregistering): Released all slaves [ 1026.591024][T15623] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 1026.648884][T15623] BTRFS info (device loop2): setting nodatacow, compression disabled [ 1026.689121][T15623] BTRFS info (device loop2): disabling tree log [ 1026.732431][T15623] BTRFS info (device loop2): max_inline at 0 [ 1026.758198][T15623] BTRFS info (device loop2): using free space tree [ 1026.950441][T15623] BTRFS info (device loop2): auto enabling async discard [ 1027.331717][ T5775] BTRFS info (device loop2): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1027.371697][ T6007] bond3 (unregistering): Released all slaves [ 1028.074505][ T6007] bond2 (unregistering): Released all slaves [ 1028.504155][ T6007] bond1 (unregistering): Released all slaves [ 1029.114194][T15662] loop2: detected capacity change from 0 to 32768 [ 1029.168386][T15662] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2487 (15662) [ 1029.280078][T15662] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1029.337389][T15662] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 1029.381803][T15662] BTRFS info (device loop2): using free space tree [ 1029.511803][T15662] BTRFS info (device loop2): enabling ssd optimizations [ 1029.546288][T15662] BTRFS info (device loop2): auto enabling async discard [ 1030.134757][ T6007] team0 (unregistering): Port device team_slave_1 removed [ 1030.343135][ T6007] team0 (unregistering): Port device team_slave_0 removed [ 1030.462119][ T6007] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1030.503105][ T5775] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1030.628292][ T6007] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1031.718979][ T6007] bond0 (unregistering): Released all slaves [ 1031.880743][T15614] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2479'. [ 1032.003101][T15686] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1032.256212][T15497] bridge0: port 1(bridge_slave_0) entered blocking state [ 1032.324003][T15497] bridge0: port 1(bridge_slave_0) entered disabled state [ 1032.616886][T15497] bridge_slave_0: entered allmulticast mode [ 1032.623949][T15497] bridge_slave_0: entered promiscuous mode [ 1032.743487][T15497] bridge0: port 2(bridge_slave_1) entered blocking state [ 1032.801453][T15497] bridge0: port 2(bridge_slave_1) entered disabled state [ 1032.875992][T15497] bridge_slave_1: entered allmulticast mode [ 1032.921714][T15497] bridge_slave_1: entered promiscuous mode [ 1033.141737][T15497] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1033.222477][T15497] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1033.362055][T15709] bond1: (slave wlan1): Releasing backup interface [ 1033.574621][T15497] team0: Port device team_slave_0 added [ 1033.650445][T15497] team0: Port device team_slave_1 added [ 1033.813074][T15497] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1033.918275][T15497] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1034.079136][T15497] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1034.193833][ T27] audit: type=1800 audit(2000000908.363:141): pid=15720 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2496" name="ipv4_address" dev="configfs" ino=41713 res=0 errno=0 [ 1034.226302][T15722] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2496'. [ 1034.294505][T15497] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1034.340842][T15497] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1034.509057][T15497] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1034.741020][T15497] hsr_slave_0: entered promiscuous mode [ 1034.790519][T15497] hsr_slave_1: entered promiscuous mode [ 1034.845058][T15497] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1034.889479][T15497] Cannot create hsr debugfs directory [ 1034.898680][T15713] loop5: detected capacity change from 0 to 32768 [ 1034.989208][T15713] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by syz.5.2495 (15713) [ 1035.151049][T15713] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1035.224929][T15713] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 1035.290279][T15713] BTRFS info (device loop5): using free space tree [ 1035.426096][T15713] BTRFS info (device loop5): enabling ssd optimizations [ 1035.481043][T15713] BTRFS info (device loop5): auto enabling async discard [ 1035.880737][ T9106] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1036.703721][T15766] md: could not open device unknown-block(7,0). [ 1037.807474][T15782] loop2: detected capacity change from 0 to 4096 [ 1037.914651][T15782] ntfs3: loop2: Different NTFS sector size (1024) and media sector size (512). [ 1038.206547][T15497] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1038.285475][T15497] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1038.339504][T15497] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1038.385808][T15497] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1038.929824][T15800] comedi comedi1: Minor 47 could not be opened [ 1038.939894][T15497] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1038.977345][T15800] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2513'. [ 1039.057448][T15497] 8021q: adding VLAN 0 to HW filter on device team0 [ 1039.106529][T13701] bridge0: port 1(bridge_slave_0) entered blocking state [ 1039.113726][T13701] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1039.217589][ T6007] bridge0: port 2(bridge_slave_1) entered blocking state [ 1039.224840][ T6007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1039.234081][T15804] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1039.393659][T15497] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1039.466522][T15497] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1040.446955][T15497] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1040.529512][T15827] netlink: 'syz.5.2516': attribute type 39 has an invalid length. [ 1040.551784][T15799] loop2: detected capacity change from 0 to 32768 [ 1040.664313][T15799] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.2511 (15799) [ 1040.850434][T15799] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1040.996416][T15799] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 1041.005097][T15799] BTRFS info (device loop2): using free space tree [ 1041.238699][T15841] jffs2: notice: (15841) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1043.409475][T15799] BTRFS error (device loop2): open_ctree failed: -4 [ 1043.785956][T15864] netlink: 'syz.5.2518': attribute type 1 has an invalid length. [ 1043.884794][T15864] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1044.049911][T15866] bond7: (slave wlan1): Enslaving as an active interface with a down link [ 1044.115936][T15497] veth0_vlan: entered promiscuous mode [ 1044.190688][T15497] veth1_vlan: entered promiscuous mode [ 1044.392910][T15497] veth0_macvtap: entered promiscuous mode [ 1044.473897][T15497] veth1_macvtap: entered promiscuous mode [ 1046.838199][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1046.914948][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1046.987206][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1047.083844][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1047.155956][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1047.229774][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1047.310056][T15497] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1047.408762][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1047.470749][T15892] comedi comedi1: Minor 47 could not be opened [ 1047.477143][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1047.534325][T15892] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2525'. [ 1047.565973][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1047.618386][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1047.672204][T15497] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1047.725914][T15497] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1047.777558][T15497] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1047.848989][T15497] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.890043][T15497] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.925435][T15497] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1047.962167][T15497] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.292332][ T6011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1048.366043][ T6011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.527974][ T6007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1048.613819][ T6007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.657387][T15908] netlink: 'syz.5.2529': attribute type 1 has an invalid length. [ 1048.792841][T15908] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1048.800378][T15895] loop3: detected capacity change from 0 to 32768 [ 1048.855318][T15895] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2526 (15895) [ 1048.973619][T15911] bond7: (slave wlan1): Releasing active interface [ 1049.003036][T15895] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1049.051994][T15911] bond8: (slave wlan1): Enslaving as an active interface with a down link [ 1049.078207][T15895] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 1049.155905][T15895] BTRFS info (device loop3): using free space tree [ 1049.415592][T15895] BTRFS info (device loop3): enabling ssd optimizations [ 1049.460620][T15895] BTRFS info (device loop3): auto enabling async discard [ 1049.747284][T14618] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1053.701958][T15959] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1053.761438][T15959] afs: Unknown parameter 'dy' [ 1054.634489][T15997] loop5: detected capacity change from 0 to 512 [ 1054.665267][T15965] loop2: detected capacity change from 0 to 32768 [ 1054.712792][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.729083][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.780309][T15965] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.2537 (15965) [ 1054.843430][T15997] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1054.975589][T15997] ext4 filesystem being mounted at /453/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1054.988902][T15965] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1055.110232][T15965] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 1055.222508][T15965] BTRFS info (device loop2): setting nodatacow, compression disabled [ 1055.316443][T15965] BTRFS info (device loop2): disabling tree log [ 1055.322798][T15965] BTRFS info (device loop2): max_inline at 0 [ 1055.373360][ T9106] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1055.596428][T15965] BTRFS info (device loop2): using free space tree [ 1055.696421][T15988] loop4: detected capacity change from 0 to 32768 [ 1055.731095][T16016] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1055.777659][T15965] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-write": -EINTR [ 1055.783857][T15965] workqueue: Failed to create a rescuer kthread for wq "btrfs-compressed-write": -EINTR [ 1055.814931][T15988] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 scanned by syz.4.2542 (15988) [ 1055.958259][T15965] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 1055.990044][T15965] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 1056.122123][T15965] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 1056.149389][T15988] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1056.375929][T15965] BTRFS error (device loop2): open_ctree failed: -12 [ 1056.383338][T15988] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 1056.463236][T15988] BTRFS info (device loop4): using free space tree [ 1056.823567][T15988] BTRFS info (device loop4): enabling ssd optimizations [ 1056.889168][T15988] BTRFS info (device loop4): auto enabling async discard [ 1056.904072][T14314] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by udevd (14314) [ 1057.178403][T15497] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1058.930605][T16074] MTD: Couldn't look up './dev/mtdblock0': -2 [ 1059.147551][T16077] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1059.271215][T16066] afs: Unknown parameter 'dy' [ 1059.288666][T16080] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2555'. [ 1059.457047][T16084] mac80211_hwsim hwsim17 wlan1: entered promiscuous mode [ 1059.516288][T16084] batman_adv: batadv0: Adding interface: wlan1 [ 1059.563919][T16084] batman_adv: batadv0: The MTU of interface wlan1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1059.653932][T16084] batman_adv: batadv0: Not using interface wlan1 (retrying later): interface not active [ 1059.994186][T16061] loop2: detected capacity change from 0 to 40427 [ 1060.120835][T16061] F2FS-fs (loop2): invalid crc value [ 1060.820295][T16061] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 1060.907465][ T5786] Bluetooth: hci2: ACL packet for unknown connection handle 200 [ 1061.397524][T16092] loop3: detected capacity change from 0 to 32768 [ 1061.480598][T16113] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1061.508845][T16092] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1061.574463][T16092] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm [ 1061.624725][T16092] BTRFS info (device loop3): setting nodatacow, compression disabled [ 1061.683345][T16092] BTRFS info (device loop3): disabling tree log [ 1061.720264][T16092] BTRFS info (device loop3): max_inline at 0 [ 1061.761318][T16092] BTRFS info (device loop3): using free space tree [ 1061.909891][ T5786] Bluetooth: hci3: command 0x0406 tx timeout [ 1061.994088][T16092] BTRFS info (device loop3): auto enabling async discard [ 1062.289580][T14618] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1063.413430][ T27] audit: type=1800 audit(2000000937.574:142): pid=16147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2572" name="num" dev="configfs" ino=43132 res=0 errno=0 [ 1063.535117][ T27] audit: type=1800 audit(2000000937.604:143): pid=16147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2572" name="ipv4_port" dev="configfs" ino=43133 res=0 errno=0 [ 1063.640054][T16149] random: crng reseeded on system resumption [ 1063.689672][ T27] audit: type=1800 audit(2000000937.614:144): pid=16147 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2572" name="num" dev="configfs" ino=43134 res=0 errno=0 [ 1063.756270][T16151] CIFS: Attempting to mount //127.0.0.1/share [ 1063.844208][T16154] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1 [ 1063.890767][T16156] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2565'. [ 1064.195126][T16143] loop3: detected capacity change from 0 to 32768 [ 1064.246936][T16143] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop3 scanned by syz.3.2570 (16143) [ 1064.332591][T16143] BTRFS info (device loop3): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1064.400668][T16143] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 1064.454063][T16143] BTRFS info (device loop3): using free space tree [ 1064.533883][T16143] BTRFS info (device loop3): enabling ssd optimizations [ 1064.568306][T16143] BTRFS info (device loop3): auto enabling async discard [ 1064.578557][T16151] CIFS: VFS: \\127.0.0.1 Send error in SessSetup = -11 [ 1064.628904][T16151] CIFS: VFS: cifs_mount failed w/return code = -11 [ 1064.693436][T16159] loop5: detected capacity change from 0 to 4096 [ 1064.754164][T14618] BTRFS info (device loop3): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1065.495549][T16187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2578'. [ 1066.079674][T16200] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1066.315162][T16203] Illegal XDP return value 4294967274 on prog (id 144) dev syz_tun, expect packet loss! [ 1066.452283][T16205] FAULT_INJECTION: forcing a failure. [ 1066.452283][T16205] name failslab, interval 1, probability 0, space 0, times 0 [ 1066.570744][T16205] CPU: 0 PID: 16205 Comm: syz.3.2585 Not tainted syzkaller #0 [ 1066.578269][T16205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1066.588347][T16205] Call Trace: [ 1066.591642][T16205] [ 1066.594593][T16205] dump_stack_lvl+0x18c/0x250 [ 1066.599303][T16205] ? show_regs_print_info+0x20/0x20 [ 1066.604527][T16205] ? load_image+0x420/0x420 [ 1066.609052][T16205] ? __might_sleep+0xe0/0xe0 [ 1066.613695][T16205] ? __lock_acquire+0x7d80/0x7d80 [ 1066.618755][T16205] should_fail_ex+0x394/0x4c0 [ 1066.623462][T16205] should_failslab+0x9/0x20 [ 1066.627989][T16205] slab_pre_alloc_hook+0x59/0x300 [ 1066.633050][T16205] kmem_cache_alloc+0x5a/0x2c0 [ 1066.637877][T16205] ? __proc_create+0x373/0x8b0 [ 1066.642714][T16205] __proc_create+0x373/0x8b0 [ 1066.647333][T16205] ? proc_symlink+0x260/0x260 [ 1066.652040][T16205] ? __register_sysctl_table+0x10fe/0x1210 [ 1066.657871][T16205] ? __lock_acquire+0x7d80/0x7d80 [ 1066.662919][T16205] proc_create_reg+0x8b/0x110 [ 1066.667642][T16205] proc_create_net_data+0x99/0x1b0 [ 1066.672782][T16205] ? bpf_iter_fini_seq_net+0xc0/0xc0 [ 1066.678086][T16205] ? _raw_spin_unlock+0x28/0x40 [ 1066.682980][T16205] ? __register_sysctl_table+0x1139/0x1210 [ 1066.688814][T16205] nf_log_net_init+0x62/0x680 [ 1066.693584][T16205] ops_init+0x391/0x640 [ 1066.697793][T16205] setup_net+0x3b6/0xa20 [ 1066.702063][T16205] ? copy_net_ns+0x5d0/0x5d0 [ 1066.706716][T16205] ? copy_net_ns+0x342/0x5d0 [ 1066.711340][T16205] ? down_read_killable+0x1d0/0x340 [ 1066.716604][T16205] copy_net_ns+0x35e/0x5d0 [ 1066.721057][T16205] create_new_namespaces+0x3ce/0x700 [ 1066.726384][T16205] unshare_nsproxy_namespaces+0x11a/0x160 [ 1066.732137][T16205] ksys_unshare+0x4fa/0x8f0 [ 1066.736689][T16205] ? sighand_ctor+0x50/0x50 [ 1066.741215][T16205] ? lock_chain_count+0x20/0x20 [ 1066.746096][T16205] ? syscall_enter_from_user_mode+0x25/0x80 [ 1066.752021][T16205] __x64_sys_unshare+0x38/0x40 [ 1066.756827][T16205] do_syscall_64+0x55/0xb0 [ 1066.761291][T16205] ? clear_bhb_loop+0x40/0x90 [ 1066.765998][T16205] ? clear_bhb_loop+0x40/0x90 [ 1066.770731][T16205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1066.776648][T16205] RIP: 0033:0x7fecef39e159 [ 1066.781081][T16205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1066.800709][T16205] RSP: 002b:00007fecf01b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1066.809148][T16205] RAX: ffffffffffffffda RBX: 00007fecef625fa0 RCX: 00007fecef39e159 [ 1066.817139][T16205] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 1066.825137][T16205] RBP: 00007fecef435024 R08: 0000000000000000 R09: 0000000000000000 [ 1066.833129][T16205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1066.841206][T16205] R13: 00007fecef626038 R14: 00007fecef625fa0 R15: 00007fff7cef2db8 [ 1066.849216][T16205] [ 1068.095154][T16220] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2591'. [ 1068.170169][ T27] audit: type=1800 audit(2000000942.335:145): pid=16220 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2591" name="ipv4_address" dev="configfs" ino=43327 res=0 errno=0 [ 1068.783516][T16233] comedi comedi1: Minor 47 could not be opened [ 1068.833285][T16233] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2598'. [ 1069.047327][T16239] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2601'. [ 1069.180779][T16243] netlink: 'syz.5.2603': attribute type 1 has an invalid length. [ 1069.297839][T16243] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1069.438209][T16246] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1069.478312][T16246] bond9: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1069.555674][T16246] bond9: (slave wireguard0): Error -95 calling set_mac_address [ 1069.819092][T16255] loop3: detected capacity change from 0 to 4096 [ 1070.053169][T16259] loop5: detected capacity change from 0 to 512 [ 1070.180553][T16259] EXT4-fs error (device loop5): ext4_orphan_get:1434: comm syz.5.2609: bad orphan inode 15 [ 1070.274652][T16259] ext4_test_bit(bit=14, block=5) = 0 [ 1070.328920][T16259] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1070.636413][ T9106] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1070.749686][T16267] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2612'. [ 1071.051746][T16253] loop4: detected capacity change from 0 to 32768 [ 1071.128094][T16253] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop4 scanned by syz.4.2606 (16253) [ 1071.254171][T16276] netlink: 'syz.5.2615': attribute type 39 has an invalid length. [ 1071.328517][T16253] BTRFS info (device loop4): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1071.400711][T16253] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 1071.462002][T16279] netlink: 'syz.3.2617': attribute type 1 has an invalid length. [ 1071.489505][T16253] BTRFS info (device loop4): setting nodatacow, compression disabled [ 1071.549243][T16253] BTRFS info (device loop4): disabling tree log [ 1071.597997][T16253] BTRFS info (device loop4): max_inline at 0 [ 1071.645511][T16253] BTRFS info (device loop4): using free space tree [ 1071.673940][T16279] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1071.706441][T16285] comedi comedi1: Minor 47 could not be opened [ 1071.772246][T16285] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2616'. [ 1071.808628][T16282] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1071.842191][T16253] BTRFS info (device loop4): auto enabling async discard [ 1071.852597][T16282] bond2: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1071.909349][T16282] bond2: (slave wireguard0): Error -95 calling set_mac_address [ 1072.039213][T15497] BTRFS info (device loop4): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 1072.493287][T14314] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 9 /dev/loop4 scanned by udevd (14314) [ 1072.786056][T16313] No source specified [ 1072.972616][T16311] loop5: detected capacity change from 0 to 4096 [ 1073.657108][T16332] netlink: 'syz.2.2627': attribute type 39 has an invalid length. [ 1074.014919][T16332] bond0: (slave syz_tun): Releasing backup interface [ 1074.199810][T16342] comedi comedi1: Minor 47 could not be opened [ 1074.263364][T16342] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2631'. [ 1074.382260][T13441] block nbd3: Receive control failed (result -32) [ 1074.390325][T16329] block nbd3: shutting down sockets [ 1074.650480][T16347] loop2: detected capacity change from 0 to 1024 [ 1075.078516][T16347] hfsplus: can't free extent [ 1076.392149][T13441] block nbd3: Receive control failed (result -32) [ 1076.399765][T16368] block nbd3: shutting down sockets [ 1077.035369][T16407] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 1077.472046][T16414] loop4: detected capacity change from 0 to 8 [ 1077.976613][T16416] loop2: detected capacity change from 0 to 4096 [ 1078.043261][T16416] EXT4-fs: inline encryption not supported [ 1078.111838][T16416] EXT4-fs: Ignoring removed mblk_io_submit option [ 1078.177050][T16416] EXT4-fs: inline encryption not supported [ 1078.197496][T16418] loop3: detected capacity change from 0 to 4096 [ 1078.246432][T16416] ext4: Unknown parameter 'in' [ 1078.777146][T16422] trusted_key: encrypted_key: insufficient parameters specified [ 1079.691017][T16423] block nbd4: shutting down sockets [ 1080.032830][T16443] comedi comedi1: Minor 47 could not be opened [ 1080.063289][T16443] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2669'. [ 1080.502670][T16455] netlink: 'syz.2.2673': attribute type 1 has an invalid length. [ 1080.641265][T16455] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1080.847693][T16466] md0: can't set backlog, no write mostly device available [ 1080.921837][T16459] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1080.957277][T16459] bond8: (slave wireguard5): The slave device specified does not support setting the MAC address [ 1081.045320][T16459] bond8: (slave wireguard5): Error -95 calling set_mac_address [ 1081.253598][T16476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2679'. [ 1081.273003][ T27] audit: type=1800 audit(2000000955.435:146): pid=16474 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2680" name="max_speed" dev="configfs" ino=44092 res=0 errno=0 [ 1081.404583][ T27] audit: type=1800 audit(2000000955.495:147): pid=16476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2679" name="ipv4_address" dev="configfs" ino=44093 res=0 errno=0 [ 1081.693275][T16486] FAULT_INJECTION: forcing a failure. [ 1081.693275][T16486] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1081.722927][T16486] CPU: 0 PID: 16486 Comm: syz.5.2684 Not tainted syzkaller #0 [ 1081.730447][T16486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1081.740549][T16486] Call Trace: [ 1081.743846][T16486] [ 1081.746797][T16486] dump_stack_lvl+0x18c/0x250 [ 1081.751509][T16486] ? show_regs_print_info+0x20/0x20 [ 1081.756735][T16486] ? load_image+0x420/0x420 [ 1081.761261][T16486] ? rcu_is_watching+0x15/0xb0 [ 1081.766068][T16486] ? trace_pelt_se_tp+0x39/0x100 [ 1081.771028][T16486] should_fail_ex+0x394/0x4c0 [ 1081.775753][T16486] get_futex_key+0x136/0x1030 [ 1081.780476][T16486] ? futex_setup_timer+0xc0/0xc0 [ 1081.785430][T16486] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1081.791451][T16486] ? __lock_acquire+0x7d80/0x7d80 [ 1081.796498][T16486] ? lock_chain_count+0x20/0x20 [ 1081.801459][T16486] futex_wait_setup+0xbc/0x270 [ 1081.806260][T16486] ? futex_wait_multiple+0x920/0x920 [ 1081.811576][T16486] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1081.817496][T16486] ? _raw_spin_unlock+0x40/0x40 [ 1081.822375][T16486] futex_wait+0x1bc/0x5c0 [ 1081.826732][T16486] ? futex_wait_setup+0x270/0x270 [ 1081.831791][T16486] do_futex+0x2ff/0x3e0 [ 1081.835972][T16486] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1081.841881][T16486] ? fput+0x154/0x1a0 [ 1081.845909][T16486] __se_sys_futex+0x3a9/0x440 [ 1081.850610][T16486] ? __x64_sys_futex+0xf0/0xf0 [ 1081.855393][T16486] ? __x64_sys_futex+0x21/0xf0 [ 1081.860172][T16486] do_syscall_64+0x55/0xb0 [ 1081.864607][T16486] ? clear_bhb_loop+0x40/0x90 [ 1081.869305][T16486] ? clear_bhb_loop+0x40/0x90 [ 1081.874036][T16486] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1081.879949][T16486] RIP: 0033:0x7fea28d9e159 [ 1081.884383][T16486] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1081.904010][T16486] RSP: 002b:00007fea29d150e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1081.912450][T16486] RAX: ffffffffffffffda RBX: 00007fea29025fa8 RCX: 00007fea28d9e159 [ 1081.920439][T16486] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fea29025fa8 [ 1081.928428][T16486] RBP: 00007fea29025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1081.936425][T16486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1081.944415][T16486] R13: 00007fea29026038 R14: 00007ffd6ab2b980 R15: 00007ffd6ab2ba68 [ 1081.952420][T16486] [ 1082.043955][T14972] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 1082.265359][T14972] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x4F, skipping [ 1082.281952][T14972] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1082.322643][T14972] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1082.358827][T14972] usb 5-1: Product: syz [ 1082.393178][T14972] usb 5-1: Manufacturer: syz [ 1082.422432][T14972] usb 5-1: SerialNumber: syz [ 1082.460554][T14972] usb 5-1: config 0 descriptor?? [ 1082.553298][T14972] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 1082.621055][T14314] udevd[14314]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1082.790766][T16501] netlink: 'syz.5.2691': attribute type 1 has an invalid length. [ 1082.890414][T16501] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1082.927120][ T27] audit: type=1800 audit(2000000957.086:148): pid=16510 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2692" name="max_speed" dev="configfs" ino=44183 res=0 errno=0 [ 1083.043563][T16508] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1083.073088][T16516] 9pnet_fd: Insufficient options for proto=fd [ 1083.082491][T16508] bond10: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1083.111392][T16508] bond10: (slave wireguard0): Error -95 calling set_mac_address [ 1083.573439][T16525] CIFS: Attempting to mount //127.0.0.1/share [ 1084.090374][T16521] loop5: detected capacity change from 0 to 32768 [ 1084.117568][T16521] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by syz.5.2696 (16521) [ 1084.181145][T16521] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1084.226824][T16521] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 1084.278921][T16521] BTRFS info (device loop5): using free space tree [ 1084.392620][T16525] CIFS: VFS: cifs_mount failed w/return code = -512 [ 1084.414609][T16521] BTRFS info (device loop5): enabling ssd optimizations [ 1084.452518][T16521] BTRFS info (device loop5): auto enabling async discard [ 1084.520807][ T7092] usb 5-1: USB disconnect, device number 24 [ 1085.223848][ T27] audit: type=1800 audit(2000000959.366:149): pid=16554 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2703" name="max_speed" dev="configfs" ino=44268 res=0 errno=0 [ 1085.650395][ T9106] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 1086.032114][ T5786] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1086.043923][ T5786] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1086.058726][ T5786] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1086.067272][ T5786] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1086.080292][ T5786] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1086.087902][ T5786] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1086.290912][T16564] lo speed is unknown, defaulting to 1000 [ 1086.329470][T16567] fuse: root generation should be zero [ 1086.378522][T16571] CIFS: Attempting to mount //127.0.0.1/share [ 1086.750411][ T5775] syz-executor (5775) used greatest stack depth: 20616 bytes left [ 1087.072049][ T6011] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.121661][ T6024] infiniband syz2: set down [ 1087.182107][T16571] CIFS: VFS: cifs_mount failed w/return code = -112 [ 1087.209201][ T6011] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.246392][T16576] netlink: 'syz.3.2711': attribute type 39 has an invalid length. [ 1087.369820][T16578] netlink: 'syz.5.2704': attribute type 1 has an invalid length. [ 1087.440701][T16578] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1087.535144][T16579] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1087.555114][T16579] bond11: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1087.573045][T16579] bond11: (slave wireguard0): Error -95 calling set_mac_address [ 1087.615131][T16564] wg2 speed is unknown, defaulting to 1000 [ 1087.628498][ T27] audit: type=1800 audit(2000000961.796:150): pid=16588 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2713" name="max_speed" dev="configfs" ino=44397 res=0 errno=0 [ 1087.668015][ T6011] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.721092][ T7090] wg2 speed is unknown, defaulting to 1000 [ 1087.748393][T14972] wg2 speed is unknown, defaulting to 1000 [ 1088.026701][ T6011] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1088.145024][ T5786] Bluetooth: hci4: command tx timeout [ 1088.438632][T16598] comedi comedi1: Minor 47 could not be opened [ 1088.502219][T16598] netlink: 220 bytes leftover after parsing attributes in process `syz.5.2718'. [ 1089.175243][T16615] netlink: 'syz.4.2723': attribute type 1 has an invalid length. [ 1089.339716][T16615] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1089.505381][T16619] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1089.559053][T16619] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1089.602470][T16619] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 1089.727581][T16564] chnl_net:caif_netlink_parms(): no params data found [ 1090.224126][ T5786] Bluetooth: hci4: command tx timeout [ 1090.312975][T16564] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.362783][T16564] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.381404][T16648] comedi comedi1: Minor 47 could not be opened [ 1090.454575][T16564] bridge_slave_0: entered allmulticast mode [ 1090.461675][T16564] bridge_slave_0: entered promiscuous mode [ 1090.474320][T16648] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2732'. [ 1090.574983][T16564] bridge0: port 2(bridge_slave_1) entered blocking state [ 1090.622812][T16564] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.644034][T16564] bridge_slave_1: entered allmulticast mode [ 1090.695856][T16564] bridge_slave_1: entered promiscuous mode [ 1090.705409][ T6011] tipc: Disabling bearer [ 1090.754381][ T6011] tipc: Left network mode [ 1091.192764][T16564] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1091.366354][T16564] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1091.447822][T16669] netlink: 'syz.3.2737': attribute type 1 has an invalid length. [ 1091.553008][T16669] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1091.643234][T16670] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1091.676162][T16670] bond3: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1091.702110][T16670] bond3: (slave wireguard0): Error -95 calling set_mac_address [ 1092.090312][T16564] team0: Port device team_slave_0 added [ 1092.149397][T16564] team0: Port device team_slave_1 added [ 1092.303527][ T5786] Bluetooth: hci4: command tx timeout [ 1092.629160][T16564] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1092.675040][T16564] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1092.853308][T16564] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1092.931663][T16564] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1092.987486][T16564] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1093.146121][T16695] comedi comedi1: Minor 47 could not be opened [ 1093.178128][T16564] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1093.204132][T16695] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2744'. [ 1093.752375][T16564] hsr_slave_0: entered promiscuous mode [ 1093.792137][T16564] hsr_slave_1: entered promiscuous mode [ 1093.822565][T16564] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1093.846488][T16564] Cannot create hsr debugfs directory [ 1094.174089][T16711] CIFS: Attempting to mount //127.0.0.1/share [ 1094.229833][T16711] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1094.298792][T16711] CIFS: VFS: cifs_mount failed w/return code = -111 [ 1094.384033][ T5786] Bluetooth: hci4: command tx timeout [ 1094.687467][T16713] netlink: 'syz.3.2747': attribute type 1 has an invalid length. [ 1094.840799][T16713] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1094.965243][T16714] bond4: (slave wlan1): Enslaving as an active interface with a down link [ 1095.028339][T16717] netlink: 'syz.5.2748': attribute type 1 has an invalid length. [ 1095.180220][T16717] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1095.288159][T16721] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1095.306191][T16721] bond12: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1095.357407][T16721] bond12: (slave wireguard0): Error -95 calling set_mac_address [ 1096.464709][ T6011] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1096.520337][ T6011] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1096.571437][ T6011] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1096.599467][ T6011] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1096.740613][ T6011] veth1_macvtap: left promiscuous mode [ 1096.779406][ T6011] veth0_macvtap: left promiscuous mode [ 1096.823158][ T6011] veth1_vlan: left promiscuous mode [ 1096.828509][ T6011] veth0_vlan: left promiscuous mode [ 1097.224474][ T6011] infiniband syz2: set down [ 1097.351823][ T6011] infiniband syz0: set down [ 1099.792122][ T6011] bond8 (unregistering): Released all slaves [ 1100.052723][ T6011] bond7 (unregistering): Released all slaves [ 1100.083823][ T5928] usb 5-1: new full-speed USB device number 25 using dummy_hcd [ 1100.296576][ T5928] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0x4F, skipping [ 1100.326519][ T5928] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1100.344862][ T6011] bond6 (unregistering): Released all slaves [ 1100.351036][ T5928] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1100.372647][ T5928] usb 5-1: Product: syz [ 1100.391556][ T5928] usb 5-1: Manufacturer: syz [ 1100.417552][ T5928] usb 5-1: SerialNumber: syz [ 1100.431245][ T5928] usb 5-1: config 0 descriptor?? [ 1100.512653][ T5928] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 1100.561117][T14314] udevd[14314]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1100.752222][ T6011] bond5 (unregistering): Released all slaves [ 1100.984662][ T6011] bond4 (unregistering): Released all slaves [ 1101.063297][T16759] 9pnet_fd: Insufficient options for proto=fd [ 1101.250898][ T6011] bond3 (unregistering): Released all slaves [ 1101.499756][ T6011] bond2 (unregistering): Released all slaves [ 1101.738958][ T6011] bond1 (unregistering): Released all slaves [ 1102.619517][ T6011] team0 (unregistering): Port device team_slave_1 removed [ 1102.699753][ T6011] team0 (unregistering): Port device team_slave_0 removed [ 1102.780154][ T6011] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1102.811180][ T5928] usb 5-1: USB disconnect, device number 25 [ 1102.970238][ T6011] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1103.336368][ T27] audit: type=1800 audit(2000000977.507:151): pid=16767 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2761" name="max_speed" dev="configfs" ino=45000 res=0 errno=0 [ 1103.379202][T13701] smc: removing ib device syz2 [ 1104.504672][ T6011] bond0 (unregistering): Released all slaves [ 1104.713675][ T6024] smc: removing ib device syz0 [ 1104.865536][ T7092] wg2 speed is unknown, defaulting to 1000 [ 1104.873618][T14972] lo speed is unknown, defaulting to 1000 [ 1104.887351][T16755] netlink: 'syz.3.2758': attribute type 1 has an invalid length. [ 1104.958000][T16755] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1105.073246][T16756] bond4: (slave wlan1): Releasing active interface [ 1106.369393][T16781] loop6: detected capacity change from 0 to 6 [ 1106.390432][T16781] Dev loop6: unable to read RDB block 6 [ 1106.396544][T16781] loop6: unable to read partition table [ 1106.402735][T16781] loop6: partition table beyond EOD, truncated [ 1106.408955][T16781] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1109.481234][T16799] netlink: 'syz.4.2769': attribute type 1 has an invalid length. [ 1110.527279][T16799] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1110.743372][T16800] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 1111.075426][T16811] loop6: detected capacity change from 0 to 6 [ 1111.093241][T16811] Dev loop6: unable to read RDB block 6 [ 1111.098854][T16811] loop6: unable to read partition table [ 1111.104855][T16811] loop6: partition table beyond EOD, truncated [ 1111.111048][T16811] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1112.273885][T16820] loop6: detected capacity change from 0 to 6 [ 1112.293958][T16820] Dev loop6: unable to read RDB block 6 [ 1112.299588][T16820] loop6: unable to read partition table [ 1112.305837][T16820] loop6: partition table beyond EOD, truncated [ 1112.312025][T16820] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1114.415784][T16564] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1114.516021][T16564] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1114.788706][T16564] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1114.836880][T16564] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1114.871341][T16848] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2772'. [ 1114.998888][ T6011] IPVS: stop unused estimator thread 0... [ 1115.363822][T16564] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1115.493336][T16851] netlink: 'syz.3.2780': attribute type 1 has an invalid length. [ 1115.803979][T16851] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1116.146113][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.155905][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.212899][T16852] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1116.248752][T16852] bond5: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1116.303919][T16852] bond5: (slave wireguard0): Error -95 calling set_mac_address [ 1116.682690][T16564] 8021q: adding VLAN 0 to HW filter on device team0 [ 1116.793961][ T6007] bridge0: port 1(bridge_slave_0) entered blocking state [ 1116.801156][ T6007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1116.819537][T16881] CIFS: Attempting to mount //127.0.0.1/share [ 1116.994713][ T6024] bridge0: port 2(bridge_slave_1) entered blocking state [ 1117.001944][ T6024] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1117.584117][T16881] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server [ 1117.659684][T16881] ------------[ cut here ]------------ [ 1117.666432][T16881] WARNING: CPU: 0 PID: 16881 at fs/smb/client/smb2ops.c:97 smb2_add_credits+0x1365/0x2600 [ 1117.677254][T16881] Modules linked in: [ 1117.681178][T16881] CPU: 0 PID: 16881 Comm: syz.4.2783 Not tainted syzkaller #0 [ 1117.689015][T16881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1117.699388][T16881] RIP: 0010:smb2_add_credits+0x1365/0x2600 [ 1117.705452][T16881] Code: 03 42 80 3c 28 00 74 08 4c 89 e7 e8 b5 b1 3c ff 49 8b 34 24 48 c7 c7 a0 21 f7 8a e8 35 f1 e0 07 e9 eb f9 ff ff e8 1b 30 e4 fe <0f> 0b e9 d9 ef ff ff e8 0f 30 e4 fe c6 05 5e be d3 0b 01 48 c7 c7 [ 1117.725347][T16881] RSP: 0018:ffffc900047f7400 EFLAGS: 00010287 [ 1117.731461][T16881] RAX: ffffffff82a35255 RBX: ffff88807e67a2c0 RCX: 0000000000080000 [ 1117.739648][T16881] RDX: ffffc90010ffd000 RSI: 0000000000010039 RDI: 000000000001003a [ 1117.748090][T16881] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004 [ 1117.756176][T16881] R10: dffffc0000000000 R11: fffff520008fee70 R12: 1ffff1100fccf458 [ 1117.764584][T16881] R13: dffffc0000000000 R14: ffff88807e67a000 R15: 0000000000000000 [ 1117.772987][T16881] FS: 00007f50f94856c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1117.782382][T16881] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1117.789051][T16881] CR2: 00007fea28feec38 CR3: 000000007e2aa000 CR4: 00000000003506f0 [ 1117.797182][T16881] Call Trace: [ 1117.800485][T16881] [ 1117.803558][T16881] compound_send_recv+0x1254/0x3040 [ 1117.808838][T16881] ? cifs_pick_channel+0x320/0x320 [ 1117.814062][T16881] ? __rwlock_init+0x150/0x150 [ 1117.818872][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1117.824176][T16881] cifs_send_recv+0x40/0x50 [ 1117.828711][T16881] SMB2_negotiate+0x16b5/0x4270 [ 1117.833672][T16881] ? smb3_encryption_required+0x2f0/0x2f0 [ 1117.839444][T16881] ? smb2_negotiate+0x5c/0x70 [ 1117.844241][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1117.849502][T16881] ? _raw_spin_unlock+0x28/0x40 [ 1117.854451][T16881] cifs_negotiate_protocol+0x445/0x670 [ 1117.859946][T16881] cifs_get_smb_ses+0x8d6/0x1b00 [ 1117.865020][T16881] cifs_mount_get_session+0xef/0x440 [ 1117.870650][T16881] dfs_mount_share+0x1e9/0x7b0 [ 1117.875689][T16881] cifs_mount+0xbc/0x650 [ 1117.879979][T16881] ? __rwlock_init+0x150/0x150 [ 1117.884925][T16881] ? cifs_is_path_remote+0x6f0/0x6f0 [ 1117.890247][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1117.895642][T16881] ? smb3_update_mnt_flags+0x52f/0xc10 [ 1117.901146][T16881] ? cifs_setup_cifs_sb+0x52f/0x840 [ 1117.906888][T16881] cifs_smb3_do_mount+0x2e5/0x710 [ 1117.912024][T16881] ? cifs_sb_deactive+0x80/0x80 [ 1117.916915][T16881] ? vfs_parse_fs_string+0x10f/0x170 [ 1117.922312][T16881] smb3_get_tree+0x5a5/0xa90 [ 1117.926937][T16881] vfs_get_tree+0x8c/0x280 [ 1117.931375][T16881] do_new_mount+0x24a/0xa40 [ 1117.935980][T16881] __se_sys_mount+0x2e7/0x3d0 [ 1117.940691][T16881] ? __x64_sys_mount+0xc0/0xc0 [ 1117.945557][T16881] ? lockdep_hardirqs_on+0x98/0x150 [ 1117.950788][T16881] ? __x64_sys_mount+0x20/0xc0 [ 1117.955625][T16881] do_syscall_64+0x55/0xb0 [ 1117.960070][T16881] ? clear_bhb_loop+0x40/0x90 [ 1117.964897][T16881] ? clear_bhb_loop+0x40/0x90 [ 1117.969604][T16881] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1117.975897][T16881] RIP: 0033:0x7f50f859e159 [ 1117.980335][T16881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1118.000175][T16881] RSP: 002b:00007f50f9485028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1118.008657][T16881] RAX: ffffffffffffffda RBX: 00007f50f8825fa0 RCX: 00007f50f859e159 [ 1118.016746][T16881] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500 [ 1118.024820][T16881] RBP: 00007f50f8635024 R08: 0000200000000300 R09: 0000000000000000 [ 1118.032890][T16881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1118.040896][T16881] R13: 00007f50f8826038 R14: 00007f50f8825fa0 R15: 00007fff40d64a88 [ 1118.049009][T16881] [ 1118.052105][T16881] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1118.059490][T16881] CPU: 0 PID: 16881 Comm: syz.4.2783 Not tainted syzkaller #0 [ 1118.067049][T16881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1118.077208][T16881] Call Trace: [ 1118.080508][T16881] [ 1118.083481][T16881] dump_stack_lvl+0x18c/0x250 [ 1118.088184][T16881] ? show_regs_print_info+0x20/0x20 [ 1118.093435][T16881] ? load_image+0x420/0x420 [ 1118.097964][T16881] panic+0x2ca/0x720 [ 1118.101890][T16881] ? bpf_jit_dump+0xd0/0xd0 [ 1118.106433][T16881] __warn+0x2e0/0x470 [ 1118.110440][T16881] ? smb2_add_credits+0x1365/0x2600 [ 1118.115670][T16881] ? smb2_add_credits+0x1365/0x2600 [ 1118.120893][T16881] report_bug+0x2be/0x4f0 [ 1118.125244][T16881] ? smb2_add_credits+0x1365/0x2600 [ 1118.130465][T16881] ? smb2_add_credits+0x1365/0x2600 [ 1118.135686][T16881] ? smb2_add_credits+0x1367/0x2600 [ 1118.140905][T16881] handle_bug+0xcf/0x120 [ 1118.145257][T16881] exc_invalid_op+0x1a/0x50 [ 1118.149818][T16881] asm_exc_invalid_op+0x1a/0x20 [ 1118.154687][T16881] RIP: 0010:smb2_add_credits+0x1365/0x2600 [ 1118.160521][T16881] Code: 03 42 80 3c 28 00 74 08 4c 89 e7 e8 b5 b1 3c ff 49 8b 34 24 48 c7 c7 a0 21 f7 8a e8 35 f1 e0 07 e9 eb f9 ff ff e8 1b 30 e4 fe <0f> 0b e9 d9 ef ff ff e8 0f 30 e4 fe c6 05 5e be d3 0b 01 48 c7 c7 [ 1118.180236][T16881] RSP: 0018:ffffc900047f7400 EFLAGS: 00010287 [ 1118.186322][T16881] RAX: ffffffff82a35255 RBX: ffff88807e67a2c0 RCX: 0000000000080000 [ 1118.194331][T16881] RDX: ffffc90010ffd000 RSI: 0000000000010039 RDI: 000000000001003a [ 1118.202334][T16881] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004 [ 1118.210325][T16881] R10: dffffc0000000000 R11: fffff520008fee70 R12: 1ffff1100fccf458 [ 1118.218323][T16881] R13: dffffc0000000000 R14: ffff88807e67a000 R15: 0000000000000000 [ 1118.226328][T16881] ? smb2_add_credits+0x1365/0x2600 [ 1118.231588][T16881] compound_send_recv+0x1254/0x3040 [ 1118.236851][T16881] ? cifs_pick_channel+0x320/0x320 [ 1118.242002][T16881] ? __rwlock_init+0x150/0x150 [ 1118.246816][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1118.252045][T16881] cifs_send_recv+0x40/0x50 [ 1118.256578][T16881] SMB2_negotiate+0x16b5/0x4270 [ 1118.261502][T16881] ? smb3_encryption_required+0x2f0/0x2f0 [ 1118.267284][T16881] ? smb2_negotiate+0x5c/0x70 [ 1118.272001][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1118.277327][T16881] ? _raw_spin_unlock+0x28/0x40 [ 1118.282237][T16881] cifs_negotiate_protocol+0x445/0x670 [ 1118.287760][T16881] cifs_get_smb_ses+0x8d6/0x1b00 [ 1118.292761][T16881] cifs_mount_get_session+0xef/0x440 [ 1118.298080][T16881] dfs_mount_share+0x1e9/0x7b0 [ 1118.302868][T16881] cifs_mount+0xbc/0x650 [ 1118.307157][T16881] ? __rwlock_init+0x150/0x150 [ 1118.311955][T16881] ? cifs_is_path_remote+0x6f0/0x6f0 [ 1118.317262][T16881] ? do_raw_spin_unlock+0x121/0x230 [ 1118.322490][T16881] ? smb3_update_mnt_flags+0x52f/0xc10 [ 1118.327987][T16881] ? cifs_setup_cifs_sb+0x52f/0x840 [ 1118.333208][T16881] cifs_smb3_do_mount+0x2e5/0x710 [ 1118.338265][T16881] ? cifs_sb_deactive+0x80/0x80 [ 1118.343153][T16881] ? vfs_parse_fs_string+0x10f/0x170 [ 1118.348494][T16881] smb3_get_tree+0x5a5/0xa90 [ 1118.353185][T16881] vfs_get_tree+0x8c/0x280 [ 1118.357672][T16881] do_new_mount+0x24a/0xa40 [ 1118.362223][T16881] __se_sys_mount+0x2e7/0x3d0 [ 1118.366928][T16881] ? __x64_sys_mount+0xc0/0xc0 [ 1118.371720][T16881] ? lockdep_hardirqs_on+0x98/0x150 [ 1118.376972][T16881] ? __x64_sys_mount+0x20/0xc0 [ 1118.381762][T16881] do_syscall_64+0x55/0xb0 [ 1118.386202][T16881] ? clear_bhb_loop+0x40/0x90 [ 1118.390907][T16881] ? clear_bhb_loop+0x40/0x90 [ 1118.395612][T16881] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1118.401548][T16881] RIP: 0033:0x7f50f859e159 [ 1118.405988][T16881] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1118.425620][T16881] RSP: 002b:00007f50f9485028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1118.434057][T16881] RAX: ffffffffffffffda RBX: 00007f50f8825fa0 RCX: 00007f50f859e159 [ 1118.442045][T16881] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500 [ 1118.450037][T16881] RBP: 00007f50f8635024 R08: 0000200000000300 R09: 0000000000000000 [ 1118.458038][T16881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1118.466025][T16881] R13: 00007f50f8826038 R14: 00007f50f8825fa0 R15: 00007fff40d64a88 [ 1118.474068][T16881] [ 1118.477299][T16881] Kernel Offset: disabled [ 1118.481737][T16881] Rebooting in 86400 seconds..