last executing test programs: 1m28.416474431s ago: executing program 2 (id=5207): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) close(0xffffffffffffffff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x4048080}], 0x1, 0x44) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x2c, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8000) socket$inet(0xa, 0x801, 0x84) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r6, &(0x7f0000000200), 0xfffffd9d) 1m26.916557502s ago: executing program 4 (id=5215): socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@remote, @random="a538ae464632", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x17, 0xf, 0x0, @multicast2}}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getrusage(0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500), 0x1d) 1m24.8330046s ago: executing program 4 (id=5217): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x4) 1m24.622141433s ago: executing program 4 (id=5220): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) socket$inet6(0xa, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000400)=0x14e1, 0x4) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000020000103000000000400000002"], 0x44}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40000) write$tcp_mem(r1, &(0x7f0000000140)={0x5, 0x2d, 0x2, 0x3a, 0x0, 0x2c}, 0x48) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'aio_aio12_8\x00', [0x100, 0x12, 0xd0, 0x2, 0x2, 0x100, 0x3, 0x7f, 0x5, 0xb, 0x2, 0x7, 0xffffffff, 0x401, 0x10001, 0x1, 0x9, 0xe, 0xfe5, 0x403, 0x0, 0x2, 0x7, 0x9, 0x48, 0x9, 0x7, 0x6a77, 0x5, 0x20003, 0x9]}) 1m23.268143454s ago: executing program 4 (id=5222): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0xe, 0x0, &(0x7f0000000580)="63eced8e46aa7ce5a833c9f7b942", 0x0, 0x7efd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000ffff28bd7000fbdbdf250052d0fa", @ANYRES32=0x0, @ANYBLOB="572000002120000014001280090001007663616e000000000400028014000300"/42], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce0", 0x55}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0x15}], 0x3}, 0xc854) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000180)=0x10000, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendfile(0xffffffffffffffff, r2, 0x0, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, 0x0, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r8, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x11}, 0xa) 1m22.083233036s ago: executing program 1 (id=5107): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r2, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000002c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) 1m21.756800002s ago: executing program 1 (id=5226): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000300), 0x12) 1m21.61555883s ago: executing program 4 (id=5228): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="5c00000030000504000000000000000000000000480001804400018009000100676174650000000034000280180002000000000000000000000000000000000000000000100005800c000180080003000100000008000a"], 0x5c}}, 0x0) 1m21.570689406s ago: executing program 1 (id=5229): socket(0x1, 0x1, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) syz_ublk_setup_queues(r1, 0x0, 0x0, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x51f2, 0x20, 0x1000000, 0x33b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x10b0, 0x2, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6f, 0x8, 0x3, 0x2e5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x200, 0x3, 0xffffffff}}], 0x1, 0x0, 0x0) 1m21.540951834s ago: executing program 2 (id=5230): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x4) 1m21.333814386s ago: executing program 2 (id=5231): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0) sendmsg$NLBL_MGMT_C_LISTALL(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)={0x14, r1, 0x5170c560dce29b81, 0x44, 0x25dfdbfe}, 0x14}, 0x1, 0xffa6, 0x0, 0x8000}, 0x40408c4) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r3, 0x0, 0x53, 0x3c, &(0x7f0000000680)="8b525853875568840fd22f2d2b980ead28ad968743f5353f96e90ac892720bd302db2136a540ae8ffab8c73ccd91650f6e9219e970f4c8f1a81e964d1e4e9a55e8d6b3278af299384b615655f68a32927d29cb", &(0x7f0000000700)=""/60, 0x3, 0x0, 0x72, 0xba, &(0x7f0000000740)="8de8239b5c62961a9e9e6fd0ec3d6f4c103443773312b0b86f212e162c716bdfd593369d5a1f1db45f5f89802ec7d2d57e2668447dd05f21686c596a95c49aaf29aeaae0b68c81faf48e2d46f9e8afa0117573e53ff393ebe2819dd3d9784e0c241ad43411dc379602d81e1af2b3e84a3608", &(0x7f00000007c0)="f8ab5e70dc75481147b6b414a00ab0c05326ee3c5d6eec53f92cc5aa1e3b48b60424825755f1ee88d523c94577190632f8055b288dbbc118ec8981daacec9bf33d9919cfe391debbda295cf1b54c42d836712eabf02a9b31d7a76920b4ae7249f0aa6527d8fc331fe587eebab21c5ea7782c24bf6c5cc5e0eac45b8e39a4b60554145c4af626e76c472b433ab2bd8360ca299f5578e4c50477e2ffaabe8290f9c426ccbcc72202e2f0ec86b59bfc7422dea3668dd2b7941440fb", 0x5, 0x0, 0x8}, 0x50) sendmsg$nl_route_sched(r2, &(0x7f0000000a80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)=@getchain={0x34, 0x66, 0x8, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xa, 0x7}, {0x9, 0xa}, {0xe, 0xd}}, [{0x8, 0xb, 0x8}, {0x8, 0xb, 0xe1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x40800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x2b, 0x1, 0x0) listen(r5, 0x6) setsockopt$sock_attach_bpf(r5, 0x1, 0xd, &(0x7f0000000080), 0x24) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r6, &(0x7f0000000280)={0x1f, 0xfffe}, 0xe) listen(0xffffffffffffffff, 0x3ff) getsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) close(r5) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000017c0), r8) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r8, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000001800)={0x5c, r9, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0x555d}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24040040}, 0x20000000) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000003fc0)={0x0, 0x7}, 0x8) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10000008ebb, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r2, 0x20, &(0x7f00000001c0)={&(0x7f0000000100)=""/92, 0x5c, 0x0, &(0x7f0000000180)=""/53, 0x35}}, 0x10) 1m21.279840167s ago: executing program 1 (id=5232): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) socket$inet6(0xa, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000400)=0x14e1, 0x4) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000020000103000000000400000002"], 0x44}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40000) write$tcp_mem(r1, &(0x7f0000000140)={0x5, 0x2d, 0x2, 0x3a, 0x0, 0x2c}, 0x48) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'aio_aio12_8\x00', [0x100, 0x12, 0xd0, 0x2, 0x2, 0x100, 0x3, 0x7f, 0x5, 0xb, 0x2, 0x7, 0xffffffff, 0x401, 0x10001, 0x1, 0x9, 0xe, 0xfe5, 0x403, 0x0, 0x2, 0x7, 0x9, 0x48, 0x9, 0x7, 0x6a77, 0x5, 0x20003, 0x9]}) 1m20.267408009s ago: executing program 4 (id=5234): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_ADD_TO_RESOLV_LIST={{0x9}, 0x10}}}, 0x7) 1m19.383446765s ago: executing program 1 (id=5235): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000002, 0x401, 0x4}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 1m19.382932659s ago: executing program 2 (id=5236): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r2, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000002c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}, {0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="00000000000000001701000004000000040000000000000000000000000000001701000003000000000000000000000000000000000000001701000002000000000000008db6ba8669d9e3af336c9db7d7b600000000000067ab9dfade50263fca68064513414d4a7812c38b4c70753e9ef9f941ff7c1ebcfd79c64a594b41dd41b329d3cc14c29fa008f5c24363ad52e2bafeba6e55ac24ad2a44cbeacd365353b6541f21789daab56174ca2941b64022d67061ec8e2b1fa1eed6e9d4"], 0x0, 0x40088c0}], 0x2, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) 1m19.375953136s ago: executing program 3 (id=5237): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001f80)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) openat$binfmt_format(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000100), 0x400000000002, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1m18.674437897s ago: executing program 2 (id=5239): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0xe, 0x0, &(0x7f0000000580)="63eced8e46aa7ce5a833c9f7b942", 0x0, 0x7efd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000ffff28bd7000fbdbdf250052d0fa", @ANYRES32=0x0, @ANYBLOB="572000002120000014001280090001007663616e000000000400028014000300"/42], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) close(0xffffffffffffffff) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce0", 0x55}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0x15}], 0x3}, 0xc854) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f0000000180)=0x10000, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendfile(0xffffffffffffffff, r2, 0x0, 0x2) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, 0x0, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r7, &(0x7f0000000180)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r8, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x11}, 0xa) 1m18.528915161s ago: executing program 1 (id=5240): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) close(0xffffffffffffffff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x4048080}], 0x1, 0x44) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x2c, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8000) socket$inet(0xa, 0x801, 0x84) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r6, &(0x7f0000000200), 0xfffffd9d) 1m18.1968161s ago: executing program 3 (id=5241): unshare(0x2a060400) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4c, 0x0, &(0x7f0000000440)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x1000000, &(0x7f00000004c0)="8452"}) 1m13.737857167s ago: executing program 3 (id=5242): socket(0x1, 0x1, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x1, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) syz_ublk_setup_queues(r1, 0x0, 0x0, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x51f2, 0x20, 0x1000000, 0x33b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x10b0, 0x2, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x6a6f, 0x8, 0x3, 0x2e5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x200, 0x3, 0xffffffff}}], 0x1, 0x0, 0x0) 1m13.730004589s ago: executing program 2 (id=5243): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x1e, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') socket$igmp(0x2, 0x3, 0x2) socket$inet(0x2, 0x4000000000000001, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$kcm(0x10, 0x2, 0x10) socket$packet(0x11, 0x2, 0x300) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e008000000008", @ANYRES64=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) 1m8.823094374s ago: executing program 3 (id=5246): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) socket$inet6(0xa, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000400)=0x14e1, 0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000020000103000000000400000002"], 0x44}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40000) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'aio_aio12_8\x00', [0x100, 0x12, 0xd0, 0x2, 0x2, 0x100, 0x3, 0x7f, 0x5, 0xb, 0x2, 0x7, 0xffffffff, 0x401, 0x10001, 0x1, 0x9, 0xe, 0xfe5, 0x403, 0x0, 0x2, 0x7, 0x9, 0x48, 0x9, 0x7, 0x6a77, 0x5, 0x20003, 0x9]}) 1m1.776627521s ago: executing program 32 (id=5234): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_ADD_TO_RESOLV_LIST={{0x9}, 0x10}}}, 0x7) 56.733316587s ago: executing program 33 (id=5240): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) close(0xffffffffffffffff) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x4048080}], 0x1, 0x44) setsockopt(r2, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)={0x2c, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8000) socket$inet(0xa, 0x801, 0x84) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r6, &(0x7f0000000200), 0xfffffd9d) 56.494098833s ago: executing program 3 (id=5250): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000002, 0x401, 0x4}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 55.012509651s ago: executing program 34 (id=5243): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x1e, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') socket$igmp(0x2, 0x3, 0x2) socket$inet(0x2, 0x4000000000000001, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$kcm(0x10, 0x2, 0x10) socket$packet(0x11, 0x2, 0x300) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e008000000008", @ANYRES64=r2], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) 46.819527989s ago: executing program 3 (id=5253): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000"], 0xcd0}}, 0x0) 43.511878528s ago: executing program 0 (id=5254): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) file_setattr(r3, 0x0, &(0x7f0000000080)={0x88, 0xd9, 0x3, 0xb, 0x57519bea}, 0x18, 0x1000) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x4, 0x2ffffffff}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_submit(0x0, 0x1, &(0x7f0000000080)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x5, 0x40, r6, 0x0, 0x0, 0x1, 0x0, 0x1}]) socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r5, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) 37.230891001s ago: executing program 0 (id=5255): syz_usb_connect(0x3, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b"], 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) 28.821426476s ago: executing program 35 (id=5253): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3000000000080002400000000350000000120a01010000000000000000020000000900010073797a3000000000070002006f303000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f303900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313000080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313100080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313200080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313300080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313400080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313500080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313600080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313700080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313800080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f313900080003400000000720000480060001000002000005000200110000000c000300080001000000001e50000000120a01010000000000000000020000000900010073797a3000000000070002006f323000080003400000000720000480060001000002000005000200110000"], 0xcd0}}, 0x0) 26.391001397s ago: executing program 0 (id=5257): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000180)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) 21.170582416s ago: executing program 0 (id=5258): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0442, 0x11) socket$inet6(0xa, 0x802, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000400)=0x14e1, 0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000020000103000000000400000002"], 0x44}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40000) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'aio_aio12_8\x00', [0x100, 0x12, 0xd0, 0x2, 0x2, 0x100, 0x3, 0x7f, 0x5, 0xb, 0x2, 0x7, 0xffffffff, 0x401, 0x10001, 0x1, 0x9, 0xe, 0xfe5, 0x403, 0x0, 0x2, 0x7, 0x9, 0x48, 0x9, 0x7, 0x6a77, 0x5, 0x20003, 0x9]}) 16.270227347s ago: executing program 6 (id=5249): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r2, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000002c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}, {0x0, 0x0, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="00000000000000001701000004000000040000000000000000000000000000001701000003000000000000000000000000000000000000001701000002000000000000008db6ba8669d9e3af336c9db7d7b600000000000067ab9dfade50263fca68064513414d4a7812c38b4c70753e9ef9f941ff7c1ebcfd79c64a594b41dd41b329d3cc14c29fa008f5c24363ad52e2bafeba6e55ac24ad2a44cbeacd365353b6541f21789daab56174ca2941b64022d67061ec8e2b1fa1eed6e9d4"], 0x0, 0x40088c0}], 0x2, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r0, 0x0) 13.249787811s ago: executing program 0 (id=5259): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0) sendmsg$NLBL_MGMT_C_LISTALL(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000980)={0x14, r1, 0x5170c560dce29b81, 0x44, 0x25dfdbfe}, 0x14}, 0x1, 0xffa6, 0x0, 0x8000}, 0x40408c4) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r3, 0x0, 0x53, 0x3c, &(0x7f0000000680)="8b525853875568840fd22f2d2b980ead28ad968743f5353f96e90ac892720bd302db2136a540ae8ffab8c73ccd91650f6e9219e970f4c8f1a81e964d1e4e9a55e8d6b3278af299384b615655f68a32927d29cb", &(0x7f0000000700)=""/60, 0x3, 0x0, 0x72, 0xbd, &(0x7f0000000740)="8de8239b5c62961a9e9e6fd0ec3d6f4c103443773312b0b86f212e162c716bdfd593369d5a1f1db45f5f89802ec7d2d57e2668447dd05f21686c596a95c49aaf29aeaae0b68c81faf48e2d46f9e8afa0117573e53ff393ebe2819dd3d9784e0c241ad43411dc379602d81e1af2b3e84a3608", &(0x7f00000007c0)="f8ab5e70dc75481147b6b414a00ab0c05326ee3c5d6eec53f92cc5aa1e3b48b60424825755f1ee88d523c94577190632f8055b288dbbc118ec8981daacec9bf33d9919cfe391debbda295cf1b54c42d836712eabf02a9b31d7a76920b4ae7249f0aa6527d8fc331fe587eebab21c5ea7782c24bf6c5cc5e0eac45b8e39a4b60554145c4af626e76c472b433ab2bd8360ca299f5578e4c50477e2ffaabe8290f9c426ccbcc72202e2f0ec86b59bfc7422dea3668dd2b7941440fbcc217d", 0x5, 0x0, 0x8}, 0x50) sendmsg$nl_route_sched(r2, &(0x7f0000000a80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000009c0)={&(0x7f0000000940)=@getchain={0x34, 0x66, 0x8, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xa, 0x7}, {0x9, 0xa}, {0xe, 0xd}}, [{0x8, 0xb, 0x8}, {0x8, 0xb, 0xe1}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x40800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x2b, 0x1, 0x0) listen(r5, 0x6) setsockopt$sock_attach_bpf(r5, 0x1, 0xd, &(0x7f0000000080), 0x24) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r6, &(0x7f0000000280)={0x1f, 0xfffe}, 0xe) listen(0xffffffffffffffff, 0x3ff) getsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x4) close(r5) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000017c0), r8) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r8, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001880)={&(0x7f0000001800)={0x5c, r9, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0x555d}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24040040}, 0x20000000) setsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000003fc0)={0x0, 0x7}, 0x8) splice(0xffffffffffffffff, 0x0, r4, 0x0, 0x10000008ebb, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r2, 0x20, &(0x7f00000001c0)={&(0x7f0000000100)=""/92, 0x5c, 0x0, &(0x7f0000000180)=""/53, 0x35}}, 0x10) 0s ago: executing program 0 (id=5260): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000002, 0x401, 0x4}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) kernel console output (not intermixed with test programs): lid maxpacket 1024, setting to 64 [ 544.657285][T15745] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 544.657317][T15745] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 544.657338][T15745] usb 1-1: Product: syz [ 544.657353][T15745] usb 1-1: Manufacturer: syz [ 544.657367][T15745] usb 1-1: SerialNumber: syz [ 544.727374][T15745] usb 1-1: config 0 descriptor?? [ 544.730216][T16319] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 544.746706][T15745] hub 1-1:0.0: bad descriptor, ignoring hub [ 544.746749][T15745] hub 1-1:0.0: probe with driver hub failed with error -5 [ 545.072748][T15745] usb 1-1: USB disconnect, device number 38 [ 545.187195][T16422] __nla_validate_parse: 12 callbacks suppressed [ 545.187218][T16422] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3763'. [ 545.626049][T16437] ip6gretap0: left allmulticast mode [ 545.637918][T16437] netlink: 136 bytes leftover after parsing attributes in process `syz.4.3767'. [ 545.637944][T16437] net_ratelimit: 12 callbacks suppressed [ 545.637956][T16437] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 545.687303][T16440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3768'. [ 545.687330][T16440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3768'. [ 545.730748][T16443] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.3769'. [ 545.917339][T16440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3768'. [ 545.917365][T16440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3768'. [ 546.062343][ T1753] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.062400][ T1753] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.062439][ T1753] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.062478][ T1753] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.429469][T16458] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3776'. [ 546.659780][T16316] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 546.701322][T16316] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 546.719812][T16316] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 546.745610][T16316] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 546.746555][T16316] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 546.962406][T16470] syzkaller0: entered promiscuous mode [ 546.962440][T16470] syzkaller0: entered allmulticast mode [ 547.042308][T15749] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 547.212308][T15749] usb 4-1: Using ep0 maxpacket: 32 [ 547.214897][T15749] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 547.219107][T15749] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 547.219139][T15749] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 547.219161][T15749] usb 4-1: Product: syz [ 547.219176][T15749] usb 4-1: Manufacturer: syz [ 547.219192][T15749] usb 4-1: SerialNumber: syz [ 547.245533][T15749] usb 4-1: config 0 descriptor?? [ 547.284164][T16471] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 547.288071][T15749] hub 4-1:0.0: bad descriptor, ignoring hub [ 547.288113][T15749] hub 4-1:0.0: probe with driver hub failed with error -5 [ 547.906630][T16471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 547.911288][T16471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.239764][T16504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.240553][T16504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.292099][T16514] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3788'. [ 548.444911][T16504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 548.445599][T16504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 548.471352][T16519] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3789'. [ 548.786247][ T3425] raw-gadget.0 gadget.3: failed to queue suspend event [ 548.902867][T16502] raw-gadget.0 gadget.3: failed to queue resume event [ 548.934156][ T3425] raw-gadget.0 gadget.3: failed to queue suspend event [ 548.993295][T16316] Bluetooth: hci1: command tx timeout [ 549.004878][T16471] raw-gadget.0 gadget.3: failed to queue resume event [ 549.023242][ T3425] raw-gadget.0 gadget.3: failed to queue suspend event [ 549.097703][T16502] raw-gadget.0 gadget.3: failed to queue resume event [ 549.138963][ T13] raw-gadget.0 gadget.3: failed to queue suspend event [ 549.202377][T16502] raw-gadget.0 gadget.3: failed to queue resume event [ 549.233447][ T1618] raw-gadget.0 gadget.3: failed to queue suspend event [ 549.305798][T16471] raw-gadget.0 gadget.3: failed to queue resume event [ 549.323684][ T13] raw-gadget.0 gadget.3: failed to queue suspend event [ 549.343563][T16504] raw-gadget.0 gadget.3: failed to queue disconnect event [ 549.346246][T15749] usb 4-1: USB disconnect, device number 27 [ 549.370011][T16539] netlink: 'syz.2.3790': attribute type 1 has an invalid length. [ 549.702590][T16316] Bluetooth: hci0: command 0x0406 tx timeout [ 549.887974][T15749] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 550.008117][T16547] wg2 speed is unknown, defaulting to 1000 [ 550.008292][T16547] wg2 speed is unknown, defaulting to 1000 [ 550.046812][T15749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 550.051847][T15749] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 550.051877][T15749] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 550.051896][T15749] usb 4-1: Product: syz [ 550.051909][T15749] usb 4-1: Manufacturer: syz [ 550.051924][T15749] usb 4-1: SerialNumber: syz [ 550.091251][T15749] usb 4-1: config 0 descriptor?? [ 550.096575][T16471] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 550.125154][T15749] hub 4-1:0.0: bad descriptor, ignoring hub [ 550.125195][T15749] hub 4-1:0.0: probe with driver hub failed with error -5 [ 550.472770][T15503] usb 4-1: USB disconnect, device number 28 [ 550.615184][T16547] wg2 speed is unknown, defaulting to 1000 [ 550.640320][T16547] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 550.640364][T16547] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 550.640408][T16547] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 550.697358][T16572] __nla_validate_parse: 3 callbacks suppressed [ 550.697382][T16572] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3797'. [ 550.840396][T16547] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 551.048458][T16547] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 551.064627][ T5616] Bluetooth: hci1: command tx timeout [ 551.810582][T16601] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3805'. [ 551.810621][T16601] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3805'. [ 551.905717][T16604] netlink: 'syz.2.3805': attribute type 1 has an invalid length. [ 551.905741][T16604] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3805'. [ 552.643857][T16626] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3808'. [ 552.927375][T16547] wg2 speed is unknown, defaulting to 1000 [ 553.042324][T15749] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 553.132513][T16547] wg2 speed is unknown, defaulting to 1000 [ 553.152413][ T5616] Bluetooth: hci1: command tx timeout [ 553.192288][T15749] usb 4-1: Using ep0 maxpacket: 32 [ 553.195950][T15749] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 553.198260][T15749] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 553.198291][T15749] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 553.198312][T15749] usb 4-1: Product: syz [ 553.198328][T15749] usb 4-1: Manufacturer: syz [ 553.198343][T15749] usb 4-1: SerialNumber: syz [ 553.208728][T15749] usb 4-1: config 0 descriptor?? [ 553.243853][T16630] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 553.248721][T15749] hub 4-1:0.0: bad descriptor, ignoring hub [ 553.248757][T15749] hub 4-1:0.0: probe with driver hub failed with error -5 [ 553.323971][T16547] wg2 speed is unknown, defaulting to 1000 [ 553.530921][T16547] wg2 speed is unknown, defaulting to 1000 [ 553.565541][T16547] wg2 speed is unknown, defaulting to 1000 [ 553.859385][T16630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.861618][T16630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.211373][T16646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.225158][T16646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.431840][T16646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 554.434184][T16646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.774090][ T1057] raw-gadget.0 gadget.3: failed to queue suspend event [ 554.844503][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 554.852432][T16645] raw-gadget.0 gadget.3: failed to queue resume event [ 554.873924][ T1057] raw-gadget.0 gadget.3: failed to queue suspend event [ 554.935064][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 554.944131][T16630] raw-gadget.0 gadget.3: failed to queue resume event [ 554.978039][ T9056] raw-gadget.0 gadget.3: failed to queue suspend event [ 554.991040][ T12] bond0 (unregistering): Released all slaves [ 555.014017][ T12] bond1 (unregistering): Released all slaves [ 555.042529][T16645] raw-gadget.0 gadget.3: failed to queue resume event [ 555.050685][ T12] bond2 (unregistering): Released all slaves [ 555.068069][ T1057] raw-gadget.0 gadget.3: failed to queue suspend event [ 555.116263][ T12] bond3 (unregistering): Released all slaves [ 555.132391][T16630] raw-gadget.0 gadget.3: failed to queue resume event [ 555.152919][ T12] bond4 (unregistering): Released all slaves [ 555.176665][ T1057] raw-gadget.0 gadget.3: failed to queue suspend event [ 555.212807][T16547] wg2 speed is unknown, defaulting to 1000 [ 555.232369][ T5616] Bluetooth: hci1: command tx timeout [ 555.242445][T16630] raw-gadget.0 gadget.3: failed to queue resume event [ 555.286631][ T9056] raw-gadget.0 gadget.3: failed to queue suspend event [ 555.311893][T16460] bridge0: port 1(bridge_slave_0) entered blocking state [ 555.312045][T16460] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.331814][T16460] bridge_slave_0: entered allmulticast mode [ 555.347215][T16646] raw-gadget.0 gadget.3: failed to queue disconnect event [ 555.351032][T16460] bridge_slave_0: entered promiscuous mode [ 555.370215][T16460] bridge0: port 2(bridge_slave_1) entered blocking state [ 555.370438][T16460] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.370655][T16460] bridge_slave_1: entered allmulticast mode [ 555.394651][T16460] bridge_slave_1: entered promiscuous mode [ 555.466090][T16460] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 555.485531][T16460] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 555.529191][ T12] : left promiscuous mode [ 555.883798][T15503] usb 4-1: USB disconnect, device number 29 [ 555.983872][T16678] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.3818'. [ 556.124660][T15503] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 556.311817][T16460] team0: Port device team_slave_0 added [ 556.312210][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 556.314804][T16460] team0: Port device team_slave_1 added [ 556.538707][T15503] usb 4-1: device descriptor read/all, error -71 [ 556.764761][T16460] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 556.764780][T16460] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.764810][T16460] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 556.770006][ T12] tipc: Left network mode [ 556.776304][T16460] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 556.776319][T16460] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 556.776344][T16460] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 557.072902][T16460] hsr_slave_0: entered promiscuous mode [ 557.078349][T16460] hsr_slave_1: entered promiscuous mode [ 557.122436][T16460] debugfs: 'hsr0' already exists in 'hsr' [ 557.122468][T16460] Cannot create hsr debugfs directory [ 558.089479][T16684] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 558.217579][T16716] syzkaller0: entered promiscuous mode [ 558.217609][T16716] syzkaller0: entered allmulticast mode [ 558.355597][T16727] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 558.492370][T15749] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 558.643591][T15749] usb 2-1: Using ep0 maxpacket: 32 [ 558.647130][T15749] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 558.671970][T15749] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 558.672003][T15749] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 558.672025][T15749] usb 2-1: Product: syz [ 558.672041][T15749] usb 2-1: Manufacturer: syz [ 558.672056][T15749] usb 2-1: SerialNumber: syz [ 558.715920][T15749] usb 2-1: config 0 descriptor?? [ 558.716860][T16732] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 558.727097][T15749] hub 2-1:0.0: bad descriptor, ignoring hub [ 558.727137][T15749] hub 2-1:0.0: probe with driver hub failed with error -5 [ 558.907509][T16744] netlink: 2000 bytes leftover after parsing attributes in process `syz.2.3836'. [ 558.927990][ T5261] 8021q: adding VLAN 0 to HW filter on device eth1 [ 558.996281][T16747] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3838'. [ 559.058379][T16743] xfrm1: entered allmulticast mode [ 559.164187][T16747] ipip2: entered allmulticast mode [ 559.165611][T16747] syztnl0: entered allmulticast mode [ 559.330505][T16732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.332894][T16732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.667269][T16758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.667920][T16758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 559.876822][T16758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 559.886810][T16758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.185400][ T1057] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.252455][T16732] raw-gadget.0 gadget.1: failed to queue resume event [ 560.277023][ T3312] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.342687][T16757] raw-gadget.0 gadget.1: failed to queue resume event [ 560.366018][ T3312] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.380792][ T12] hsr_slave_0: left promiscuous mode [ 560.414691][ T12] hsr_slave_1: left promiscuous mode [ 560.416067][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 560.443471][T16732] raw-gadget.0 gadget.1: failed to queue resume event [ 560.463486][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 560.467298][ T1057] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.534327][T16757] raw-gadget.0 gadget.1: failed to queue resume event [ 560.557282][ T13] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.632460][T16732] raw-gadget.0 gadget.1: failed to queue resume event [ 560.655174][ T1057] raw-gadget.0 gadget.1: failed to queue suspend event [ 560.807324][T16758] raw-gadget.0 gadget.1: failed to queue disconnect event [ 561.153680][T15745] usb 2-1: USB disconnect, device number 36 [ 561.312619][T15745] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 561.355855][T16801] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3850'. [ 561.465216][T15745] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 561.468087][T15745] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 561.468119][T15745] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 561.468141][T15745] usb 2-1: Product: syz [ 561.468157][T15745] usb 2-1: Manufacturer: syz [ 561.468172][T15745] usb 2-1: SerialNumber: syz [ 561.522805][T15745] usb 2-1: config 0 descriptor?? [ 561.525286][T16758] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 561.531585][T15745] hub 2-1:0.0: bad descriptor, ignoring hub [ 561.531627][T15745] hub 2-1:0.0: probe with driver hub failed with error -5 [ 561.623362][ T12] team0 (unregistering): Port device team_slave_1 removed [ 561.684371][ T12] team0 (unregistering): Port device team_slave_0 removed [ 561.882822][T15503] usb 2-1: USB disconnect, device number 37 [ 562.025276][T16776] syzkaller0: entered promiscuous mode [ 562.025298][T16776] syzkaller0: entered allmulticast mode [ 562.463882][ T5261] 8021q: adding VLAN 0 to HW filter on device eth2 [ 562.464494][T16801] tunl0: entered allmulticast mode [ 562.481698][T16801] gre0: entered allmulticast mode [ 562.543223][T16801] gretap0: entered allmulticast mode [ 562.598707][T16801] erspan0: entered allmulticast mode [ 562.615162][T16801] ip_vti0: entered allmulticast mode [ 562.631889][T16801] ip6_vti0: entered allmulticast mode [ 562.641930][T16801] sit0: entered allmulticast mode [ 562.655169][T16801] ip6tnl0: entered allmulticast mode [ 562.664030][T16801] ip6gre0: entered allmulticast mode [ 562.724815][T16801] ip6gretap0: entered allmulticast mode [ 562.758096][T16801] vcan0: entered allmulticast mode [ 562.832470][T16801] bond0: entered allmulticast mode [ 562.852438][T16801] tipc: Resetting bearer [ 562.852595][T16801] team0: entered allmulticast mode [ 562.852611][T16801] xfrm0: entered allmulticast mode [ 562.871772][T16801] dummy0: entered allmulticast mode [ 562.933807][T16801] nlmon0: entered allmulticast mode [ 562.946781][T16801] batadv0: entered allmulticast mode [ 562.956164][T16801] vxcan0: entered allmulticast mode [ 562.959105][T16801] vxcan1: entered allmulticast mode [ 562.961960][T16801] veth0: entered allmulticast mode [ 562.983214][T16801] veth1: entered allmulticast mode [ 563.022949][T16801] wg0: entered allmulticast mode [ 563.062910][T16801] wg1: entered allmulticast mode [ 563.128968][T16801] wg2: entered allmulticast mode [ 563.144419][T16801] veth0_to_bridge: entered allmulticast mode [ 563.153664][T16801] bridge_slave_0: entered allmulticast mode [ 563.165986][T16801] veth1_to_bridge: entered allmulticast mode [ 563.171922][T16801] bridge_slave_1: entered allmulticast mode [ 563.180405][T16801] veth0_to_bond: entered allmulticast mode [ 563.222625][T16801] veth1_to_bond: entered allmulticast mode [ 563.228337][T16801] bond_slave_1: entered allmulticast mode [ 563.263612][T16801] veth0_to_team: entered allmulticast mode [ 563.269765][T16801] team_slave_0: entered allmulticast mode [ 563.302617][T16801] veth1_to_team: entered allmulticast mode [ 563.306803][T16801] team_slave_1: entered allmulticast mode [ 563.308583][T16801] veth0_to_batadv: entered allmulticast mode [ 563.331996][T16801] batadv_slave_0: entered allmulticast mode [ 563.349031][T16801] veth1_to_batadv: entered allmulticast mode [ 563.361078][T16801] batadv_slave_1: entered allmulticast mode [ 563.384094][T16801] veth0_to_hsr: entered allmulticast mode [ 563.387004][T16801] hsr_slave_0: entered allmulticast mode [ 563.388734][T16801] veth1_to_hsr: entered allmulticast mode [ 563.390925][T16801] hsr_slave_1: entered allmulticast mode [ 563.423334][T16801] hsr0: entered allmulticast mode [ 563.442859][T16801] veth1_virt_wifi: entered allmulticast mode [ 563.472283][T16801] veth0_virt_wifi: entered allmulticast mode [ 563.474654][T16801] virt_wifi0: entered allmulticast mode [ 563.474923][T16801] veth1_vlan: entered allmulticast mode [ 563.477142][T16801] veth0_vlan: entered allmulticast mode [ 563.479506][T16801] vlan0: entered allmulticast mode [ 563.481606][T16801] vlan1: entered allmulticast mode [ 563.533536][T16801] macvlan0: entered allmulticast mode [ 563.552548][T16801] macvlan1: entered allmulticast mode [ 563.562676][T16801] ipvlan0: entered allmulticast mode [ 563.562910][T16801] ipvlan1: entered allmulticast mode [ 563.563211][T16801] veth1_macvtap: entered allmulticast mode [ 563.590250][T16801] veth0_macvtap: entered allmulticast mode [ 563.672438][T16801] macvtap0: entered allmulticast mode [ 563.690491][T16801] macsec0: entered allmulticast mode [ 563.697791][T16801] geneve0: entered allmulticast mode [ 563.705629][T16801] geneve1: left promiscuous mode [ 563.705653][T16801] geneve1: entered allmulticast mode [ 563.772729][T16801] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 563.853124][T16801] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 563.952643][T16801] netdevsim netdevsim0 netdevsim2: entered allmulticast mode [ 564.012559][T16801] netdevsim netdevsim0 netdevsim3: entered allmulticast mode [ 564.015976][T16801] mac80211_hwsim hwsim5 wlan0: left promiscuous mode [ 564.117554][T16801] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 564.122785][T16801] vxlan0: entered allmulticast mode [ 564.129749][T16801] : entered allmulticast mode [ 564.129945][T16801] veth2: entered allmulticast mode [ 564.130130][T16801] veth3: entered allmulticast mode [ 564.130319][T16801] mac80211_hwsim hwsim5 netpci0: entered allmulticast mode [ 564.160830][T16801] geneve2: entered allmulticast mode [ 564.182579][T16801] syztnl0: entered allmulticast mode [ 564.182716][T16801] : entered allmulticast mode [ 564.277812][T16816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3854'. [ 564.277837][T16816] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3854'. [ 564.375753][T16816] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3854'. [ 564.375780][T16816] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3854'. [ 564.375920][T15471] wg2 speed is unknown, defaulting to 1000 [ 564.376028][T16807] tipc: New replicast peer: 127.0.0.2 [ 564.376047][T15471] syz2: Port: 1 Link DOWN [ 564.376433][T16807] tipc: Enabled bearer , priority 10 [ 564.452387][ T13] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 564.452423][ T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.452520][ T13] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 564.452542][ T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.452646][ T13] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 564.452668][ T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 564.452769][ T13] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 564.452793][ T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.072385][T16840] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3863'. [ 565.113267][T16832] 8021q: VLANs not supported on nlmon0 [ 565.335739][T16849] tipc: New replicast peer: 127.0.0.2 [ 565.336195][T16849] tipc: Enabled bearer , priority 10 [ 565.336724][T16849] tipc: Disabling bearer [ 566.598529][T16886] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3874'. [ 566.755914][T16881] 8021q: VLANs not supported on nlmon0 [ 566.798190][T16874] tipc: Enabling of bearer rejected, already enabled [ 566.816389][T16884] tipc: Disabling bearer [ 567.024314][T16871] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 567.107272][T16871] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 567.179381][T16903] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3877'. [ 567.219137][T16903] IPVS: set_ctl: invalid protocol: 33 172.20.20.46:20004 [ 567.758112][T16915] tipc: New replicast peer: 127.0.0.2 [ 567.758573][T16915] tipc: Enabled bearer , priority 10 [ 567.844534][T16915] tipc: Disabling bearer [ 568.179251][T16935] netlink: zone id is out of range [ 568.179266][T16935] netlink: zone id is out of range [ 568.179273][T16935] netlink: zone id is out of range [ 568.179281][T16935] netlink: zone id is out of range [ 568.179289][T16935] netlink: zone id is out of range [ 568.179296][T16935] netlink: zone id is out of range [ 568.179303][T16935] netlink: zone id is out of range [ 568.179310][T16935] netlink: zone id is out of range [ 568.179317][T16935] netlink: zone id is out of range [ 568.179324][T16935] netlink: set zone limit has 4 unknown bytes [ 568.800981][T16952] tipc: Enabling of bearer rejected, already enabled [ 568.813459][T16952] tipc: Disabling bearer [ 568.826034][T16460] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 569.072706][T16460] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 569.077391][T16952] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 569.102134][T16952] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 569.110371][T16460] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 569.170174][T16966] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3894'. [ 569.226031][T16460] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 569.228146][T16460] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 569.289468][T16460] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 569.291542][T16460] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 569.474377][T16460] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 569.678509][T16986] tipc: New replicast peer: 127.0.0.2 [ 569.680060][T16986] tipc: Enabled bearer , priority 10 [ 569.722537][T16986] tipc: Disabling bearer [ 570.090766][T17003] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3904'. [ 570.181127][T16460] 8021q: adding VLAN 0 to HW filter on device bond0 [ 570.219054][T17007] tipc: New replicast peer: 127.0.0.2 [ 570.219508][T17007] tipc: Enabled bearer , priority 10 [ 570.231580][T17007] tipc: Disabling bearer [ 570.255299][T17011] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3908'. [ 570.255328][T17011] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3908'. [ 570.338151][T16460] 8021q: adding VLAN 0 to HW filter on device team0 [ 570.403998][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 570.404237][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 570.421669][T17007] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 570.465922][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 570.466009][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 571.225092][T17050] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3918'. [ 571.225118][T17050] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3918'. [ 571.243934][T17048] syzkaller0: entered promiscuous mode [ 571.243960][T17048] syzkaller0: entered allmulticast mode [ 571.741292][T17059] tipc: Started in network mode [ 571.741317][T17059] tipc: Node identity 1, cluster identity 4711 [ 571.741331][T17059] tipc: Node number set to 1 [ 572.772838][T16460] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 572.784491][T15471] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 572.821442][T17109] syzkaller0: entered promiscuous mode [ 572.821472][T17109] syzkaller0: entered allmulticast mode [ 572.947240][T15471] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 572.947273][T15471] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.949102][T15471] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 572.949134][T15471] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 572.949156][T15471] usb 2-1: Manufacturer: syz [ 573.004117][T15471] usb 2-1: config 0 descriptor?? [ 573.047594][T15471] igorplugusb 2-1:0.0: incorrect number of endpoints [ 573.237919][T15471] usb 2-1: USB disconnect, device number 38 [ 573.680864][T17132] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3934'. [ 573.916069][T17139] net_ratelimit: 33 callbacks suppressed [ 573.916089][T17139] netlink: zone id is out of range [ 573.916097][T17139] netlink: zone id is out of range [ 573.916104][T17139] netlink: zone id is out of range [ 573.916111][T17139] netlink: zone id is out of range [ 573.916117][T17139] netlink: zone id is out of range [ 573.916124][T17139] netlink: zone id is out of range [ 573.916132][T17139] netlink: zone id is out of range [ 573.916138][T17139] netlink: zone id is out of range [ 573.916145][T17139] netlink: zone id is out of range [ 573.916153][T17139] netlink: set zone limit has 4 unknown bytes [ 574.020450][T16460] veth0_vlan: entered promiscuous mode [ 574.048445][T16460] veth1_vlan: entered promiscuous mode [ 574.109082][T16460] veth0_macvtap: entered promiscuous mode [ 574.130180][T16460] veth1_macvtap: entered promiscuous mode [ 574.137418][T17143] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3938'. [ 574.169883][T16460] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 574.296078][T16460] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 574.353022][ T9056] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.353535][ T9056] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.353631][ T9056] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.353671][ T9056] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 574.778311][T17163] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3945'. [ 575.044682][T17167] syzkaller0: entered promiscuous mode [ 575.044709][T17167] syzkaller0: entered allmulticast mode [ 575.241187][ T3425] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.241209][ T3425] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 575.364458][ T1618] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 575.364481][ T1618] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 576.216140][T17202] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3953'. [ 576.337348][T16316] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 576.418319][T16316] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 576.429026][T17204] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 576.429441][T17194] tipc: New replicast peer: 127.0.0.2 [ 576.438421][T16316] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 576.448518][T16316] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 576.454050][T16316] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 576.621638][T17194] tipc: Enabled bearer , priority 10 [ 576.650957][T17200] tipc: Disabling bearer [ 576.938459][T17221] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3957'. [ 577.208271][T17230] tipc: Enabled bearer , priority 0 [ 577.305496][T17232] tipc: Resetting bearer [ 577.404251][T17239] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.3963'. [ 577.500294][T17244] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3964'. [ 577.554947][T17227] tipc: Disabling bearer [ 578.449150][T17275] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3971'. [ 578.503324][T16316] Bluetooth: hci4: command tx timeout [ 578.635616][T17283] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3973'. [ 578.900279][T17205] wg2 speed is unknown, defaulting to 1000 [ 579.346278][ T4927] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 579.516634][ T4927] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 579.516666][ T4927] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.516713][ T4927] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 579.524519][ T4927] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 579.524560][ T4927] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 579.524581][ T4927] usb 5-1: Manufacturer: syz [ 579.602831][ T4927] usb 5-1: config 0 descriptor?? [ 579.628087][ T4927] igorplugusb 5-1:0.0: incorrect number of endpoints [ 579.847189][ T197] usb 5-1: USB disconnect, device number 40 [ 580.028706][T17328] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3985'. [ 580.348474][T17334] 8021q: VLANs not supported on nlmon0 [ 580.582303][T16316] Bluetooth: hci4: command tx timeout [ 580.627032][T17205] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.640018][T17205] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.640244][T17205] bridge_slave_0: entered allmulticast mode [ 580.651192][T17205] bridge_slave_0: entered promiscuous mode [ 580.734383][T17205] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.734609][T17205] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.734846][T17205] bridge_slave_1: entered allmulticast mode [ 580.748288][T17205] bridge_slave_1: entered promiscuous mode [ 580.823795][T17351] tipc: Enabled bearer , priority 0 [ 580.964832][T17349] syzkaller0: entered promiscuous mode [ 580.964864][T17349] syzkaller0: entered allmulticast mode [ 581.349267][T17362] tipc: Resetting bearer [ 581.416919][T17205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 581.623609][T17345] tipc: Resetting bearer [ 581.770563][T17383] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.3997'. [ 581.893195][T17345] tipc: Disabling bearer [ 582.037316][T17205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 582.119701][T17392] 8021q: VLANs not supported on nlmon0 [ 582.172356][T15745] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 582.239572][T17205] team0: Port device team_slave_0 added [ 582.257315][T17205] team0: Port device team_slave_1 added [ 582.327817][T15745] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 582.327851][T15745] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 582.327890][T15745] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 582.329536][T15745] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 582.329566][T15745] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 582.329586][T15745] usb 2-1: Manufacturer: syz [ 582.352384][T15745] usb 2-1: config 0 descriptor?? [ 582.384398][T15745] igorplugusb 2-1:0.0: incorrect number of endpoints [ 582.435306][T17406] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.4007'. [ 582.482855][T17205] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 582.482869][T17205] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 582.482885][T17205] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 582.491286][T17205] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 582.491304][T17205] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 582.491331][T17205] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 582.610435][T15745] usb 2-1: USB disconnect, device number 39 [ 582.662300][T16316] Bluetooth: hci4: command tx timeout [ 582.774016][T17205] hsr_slave_0: entered promiscuous mode [ 582.775657][T17205] hsr_slave_1: entered promiscuous mode [ 582.776643][T17205] debugfs: 'hsr0' already exists in 'hsr' [ 582.776666][T17205] Cannot create hsr debugfs directory [ 583.895874][T17436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4009'. [ 584.340921][T17445] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4013'. [ 584.604092][T17455] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4017'. [ 584.750561][T16316] Bluetooth: hci4: command tx timeout [ 584.867565][T17467] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 585.153010][T17478] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4024'. [ 585.886116][T17484] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4026'. [ 585.886579][T17505] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4029'. [ 586.219166][T17513] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4034'. [ 586.681014][T17521] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4038'. [ 586.681051][T17521] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4038'. [ 586.730489][T17523] netlink: 'syz.1.4038': attribute type 1 has an invalid length. [ 586.730515][T17523] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4038'. [ 587.301204][T17205] bond0: (slave netdevsim0): Releasing backup interface [ 588.010544][T17555] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.4040'. [ 588.719556][T17562] tipc: Enabled bearer , priority 0 [ 588.740053][T17560] tipc: Resetting bearer [ 589.349917][T17558] tipc: Disabling bearer [ 590.041745][T17584] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4048'. [ 590.282352][T17593] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.4051'. [ 590.382895][T17205] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 590.458604][T17205] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 590.460903][T17205] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 590.539722][T17205] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 590.585055][T17205] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 590.636842][T17205] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 590.765223][T17205] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 590.879432][T17205] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 590.929005][T17599] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4053'. [ 590.929043][T17599] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4053'. [ 590.931622][T17614] tipc: Enabled bearer , priority 0 [ 591.004898][T17626] syzkaller0: entered promiscuous mode [ 591.004928][T17626] syzkaller0: entered allmulticast mode [ 591.010230][T17600] netlink: 'syz.4.4053': attribute type 1 has an invalid length. [ 591.010255][T17600] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4053'. [ 591.189628][T17608] tipc: Resetting bearer [ 591.704767][T17604] tipc: Resetting bearer [ 591.893113][T17604] tipc: Disabling bearer [ 591.899955][T17646] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4060'. [ 592.254232][T17655] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4062'. [ 592.479622][T17205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 592.541655][T17205] 8021q: adding VLAN 0 to HW filter on device team0 [ 592.596995][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 592.597135][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 592.663050][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 592.663208][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.187752][T17676] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4071'. [ 593.586068][T17687] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4074'. [ 593.701137][T17690] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4075'. [ 594.009051][ T4927] hid-generic 0005:15C2:5505.0001: collection stack underflow [ 594.009094][ T4927] hid-generic 0005:15C2:5505.0001: item 0 2 0 12 parsing failed [ 594.010002][ T4927] hid-generic 0005:15C2:5505.0001: probe with driver hid-generic failed with error -22 [ 595.290985][T17205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.759002][T17205] veth0_vlan: entered promiscuous mode [ 595.817779][T17731] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4082'. [ 595.837587][T17205] veth1_vlan: entered promiscuous mode [ 596.011152][T17737] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.4085'. [ 596.088852][T17205] veth0_macvtap: entered promiscuous mode [ 596.106669][T17205] veth1_macvtap: entered promiscuous mode [ 596.130204][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4087'. [ 596.246916][T17205] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.294690][T17205] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.025262][ T1753] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.046299][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.553211][ T3312] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.553235][ T3312] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.595234][T17777] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4096'. [ 597.664723][ T1057] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.664776][ T1057] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.810874][T17779] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.4097'. [ 597.870301][T17781] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4098'. [ 597.993769][ T1057] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.993792][ T1057] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 598.399591][T17796] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4103'. [ 598.614313][T17809] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4110'. [ 598.680633][T17804] tipc: Started in network mode [ 598.680669][T17804] tipc: Node identity 0e4788cc10f9, cluster identity 4711 [ 598.680883][T17804] tipc: Enabled bearer , priority 0 [ 598.836744][T17800] tipc: Disabling bearer [ 599.456861][T17842] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4120'. [ 599.766761][T17849] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4123'. [ 600.051255][T17859] tipc: Enabled bearer , priority 0 [ 600.060334][T17859] syzkaller0: entered promiscuous mode [ 600.060361][T17859] syzkaller0: entered allmulticast mode [ 600.084441][T17859] tipc: Resetting bearer [ 600.126320][T17856] tipc: Resetting bearer [ 600.445002][T17856] tipc: Disabling bearer [ 601.339151][T17913] __nla_validate_parse: 1 callbacks suppressed [ 601.339182][T17913] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4147'. [ 601.713251][T17921] tipc: Enabled bearer , priority 0 [ 601.714990][T17926] syzkaller0: entered promiscuous mode [ 601.715017][T17926] syzkaller0: entered allmulticast mode [ 601.750630][T17921] tipc: Resetting bearer [ 601.809702][T17920] tipc: Resetting bearer [ 601.963147][T17920] tipc: Disabling bearer [ 602.309750][T17953] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4159'. [ 602.573513][T17962] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4164'. [ 602.882304][T15743] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 603.032305][T15743] usb 1-1: Using ep0 maxpacket: 32 [ 603.035191][T15743] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 603.038195][T15743] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 603.038215][T15743] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 603.038227][T15743] usb 1-1: Product: syz [ 603.038236][T15743] usb 1-1: Manufacturer: syz [ 603.038247][T15743] usb 1-1: SerialNumber: syz [ 603.093984][T15743] usb 1-1: config 0 descriptor?? [ 603.107058][T17963] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 603.117609][T15743] hub 1-1:0.0: bad descriptor, ignoring hub [ 603.117653][T15743] hub 1-1:0.0: probe with driver hub failed with error -5 [ 603.241251][T17980] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4170'. [ 603.241287][T17980] net_ratelimit: 12 callbacks suppressed [ 603.241299][T17980] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 603.352643][T17984] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4171'. [ 603.373802][T17983] tipc: Enabled bearer , priority 0 [ 603.374787][T17983] syzkaller0: entered promiscuous mode [ 603.374813][T17983] syzkaller0: entered allmulticast mode [ 603.404459][T17983] tipc: Resetting bearer [ 603.432560][T17981] tipc: Resetting bearer [ 603.469341][T17989] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4174'. [ 603.603077][T17981] tipc: Disabling bearer [ 603.761591][T17963] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.763557][T17963] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.784311][T18000] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4178'. [ 604.157992][T18004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.160692][T18004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.229987][T18022] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4184'. [ 604.256489][T18023] netlink: zone id is out of range [ 604.256508][T18023] netlink: zone id is out of range [ 604.256516][T18023] netlink: zone id is out of range [ 604.256525][T18023] netlink: zone id is out of range [ 604.256533][T18023] netlink: zone id is out of range [ 604.256541][T18023] netlink: zone id is out of range [ 604.256550][T18023] netlink: zone id is out of range [ 604.256558][T18023] netlink: zone id is out of range [ 604.256566][T18023] netlink: zone id is out of range [ 604.369799][T18004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 604.370481][T18004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 604.686950][T15749] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 604.763900][ T2949] raw-gadget.0 gadget.0: failed to queue suspend event [ 604.851141][T18003] raw-gadget.0 gadget.0: failed to queue resume event [ 604.852266][T15749] usb 4-1: Using ep0 maxpacket: 16 [ 604.860044][T15749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 604.860078][T15749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 604.860102][T15749] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 604.860147][T15749] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 604.860172][T15749] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.875628][ T13] raw-gadget.0 gadget.0: failed to queue suspend event [ 604.906926][T18037] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4191'. [ 604.938204][T15749] usb 4-1: config 0 descriptor?? [ 604.942653][T18003] raw-gadget.0 gadget.0: failed to queue resume event [ 604.965923][ T13] raw-gadget.0 gadget.0: failed to queue suspend event [ 605.052378][T17963] raw-gadget.0 gadget.0: failed to queue resume event [ 605.074304][ T13] raw-gadget.0 gadget.0: failed to queue suspend event [ 605.102909][T18039] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4190'. [ 605.107883][T18039] netlink: 'syz.2.4190': attribute type 1 has an invalid length. [ 605.142475][T17963] raw-gadget.0 gadget.0: failed to queue resume event [ 605.169105][ T2949] raw-gadget.0 gadget.0: failed to queue suspend event [ 605.252527][T18003] raw-gadget.0 gadget.0: failed to queue resume event [ 605.252744][T18004] raw-gadget.0 gadget.0: failed to queue suspend event [ 605.253157][T18004] raw-gadget.0 gadget.0: failed to queue disconnect event [ 605.677029][T15749] usbhid 4-1:0.0: can't add hid device: -71 [ 605.677166][T15749] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 605.698126][T15749] usb 4-1: USB disconnect, device number 32 [ 605.916799][T15471] usb 1-1: USB disconnect, device number 39 [ 606.062543][T15471] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 606.217684][T15471] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 606.235987][T15471] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 606.236022][T15471] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 606.236044][T15471] usb 1-1: Product: syz [ 606.236128][T15471] usb 1-1: Manufacturer: syz [ 606.236144][T15471] usb 1-1: SerialNumber: syz [ 606.286481][T15471] usb 1-1: config 0 descriptor?? [ 606.287518][T18004] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 606.298254][T15471] hub 1-1:0.0: bad descriptor, ignoring hub [ 606.298291][T15471] hub 1-1:0.0: probe with driver hub failed with error -5 [ 606.497637][T18077] __nla_validate_parse: 3 callbacks suppressed [ 606.497661][T18077] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4202'. [ 606.640048][T18081] netlink: 100 bytes leftover after parsing attributes in process `syz.0.4204'. [ 606.662766][T15471] usb 1-1: USB disconnect, device number 40 [ 607.001879][T18091] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4208'. [ 607.001913][T18091] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4208'. [ 607.049849][T18091] netlink: 'syz.0.4208': attribute type 1 has an invalid length. [ 607.049874][T18091] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4208'. [ 607.176697][T18095] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4209'. [ 607.472713][T18095] bond0: left allmulticast mode [ 607.474864][T18095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 607.842495][T15500] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 607.909597][T18112] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4215'. [ 607.992387][T15500] usb 3-1: Using ep0 maxpacket: 16 [ 607.994699][T15500] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 607.994732][T15500] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.994754][T15500] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 607.994790][T15500] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 607.994805][T15500] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.013676][T15500] usb 3-1: config 0 descriptor?? [ 608.053062][ T197] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 608.118146][T18116] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4217'. [ 608.212336][ T197] usb 1-1: Using ep0 maxpacket: 32 [ 608.216759][ T197] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 608.221304][ T197] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 608.221333][ T197] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 608.221354][ T197] usb 1-1: Product: syz [ 608.221369][ T197] usb 1-1: Manufacturer: syz [ 608.221383][ T197] usb 1-1: SerialNumber: syz [ 608.281692][ T197] usb 1-1: config 0 descriptor?? [ 608.285207][T18110] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 608.334790][ T197] hub 1-1:0.0: bad descriptor, ignoring hub [ 608.335578][ T197] hub 1-1:0.0: probe with driver hub failed with error -5 [ 608.884972][T15500] usbhid 3-1:0.0: can't add hid device: -71 [ 608.885105][T15500] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 608.896512][T15500] usb 3-1: USB disconnect, device number 34 [ 608.958695][T18110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 608.962766][T18110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.290864][T18137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.291949][T18137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.511143][T18137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.511828][T18137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.730246][T18150] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4226'. [ 609.846476][ T13] raw-gadget.1 gadget.0: failed to queue suspend event [ 609.871340][T18155] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4228'. [ 609.912417][T18136] raw-gadget.1 gadget.0: failed to queue resume event [ 609.933792][ T1753] raw-gadget.1 gadget.0: failed to queue suspend event [ 610.042377][T18110] raw-gadget.1 gadget.0: failed to queue resume event [ 610.064064][ T13] raw-gadget.1 gadget.0: failed to queue suspend event [ 610.134070][T18136] raw-gadget.1 gadget.0: failed to queue resume event [ 610.157695][ T1753] raw-gadget.1 gadget.0: failed to queue suspend event [ 610.282493][T18136] raw-gadget.1 gadget.0: failed to queue resume event [ 610.306572][ T13] raw-gadget.1 gadget.0: failed to queue suspend event [ 610.350830][T18137] raw-gadget.1 gadget.0: failed to queue disconnect event [ 610.735740][T15500] usb 1-1: USB disconnect, device number 41 [ 610.919661][T15500] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 611.103656][T15500] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 611.116128][T15500] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 611.116158][T15500] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 611.116178][T15500] usb 1-1: Product: syz [ 611.116191][T15500] usb 1-1: Manufacturer: syz [ 611.116205][T15500] usb 1-1: SerialNumber: syz [ 611.150344][T15500] usb 1-1: config 0 descriptor?? [ 611.151640][T18137] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 611.163817][T15500] hub 1-1:0.0: bad descriptor, ignoring hub [ 611.163857][T15500] hub 1-1:0.0: probe with driver hub failed with error -5 [ 611.542674][T15500] usb 1-1: USB disconnect, device number 42 [ 611.800126][T18196] __nla_validate_parse: 1 callbacks suppressed [ 611.800150][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4240'. [ 611.836082][T18200] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4239'. [ 612.618297][T18233] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4252'. [ 612.687521][T18235] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4253'. [ 613.684304][T18267] tipc: Enabled bearer , priority 0 [ 613.685748][T18267] syzkaller0: entered promiscuous mode [ 613.685773][T18267] syzkaller0: entered allmulticast mode [ 613.871693][T18271] tipc: Resetting bearer [ 613.922542][T18265] tipc: Resetting bearer [ 614.133647][T18247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 614.170894][T18265] tipc: Disabling bearer [ 614.195309][T18247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 614.611717][T18300] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4275'. [ 614.791093][T18307] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4277'. [ 616.150973][T18356] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4293'. [ 616.151355][T18356] bond0: left allmulticast mode [ 616.276386][T18356] 8021q: adding VLAN 0 to HW filter on device bond0 [ 616.810582][T18375] 8021q: VLANs not supported on nlmon0 [ 617.733966][T18417] net_ratelimit: 13 callbacks suppressed [ 617.733991][T18417] netlink: zone id is out of range [ 617.733999][T18417] netlink: zone id is out of range [ 617.734014][T18417] netlink: zone id is out of range [ 617.734022][T18417] netlink: zone id is out of range [ 617.734038][T18417] netlink: zone id is out of range [ 617.734046][T18417] netlink: zone id is out of range [ 617.734054][T18417] netlink: zone id is out of range [ 617.734062][T18417] netlink: zone id is out of range [ 617.734069][T18417] netlink: zone id is out of range [ 617.734078][T18417] netlink: set zone limit has 4 unknown bytes [ 617.918474][T18421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4315'. [ 618.148752][T18428] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4318'. [ 618.579440][T18444] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4326'. [ 618.953699][T18461] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4331'. [ 618.994525][T15500] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 619.142394][T15500] usb 2-1: Using ep0 maxpacket: 16 [ 619.144690][T15500] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 619.144725][T15500] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 619.144748][T15500] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 619.144793][T15500] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 619.144818][T15500] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.214335][T15500] usb 2-1: config 0 descriptor?? [ 619.996555][T15500] usbhid 2-1:0.0: can't add hid device: -71 [ 619.996695][T15500] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 620.043230][T15500] usb 2-1: USB disconnect, device number 40 [ 620.175863][T18495] tipc: Enabled bearer , priority 0 [ 620.260662][T18505] syzkaller0: entered promiscuous mode [ 620.260692][T18505] syzkaller0: entered allmulticast mode [ 620.327151][T18504] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 620.327171][T18504] IPv6: NLM_F_CREATE should be set when creating new route [ 620.337975][T18504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4338'. [ 620.533238][T18491] tipc: Resetting bearer [ 620.762575][T18485] tipc: Resetting bearer [ 620.899550][T18520] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4343'. [ 620.988380][T18527] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4345'. [ 621.123495][T18485] tipc: Disabling bearer [ 621.181661][T18527] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input36 [ 621.992329][T15743] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 622.142314][T15743] usb 1-1: Using ep0 maxpacket: 16 [ 622.150129][T15743] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 622.150168][T15743] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 622.150192][T15743] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 622.150240][T15743] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 622.150265][T15743] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.185534][T15743] usb 1-1: config 0 descriptor?? [ 622.727359][T18582] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4355'. [ 623.045547][T18588] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4357'. [ 623.049200][T15743] usbhid 1-1:0.0: can't add hid device: -71 [ 623.049347][T15743] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 623.091983][T15743] usb 1-1: USB disconnect, device number 43 [ 623.257094][T18590] net_ratelimit: 21 callbacks suppressed [ 623.257117][T18590] netlink: zone id is out of range [ 623.257127][T18590] netlink: zone id is out of range [ 623.257135][T18590] netlink: zone id is out of range [ 623.257142][T18590] netlink: zone id is out of range [ 623.257151][T18590] netlink: zone id is out of range [ 623.257158][T18590] netlink: zone id is out of range [ 623.257165][T18590] netlink: zone id is out of range [ 623.257173][T18590] netlink: zone id is out of range [ 623.257181][T18590] netlink: zone id is out of range [ 623.257189][T18590] netlink: set zone limit has 4 unknown bytes [ 625.139979][T18658] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4378'. [ 625.310933][T18664] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4381'. [ 625.981139][T15743] hid-generic 0005:15C2:5505.0002: collection stack underflow [ 625.981179][T15743] hid-generic 0005:15C2:5505.0002: item 0 2 0 12 parsing failed [ 625.985255][T15743] hid-generic 0005:15C2:5505.0002: probe with driver hid-generic failed with error -22 [ 626.422295][T16316] Bluetooth: hci2: command 0x041b tx timeout [ 626.437493][T18694] netlink: 76 bytes leftover after parsing attributes in process `syz.4.4392'. [ 626.448338][T18695] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4391'. [ 626.625610][T18700] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4394'. [ 627.549647][T18727] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4405'. [ 628.109126][T18743] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4410'. [ 628.173735][T18745] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4412'. [ 628.552269][T15500] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 628.702343][T15500] usb 4-1: Using ep0 maxpacket: 32 [ 628.707963][T15500] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 628.710386][T15500] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 628.710404][T15500] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 628.710417][T15500] usb 4-1: Product: syz [ 628.710425][T15500] usb 4-1: Manufacturer: syz [ 628.710434][T15500] usb 4-1: SerialNumber: syz [ 628.772060][T15500] usb 4-1: config 0 descriptor?? [ 628.778152][T18748] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 628.780798][T15500] hub 4-1:0.0: bad descriptor, ignoring hub [ 628.780839][T15500] hub 4-1:0.0: probe with driver hub failed with error -5 [ 629.250920][T18769] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4421'. [ 629.250946][T18769] net_ratelimit: 1 callbacks suppressed [ 629.250959][T18769] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 629.454649][T18748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.455329][T18748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 629.823909][T18778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.824627][T18778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.040576][T18778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.058556][T18778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.476967][ T9056] raw-gadget.0 gadget.3: failed to queue suspend event [ 630.547412][T18748] raw-gadget.0 gadget.3: failed to queue resume event [ 630.563810][ T9058] raw-gadget.0 gadget.3: failed to queue suspend event [ 630.642365][T18776] raw-gadget.0 gadget.3: failed to queue resume event [ 630.664395][ T9058] raw-gadget.0 gadget.3: failed to queue suspend event [ 630.734436][T18776] raw-gadget.0 gadget.3: failed to queue resume event [ 630.773959][ T9056] raw-gadget.0 gadget.3: failed to queue suspend event [ 630.851845][T18748] raw-gadget.0 gadget.3: failed to queue resume event [ 630.876050][ T9056] raw-gadget.0 gadget.3: failed to queue suspend event [ 630.934027][T18778] raw-gadget.0 gadget.3: failed to queue disconnect event [ 631.313944][T15743] usb 4-1: USB disconnect, device number 33 [ 631.476266][T18821] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4436'. [ 631.592286][T15743] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 631.598476][T18823] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4439'. [ 631.598598][T18823] openvswitch: netlink: Flow key attribute not present in set flow. [ 631.749851][T15743] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 1024, setting to 64 [ 631.763570][T15743] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 631.763601][T15743] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 631.763622][T15743] usb 4-1: Product: syz [ 631.763634][T15743] usb 4-1: Manufacturer: syz [ 631.763642][T15743] usb 4-1: SerialNumber: syz [ 631.780215][T15743] usb 4-1: config 0 descriptor?? [ 631.793738][T18778] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 631.805691][T15743] hub 4-1:0.0: bad descriptor, ignoring hub [ 631.805730][T15743] hub 4-1:0.0: probe with driver hub failed with error -5 [ 632.174746][T15499] usb 4-1: USB disconnect, device number 34 [ 632.745706][T18852] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4449'. [ 632.831277][T18854] tipc: New replicast peer: 127.0.0.2 [ 632.849815][T18854] tipc: Enabled bearer , priority 10 [ 632.850672][T18854] tipc: Disabling bearer [ 633.026890][T18859] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 633.845981][T18885] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4462'. [ 634.185641][T18897] tipc: Cannot configure node identity twice [ 634.187255][T18897] tipc: New replicast peer: 127.0.0.2 [ 634.211400][T18897] tipc: Enabled bearer , priority 10 [ 634.220306][T18897] tipc: Disabling bearer [ 634.521293][T18897] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 634.802713][T18916] netlink: 'syz.0.4475': attribute type 15 has an invalid length. [ 634.802738][T18916] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4475'. [ 635.844500][T18945] tipc: Started in network mode [ 635.844524][T18945] tipc: Node identity 1, cluster identity 4711 [ 635.844537][T18945] tipc: Node number set to 1 [ 635.918005][T18949] tipc: New replicast peer: 127.0.0.2 [ 635.918839][T18949] tipc: Enabled bearer , priority 10 [ 635.921566][T18945] tipc: Disabling bearer [ 636.350842][T18945] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 636.814635][T18977] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4495'. [ 637.168334][T18992] tipc: New replicast peer: 127.0.0.2 [ 637.225816][T18992] tipc: Enabled bearer , priority 10 [ 637.227785][T18992] tipc: Disabling bearer [ 637.536623][T18992] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 638.279400][T19016] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4510'. [ 638.787001][T19036] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4517'. [ 639.269421][T19053] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4524'. [ 639.713047][T19074] tipc: New replicast peer: 127.0.0.2 [ 639.735821][T19074] tipc: Enabled bearer , priority 10 [ 639.737701][T19074] tipc: Disabling bearer [ 639.821387][T19077] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4531'. [ 640.000227][T19078] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 640.843841][T15499] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 641.022257][T15499] usb 1-1: Using ep0 maxpacket: 16 [ 641.024685][T15499] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 641.024719][T15499] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 641.024744][T15499] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 641.024789][T15499] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 641.024814][T15499] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 641.124098][T15499] usb 1-1: config 0 descriptor?? [ 641.220455][T19118] netlink: 27 bytes leftover after parsing attributes in process `syz.4.4542'. [ 641.340995][T19121] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4542'. [ 641.754742][T15499] usbhid 1-1:0.0: can't add hid device: -71 [ 641.754875][T15499] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 641.784980][T15499] usb 1-1: USB disconnect, device number 44 [ 643.410918][T19150] 9p: Could not find request transport: xen [ 644.366007][ T5616] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 644.366036][ T5616] CPU: 0 UID: 0 PID: 5616 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 644.366063][ T5616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 644.366077][ T5616] Workqueue: hci4 hci_rx_work [ 644.366247][ T5616] Call Trace: [ 644.366283][ T5616] [ 644.366335][ T5616] dump_stack_lvl+0xe8/0x150 [ 644.366494][ T5616] sysfs_create_dir_ns+0x271/0x2a0 [ 644.366583][ T5616] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 644.366640][ T5616] ? rt_spin_unlock+0x163/0x200 [ 644.366734][ T5616] kobject_add_internal+0x62c/0xce0 [ 644.366793][ T5616] kobject_add+0x163/0x240 [ 644.366813][ T5616] ? rt_spin_unlock+0x157/0x200 [ 644.366843][ T5616] ? __pfx_kobject_add+0x10/0x10 [ 644.366871][ T5616] ? get_device_parent+0x370/0x3a0 [ 644.366969][ T5616] device_add+0x3fa/0xb80 [ 644.367002][ T5616] hci_conn_add_sysfs+0xd5/0x210 [ 644.367080][ T5616] le_conn_complete_evt+0xfef/0x1580 [ 644.367170][ T5616] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 644.367204][ T5616] ? lockdep_hardirqs_on+0x7a/0x110 [ 644.367255][ T5616] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 644.367284][ T5616] ? rt_mutex_slowunlock+0x219/0x460 [ 644.367309][ T5616] ? skb_pull_data+0xf0/0x200 [ 644.367423][ T5616] hci_le_conn_complete_evt+0x187/0x470 [ 644.367464][ T5616] hci_event_packet+0x67a/0xf10 [ 644.367499][ T5616] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 644.367539][ T5616] ? __pfx_hci_event_packet+0x10/0x10 [ 644.367568][ T5616] ? rt_spin_unlock+0x157/0x200 [ 644.367603][ T5616] ? hci_send_to_monitor+0xe2/0x590 [ 644.367629][ T5616] hci_rx_work+0x3ee/0x1020 [ 644.367665][ T5616] ? process_scheduled_works+0xa20/0x14e0 [ 644.367798][ T5616] process_scheduled_works+0xa8e/0x14e0 [ 644.367859][ T5616] ? __pfx_process_scheduled_works+0x10/0x10 [ 644.367893][ T5616] ? assign_work+0x3cf/0x5d0 [ 644.367926][ T5616] worker_thread+0xa47/0xfb0 [ 644.367985][ T5616] kthread+0x388/0x470 [ 644.368043][ T5616] ? __pfx_worker_thread+0x10/0x10 [ 644.368069][ T5616] ? __pfx_kthread+0x10/0x10 [ 644.368103][ T5616] ret_from_fork+0x514/0xb70 [ 644.368174][ T5616] ? __pfx_ret_from_fork+0x10/0x10 [ 644.368205][ T5616] ? __switch_to+0xc89/0x1420 [ 644.368259][ T5616] ? __pfx_kthread+0x10/0x10 [ 644.368292][ T5616] ret_from_fork_asm+0x1a/0x30 [ 644.368335][ T5616] [ 644.368487][ T5616] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 644.368541][ T5616] Bluetooth: hci4: failed to register connection device [ 644.682271][T15745] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 644.869977][T15745] usb 5-1: Using ep0 maxpacket: 16 [ 644.883196][T15745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 644.883232][T15745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 644.883256][T15745] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 644.883299][T15745] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 644.883323][T15745] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.913271][T15745] usb 5-1: config 0 descriptor?? [ 645.447320][T19217] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4567'. [ 645.510461][T19195] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 645.921742][T19226] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 645.978459][T19226] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4568'. [ 646.117515][T15745] usbhid 5-1:0.0: can't add hid device: -71 [ 646.117844][T15745] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 646.250018][T15745] usb 5-1: USB disconnect, device number 41 [ 646.662733][T15499] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 646.814690][T15499] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 646.814723][T15499] usb 2-1: config 0 has no interface number 0 [ 646.814772][T15499] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 646.818683][T15499] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 646.818715][T15499] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.818736][T15499] usb 2-1: Product: syz [ 646.818751][T15499] usb 2-1: Manufacturer: syz [ 646.818766][T15499] usb 2-1: SerialNumber: syz [ 646.900347][T15499] usb 2-1: config 0 descriptor?? [ 647.052548][T15499] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 647.168071][T15499] usb 2-1: USB disconnect, device number 41 [ 647.221036][T15499] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 648.517858][T19287] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4583'. [ 648.648684][T19290] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4584'. [ 649.023773][T19302] netlink: 160 bytes leftover after parsing attributes in process `syz.4.4588'. [ 649.579646][T19317] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4593'. [ 650.175541][T19336] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4598'. [ 650.982300][T15745] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 651.144812][T15745] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 651.144852][T15745] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 651.144899][T15745] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 651.144933][T15745] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.160463][T15745] usb 1-1: config 0 descriptor?? [ 651.161482][T19347] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 651.786503][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786552][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786579][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786604][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786630][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786655][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786679][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786701][T15745] kone 0003:1E7D:2CED.0003: unknown main item tag 0x0 [ 651.786724][T15745] kone 0003:1E7D:2CED.0003: unexpected long global item [ 651.849135][T15745] kone 0003:1E7D:2CED.0003: parse failed [ 651.849238][T15745] kone 0003:1E7D:2CED.0003: probe with driver kone failed with error -22 [ 651.992425][T15745] usb 1-1: USB disconnect, device number 45 [ 653.167233][ T197] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 653.312305][ T197] usb 3-1: Using ep0 maxpacket: 8 [ 653.314860][ T197] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 653.314897][ T197] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 653.314924][ T197] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 653.314950][ T197] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 653.314995][ T197] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 653.315020][ T197] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.640737][ T197] usb 3-1: GET_CAPABILITIES returned 0 [ 653.640795][ T197] usbtmc 3-1:16.0: can't read capabilities [ 653.881158][T15749] usb 3-1: USB disconnect, device number 35 [ 654.919831][T19439] 8021q: VLANs not supported on nlmon0 [ 656.233981][T19477] 8021q: VLANs not supported on nlmon0 [ 657.632294][ T197] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 657.835157][ T197] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 657.835195][ T197] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 657.835219][ T197] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 657.835264][ T197] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 657.835289][ T197] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.847502][ T197] usb 3-1: config 0 descriptor?? [ 658.419930][T19531] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4655'. [ 658.892262][T15500] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 659.078439][T15500] usb 5-1: Using ep0 maxpacket: 32 [ 659.127588][T15500] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 659.127624][T15500] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.127646][T15500] usb 5-1: Product: syz [ 659.127661][T15500] usb 5-1: Manufacturer: syz [ 659.127677][T15500] usb 5-1: SerialNumber: syz [ 659.535229][ T197] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 659.549412][T15500] usb 5-1: config 0 descriptor?? [ 659.763277][T15500] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 659.908433][ T197] usb 3-1: USB disconnect, device number 36 [ 660.250389][T15500] gspca_ov534_9: reg_w failed -71 [ 660.615610][T15500] gspca_ov534_9: Unknown sensor 0000 [ 660.615784][T15500] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 660.654620][T15500] usb 5-1: USB disconnect, device number 42 [ 661.094653][T19569] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4667'. [ 661.425997][T19583] netlink: 'syz.3.4670': attribute type 15 has an invalid length. [ 661.426018][T19583] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4670'. [ 663.520855][T19596] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 663.561004][T19594] tipc: New replicast peer: 127.0.0.2 [ 663.566262][T19594] tipc: Enabled bearer , priority 10 [ 663.572015][T19594] tipc: Disabling bearer [ 664.065075][T19600] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 664.443928][T15745] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 664.592530][T15745] usb 4-1: Using ep0 maxpacket: 16 [ 664.595044][T15745] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 664.595078][T15745] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 664.595096][T15745] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 664.595123][T15745] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 664.595136][T15745] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.600139][T15745] usb 4-1: config 0 descriptor?? [ 664.846884][T19619] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4678'. [ 665.697955][T15745] usbhid 4-1:0.0: can't add hid device: -71 [ 665.698088][T15745] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 665.804232][T15745] usb 4-1: USB disconnect, device number 35 [ 666.112745][T19644] tipc: New replicast peer: 127.0.0.2 [ 666.113507][T19644] tipc: Enabled bearer , priority 10 [ 666.118014][T19644] tipc: Disabling bearer [ 666.513872][T19644] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 668.121572][T19689] tipc: New replicast peer: 127.0.0.2 [ 668.133486][T19689] tipc: Enabled bearer , priority 10 [ 668.134477][T19689] tipc: Disabling bearer [ 668.404132][T19689] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 669.526372][T19704] nvme nvme0: rdma connection establishment failed (-104) [ 670.499974][T19735] tipc: New replicast peer: 127.0.0.2 [ 670.500391][T19735] tipc: Enabled bearer , priority 10 [ 670.501332][T19735] tipc: Disabling bearer [ 670.535791][T19712] block device autoloading is deprecated and will be removed. [ 670.942941][T19737] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 671.591972][T19761] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4722'. [ 672.471669][T19752] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 672.502315][ T5616] Bluetooth: hci1: command 0x0406 tx timeout [ 672.799994][T19780] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4730'. [ 672.802274][T15745] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 672.952217][T15745] usb 3-1: Using ep0 maxpacket: 16 [ 672.959829][T15745] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.959864][T15745] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 672.959888][T15745] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 672.959932][T15745] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 672.959958][T15745] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.999533][T15745] usb 3-1: config 0 descriptor?? [ 673.659681][T15745] usbhid 3-1:0.0: can't add hid device: -71 [ 673.659819][T15745] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 673.671708][T15745] usb 3-1: USB disconnect, device number 37 [ 673.815258][T19801] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4738'. [ 674.128155][T19810] netlink: zone id is out of range [ 674.128173][T19810] netlink: zone id is out of range [ 674.128181][T19810] netlink: zone id is out of range [ 674.128189][T19810] netlink: zone id is out of range [ 674.128196][T19810] netlink: zone id is out of range [ 674.128203][T19810] netlink: zone id is out of range [ 674.128210][T19810] netlink: zone id is out of range [ 674.128217][T19810] netlink: zone id is out of range [ 674.128224][T19810] netlink: set zone limit has 8 unknown bytes [ 674.275557][T19814] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4743'. [ 674.516614][T19825] netlink: 188 bytes leftover after parsing attributes in process `syz.3.4746'. [ 674.978425][T19843] netlink: zone id is out of range [ 675.152288][T15745] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 675.219662][T19853] netlink: 188 bytes leftover after parsing attributes in process `syz.3.4758'. [ 675.302304][T15745] usb 5-1: Using ep0 maxpacket: 16 [ 675.319707][T15745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 675.319742][T15745] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 675.319764][T15745] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 675.319805][T15745] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 675.319827][T15745] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.376720][T15745] usb 5-1: config 0 descriptor?? [ 675.672834][T19863] tipc: Cannot configure node identity twice [ 675.674077][T19863] tipc: New replicast peer: 127.0.0.2 [ 675.674812][T19863] tipc: Enabled bearer , priority 10 [ 675.675863][T19863] tipc: Disabling bearer [ 675.959270][T19866] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 676.367721][T15745] usbhid 5-1:0.0: can't add hid device: -71 [ 676.367861][T15745] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 676.373549][T15745] usb 5-1: USB disconnect, device number 43 [ 676.784407][T19884] tipc: Enabled bearer , priority 10 [ 676.950405][T19890] netlink: 188 bytes leftover after parsing attributes in process `syz.2.4770'. [ 677.079731][T19892] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4772'. [ 677.240928][T19904] tipc: New replicast peer: 127.0.0.2 [ 677.241280][T19904] tipc: Enabled bearer , priority 10 [ 677.241938][T19904] tipc: Disabling bearer [ 677.363512][T19911] netlink: 'syz.1.4780': attribute type 15 has an invalid length. [ 677.363535][T19911] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4780'. [ 677.494187][T19904] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 677.719436][T19923] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4785'. [ 677.789332][T19924] jffs2: notice: (19924) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 677.860038][T19926] capability: warning: `syz.1.4786' uses deprecated v2 capabilities in a way that may be insecure [ 677.985462][T19930] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4787'. [ 678.541583][T19956] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4798'. [ 678.749345][T19961] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4801'. [ 681.447069][T19991] netlink: 164 bytes leftover after parsing attributes in process `syz.2.4809'. [ 681.805942][T19996] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4812'. [ 683.038073][T20008] binder: 20007:20008 ioctl c0306201 0 returned -14 [ 683.039037][T20008] binder: 20007:20008 ioctl c0306201 0 returned -14 [ 683.039622][T20008] tmpfs: Unknown parameter 'grpquotaL' [ 683.187115][T20016] net_ratelimit: 36 callbacks suppressed [ 683.187137][T20016] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 683.187169][T20016] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 683.492156][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.512169][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.522176][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.532167][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.542168][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.552165][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.562169][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.572165][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 683.582176][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 685.435278][T20034] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4824'. [ 685.675250][T20043] netlink: zone id is out of range [ 685.675265][T20043] netlink: zone id is out of range [ 685.675274][T20043] netlink: zone id is out of range [ 685.675282][T20043] netlink: zone id is out of range [ 685.675290][T20043] netlink: zone id is out of range [ 685.675298][T20043] netlink: zone id is out of range [ 685.675306][T20043] netlink: zone id is out of range [ 685.675314][T20043] netlink: zone id is out of range [ 686.870447][T20069] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4836'. [ 688.905063][T20078] net_ratelimit: 3 callbacks suppressed [ 688.923227][T20078] netlink: zone id is out of range [ 688.923244][T20078] netlink: zone id is out of range [ 688.923253][T20078] netlink: zone id is out of range [ 688.923313][T20078] netlink: zone id is out of range [ 688.923322][T20078] netlink: zone id is out of range [ 688.923329][T20078] netlink: zone id is out of range [ 688.923337][T20078] netlink: zone id is out of range [ 688.923345][T20078] netlink: zone id is out of range [ 688.923416][T20078] netlink: zone id is out of range [ 689.637735][T20084] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 690.949740][T20107] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4849'. [ 693.035663][T20121] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6gretap0, syncid = 4, id = 0 [ 695.958644][T20111] ima: policy update failed [ 695.960392][ T37] kauditd_printk_skb: 34 callbacks suppressed [ 695.960409][ T37] audit: type=1802 audit(1785925480.338:46): pid=20111 uid=0 auid=4294967295 ses=4294967295 subj=_ op=policy_update cause=failed comm="syz.3.4851" res=0 errno=0 [ 696.217965][T20143] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4860'. [ 696.291735][T20148] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4862'. [ 696.291761][T20148] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4862'. [ 696.291947][T20148] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4862'. [ 696.291963][T20148] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4862'. [ 696.662986][T20159] net_ratelimit: 1 callbacks suppressed [ 696.663008][T20159] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 696.842216][ T197] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 697.054946][ T197] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 697.054983][ T197] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 697.055013][ T197] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 697.055027][ T197] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.060476][ T197] usb 2-1: config 0 descriptor?? [ 697.127835][T20155] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 698.897244][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897373][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897439][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897530][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897557][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897583][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897647][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897708][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897800][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 698.897862][ T197] kone 0003:1E7D:2CED.0005: unknown main item tag 0x0 [ 700.664861][ T197] kone 0003:1E7D:2CED.0005: hidraw0: USB HID v80.09 Device [HID 1e7d:2ced] on usb-dummy_hcd.1-1/input0 [ 700.943476][ T197] usb 2-1: USB disconnect, device number 42 [ 701.103087][T20177] loop0: detected capacity change from 0 to 2048 [ 701.108837][T20183] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4873'. [ 701.202989][T20186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4874'. [ 701.203012][T20186] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4874'. [ 701.203266][T20186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4874'. [ 701.203281][T20186] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4874'. [ 703.465260][T20190] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 704.034036][ T4927] usb 4-1: new full-speed USB device number 36 using dummy_hcd [ 704.196925][ T4927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 704.196966][ T4927] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 704.197012][ T4927] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 704.197037][ T4927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 704.259473][T20237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4885'. [ 704.259498][T20237] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4885'. [ 704.259685][T20237] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4885'. [ 704.259701][T20237] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4885'. [ 704.261308][ T4927] usb 4-1: config 0 descriptor?? [ 704.262459][T20197] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 704.345657][T20239] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4886'. [ 705.176450][ T4927] hid_parser_main: 34 callbacks suppressed [ 705.176535][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176588][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176615][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176639][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176673][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176699][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176724][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176749][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176773][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.176797][ T4927] kone 0003:1E7D:2CED.0006: unknown main item tag 0x0 [ 705.273482][ T4927] kone 0003:1E7D:2CED.0006: hidraw0: USB HID v80.09 Device [HID 1e7d:2ced] on usb-dummy_hcd.3-1/input0 [ 705.297199][ T4927] usb 4-1: USB disconnect, device number 36 [ 705.548330][T20251] fido_id[20251]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 707.225979][T20275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4898'. [ 707.226052][T20275] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4898'. [ 707.226763][T20275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4898'. [ 707.226838][T20275] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4898'. [ 708.358228][T20280] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4899'. [ 708.812251][T15500] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 708.952276][T15500] usb 3-1: device descriptor read/64, error -71 [ 709.192557][T15500] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 709.333237][T20304] __nla_validate_parse: 1 callbacks suppressed [ 709.333293][T20304] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4905'. [ 710.217969][T15500] usb 3-1: device descriptor read/64, error -71 [ 710.506473][T15500] usb usb3-port1: attempt power cycle [ 716.622582][T15501] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 716.959671][T15501] usb 3-1: device descriptor read/64, error -71 [ 717.362375][T15501] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 717.492282][T15501] usb 3-1: device descriptor read/64, error -71 [ 717.602917][T15501] usb usb3-port1: attempt power cycle [ 717.952246][T15501] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 717.973228][T15501] usb 3-1: device descriptor read/8, error -71 [ 718.232769][T15501] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 718.253126][T15501] usb 3-1: device descriptor read/8, error -71 [ 718.362726][T15501] usb usb3-port1: unable to enumerate USB device [ 718.599242][T20398] binder: 20397:20398 ioctl c0306201 200000000580 returned -14 [ 722.832238][ T4927] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 722.984253][ T4927] usb 3-1: config 0 has no interfaces? [ 722.985986][ T4927] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 722.986015][ T4927] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 722.986114][ T4927] usb 3-1: Product: syz [ 722.986130][ T4927] usb 3-1: SerialNumber: syz [ 722.991015][ T4927] usb 3-1: config 0 descriptor?? [ 723.555901][T20461] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 723.556620][T20461] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 723.596946][T15745] usb 3-1: USB disconnect, device number 45 [ 723.673110][T15749] usb 5-1: new full-speed USB device number 44 using dummy_hcd [ 723.830105][T15749] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 723.830132][T15749] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 723.830144][T15749] usb 5-1: config 0 has no interface number 0 [ 723.830172][T15749] usb 5-1: config 0 interface 251 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 723.834309][T15749] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 723.834340][T15749] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.834360][T15749] usb 5-1: Product: syz [ 723.834374][T15749] usb 5-1: Manufacturer: syz [ 723.834388][T15749] usb 5-1: SerialNumber: syz [ 723.845006][T15749] usb 5-1: config 0 descriptor?? [ 723.904089][T15749] asix 5-1:0.251: probe with driver asix failed with error -22 [ 724.164932][T20472] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4970'. [ 724.258390][T20475] binder: 20474:20475 ioctl c0306201 200000000580 returned -14 [ 724.426684][ T4927] usb 5-1: USB disconnect, device number 44 [ 724.689460][ T5616] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 724.739433][ T5616] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 724.766037][ T5616] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 724.769171][ T5616] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 724.770019][ T5616] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 725.182800][T20491] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4977'. [ 725.416192][T20501] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4981'. [ 725.508748][T20500] comedi comedi3: das16m1: I/O port conflict (0x500,8) [ 725.669206][T20506] binder: 20504:20506 ioctl c0306201 200000000580 returned -14 [ 725.991460][T20520] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4988'. [ 725.991496][T20520] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4988'. [ 726.013643][T20520] netlink: 'syz.4.4988': attribute type 1 has an invalid length. [ 726.013667][T20520] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4988'. [ 726.030901][T20482] wg2 speed is unknown, defaulting to 1000 [ 726.723778][T20532] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4991'. [ 726.982473][T16316] Bluetooth: hci3: command tx timeout [ 727.127000][T20482] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.127234][T20482] bridge0: port 1(bridge_slave_0) entered disabled state [ 727.127430][T20482] bridge_slave_0: entered allmulticast mode [ 727.130463][T20482] bridge_slave_0: entered promiscuous mode [ 727.161526][T20482] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.161751][T20482] bridge0: port 2(bridge_slave_1) entered disabled state [ 727.161988][T20482] bridge_slave_1: entered allmulticast mode [ 727.185374][T20482] bridge_slave_1: entered promiscuous mode [ 727.273450][T20482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 727.278304][T20482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 727.741731][T20556] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4999'. [ 727.741769][T20556] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4999'. [ 727.902747][T20558] netlink: 'syz.3.4999': attribute type 1 has an invalid length. [ 727.902772][T20558] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4999'. [ 728.183946][T20482] team0: Port device team_slave_0 added [ 728.199702][T20482] team0: Port device team_slave_1 added [ 728.989288][T20482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 728.989306][T20482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 728.989329][T20482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 728.996732][T20482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 728.996748][T20482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 728.996773][T20482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 729.073321][T16316] Bluetooth: hci3: command tx timeout [ 729.320881][T20577] binder: 20576:20577 ioctl c0306201 200000000580 returned -14 [ 729.334850][T15500] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 729.347576][T20482] hsr_slave_0: entered promiscuous mode [ 729.348991][T20482] hsr_slave_1: entered promiscuous mode [ 729.349958][T20482] debugfs: 'hsr0' already exists in 'hsr' [ 729.349983][T20482] Cannot create hsr debugfs directory [ 729.494696][T15500] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 729.494727][T15500] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 729.494759][T15500] usb 2-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 729.494773][T15500] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.050303][T20591] __nla_validate_parse: 1 callbacks suppressed [ 730.050326][T20591] netlink: 120 bytes leftover after parsing attributes in process `syz.3.5011'. [ 730.215957][T20594] tipc: New replicast peer: 127.0.0.2 [ 730.238989][T20594] tipc: Enabled bearer , priority 10 [ 730.240150][T20594] tipc: Disabling bearer [ 730.564916][T20594] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 730.855189][T20607] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5016'. [ 730.855216][T20607] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5016'. [ 730.857700][T20607] netlink: 'syz.4.5016': attribute type 1 has an invalid length. [ 730.857721][T20607] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5016'. [ 731.142235][T16316] Bluetooth: hci3: command tx timeout [ 731.326753][T20609] binder: 20608:20609 ioctl c0306201 200000000580 returned -14 [ 731.424076][T20611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5018'. [ 731.424094][T20611] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5018'. [ 731.424200][T20611] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5018'. [ 731.424209][T20611] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5018'. [ 731.529926][T20613] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5019'. [ 731.835131][T20621] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5021'. [ 732.925442][T15471] usb 2-1: USB disconnect, device number 43 [ 733.222243][T16316] Bluetooth: hci3: command tx timeout [ 733.380346][T20631] tipc: New replicast peer: 127.0.0.2 [ 733.381164][T20631] tipc: Enabled bearer , priority 10 [ 733.416151][T20629] tipc: Disabling bearer [ 733.726144][T20482] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 733.799510][T20482] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 733.831505][T20638] tipc: Enabled bearer , priority 10 [ 733.832192][T20629] bond0: (slave netdevsim0): Error: Device can not be enslaved while up [ 733.847791][T20482] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 733.899000][T20482] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 733.909332][T20482] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 733.997548][T20482] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 734.042653][T20482] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 734.094874][T20643] binder: 20642:20643 ioctl c0306201 200000000580 returned -14 [ 734.099665][T20482] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 734.442277][T15749] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 734.561515][T20482] 8021q: adding VLAN 0 to HW filter on device bond0 [ 734.592301][T15749] usb 2-1: Using ep0 maxpacket: 16 [ 734.594807][T15749] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.594840][T15749] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 734.594864][T15749] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 734.594909][T15749] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 734.594932][T15749] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.601864][T15749] usb 2-1: config 0 descriptor?? [ 734.722672][T20482] 8021q: adding VLAN 0 to HW filter on device team0 [ 734.733292][T15501] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 734.769474][ T9053] bridge0: port 1(bridge_slave_0) entered blocking state [ 734.769643][ T9053] bridge0: port 1(bridge_slave_0) entered forwarding state [ 734.808749][ T9053] bridge0: port 2(bridge_slave_1) entered blocking state [ 734.809075][ T9053] bridge0: port 2(bridge_slave_1) entered forwarding state [ 734.842750][ T197] usb 5-1: new full-speed USB device number 45 using dummy_hcd [ 734.897665][T15501] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 734.897695][T15501] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 734.897735][T15501] usb 4-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 734.897759][T15501] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.995434][ T197] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 734.995464][ T197] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 734.995484][ T197] usb 5-1: config 0 has no interface number 0 [ 734.995525][ T197] usb 5-1: config 0 interface 251 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 735.003586][ T197] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 735.003658][ T197] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.003679][ T197] usb 5-1: Product: syz [ 735.003693][ T197] usb 5-1: Manufacturer: syz [ 735.003707][ T197] usb 5-1: SerialNumber: syz [ 735.016189][ T197] usb 5-1: config 0 descriptor?? [ 735.031475][ T197] asix 5-1:0.251: probe with driver asix failed with error -22 [ 735.296540][T15749] usbhid 2-1:0.0: can't add hid device: -71 [ 735.296684][T15749] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 735.325399][T15749] usb 2-1: USB disconnect, device number 44 [ 735.674725][ T197] usb 5-1: USB disconnect, device number 45 [ 735.915385][T20686] Bluetooth: MGMT ver 1.23 [ 735.931427][T20482] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 736.005488][T20688] tipc: New replicast peer: 127.0.0.2 [ 736.005814][T20688] tipc: Enabled bearer , priority 10 [ 736.010451][T20688] tipc: Disabling bearer [ 736.156300][T20482] veth0_vlan: entered promiscuous mode [ 736.241759][T20482] veth1_vlan: entered promiscuous mode [ 736.334018][T20690] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 736.340092][T20696] binder_alloc: 20695: binder_alloc_buf, no vma [ 736.340197][T20696] binder: 20695:20696 ioctl c0306201 200000000580 returned -14 [ 736.476062][T20482] veth0_macvtap: entered promiscuous mode [ 736.492627][T20482] veth1_macvtap: entered promiscuous mode [ 736.540137][T20482] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 736.585910][T20482] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 736.642051][T20698] __nla_validate_parse: 5 callbacks suppressed [ 736.642285][T20698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5042'. [ 736.642304][T20698] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5042'. [ 736.642553][T20698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5042'. [ 736.642568][T20698] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5042'. [ 736.742507][ T2949] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.816352][T20700] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5043'. [ 737.017330][T20704] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5044'. [ 737.243387][ T3295] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.111448][ T4927] usb 4-1: USB disconnect, device number 37 [ 738.363186][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.453147][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.636571][T20719] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5049'. [ 739.544753][ T4927] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 739.713244][ T4927] usb 4-1: Using ep0 maxpacket: 16 [ 739.717632][ T4927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 739.717667][ T4927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 739.717689][ T4927] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 739.717730][ T4927] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 739.717753][ T4927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 739.861911][ T4927] usb 4-1: config 0 descriptor?? [ 740.063677][ T3425] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 740.063701][ T3425] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 740.231742][ T3425] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 740.231766][ T3425] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 740.491569][T20730] tipc: New replicast peer: 127.0.0.2 [ 740.518916][T20730] tipc: Enabled bearer , priority 10 [ 740.521354][T20730] tipc: Disabling bearer [ 740.565621][ T4927] usbhid 4-1:0.0: can't add hid device: -71 [ 740.565756][ T4927] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 740.592398][ T4927] usb 4-1: USB disconnect, device number 38 [ 740.875079][T20730] bond0: (slave netdevsim0): Error: Device is in use and cannot be enslaved [ 742.389543][T20756] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5059'. [ 742.414286][T20764] netlink: zone id is out of range [ 742.415220][T20764] netlink: get zone limit has 4 unknown bytes [ 742.552202][T20767] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5063'. [ 744.051514][T20777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5065'. [ 744.051543][T20777] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5065'. [ 744.304096][T20777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5065'. [ 744.304122][T20777] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5065'. [ 744.312333][ T9053] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 744.312388][ T9053] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 744.312428][ T9053] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 744.312466][ T9053] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 744.371912][T20783] kernel profiling enabled (shift: 5) [ 746.319672][T20801] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5072'. [ 750.490585][T20854] cgroup: fork rejected by pids controller in /syz1 [ 750.525948][T20856] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5092'. [ 751.888469][T20887] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input37 [ 752.406624][T20905] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5112'. [ 752.552686][ T5616] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 752.615359][ T5616] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 752.624576][ T5616] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 752.631441][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 752.643634][ T5616] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 753.315217][ T37] audit: type=1800 audit(1785925537.658:47): pid=20917 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.5115" name="attr_allow_any_host" dev="configfs" ino=69847 res=0 errno=0 [ 753.386067][T20921] nvmet: adding nsid 1 to subsystem testnqn [ 753.592458][T20909] wg2 speed is unknown, defaulting to 1000 [ 755.138768][T20949] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5123'. [ 755.402636][T16316] Bluetooth: hci2: command tx timeout [ 755.966493][T20963] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5127'. [ 756.065621][T20966] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5128'. [ 756.512419][T15749] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 756.535050][T20909] bridge0: port 1(bridge_slave_0) entered blocking state [ 756.535284][T20909] bridge0: port 1(bridge_slave_0) entered disabled state [ 756.535514][T20909] bridge_slave_0: entered allmulticast mode [ 756.540085][T20909] bridge_slave_0: entered promiscuous mode [ 756.555030][T20909] bridge0: port 2(bridge_slave_1) entered blocking state [ 756.555152][T20909] bridge0: port 2(bridge_slave_1) entered disabled state [ 756.555356][T20909] bridge_slave_1: entered allmulticast mode [ 756.563998][T20909] bridge_slave_1: entered promiscuous mode [ 756.682247][T15749] usb 4-1: Using ep0 maxpacket: 16 [ 756.684792][T15749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 756.684828][T15749] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 756.684853][T15749] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 756.684897][T15749] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 756.684922][T15749] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.740368][T20909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 756.757245][T20909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 756.806665][T15749] usb 4-1: config 0 descriptor?? [ 757.133928][T20909] team0: Port device team_slave_0 added [ 757.171803][T20909] team0: Port device team_slave_1 added [ 757.462300][ T5616] Bluetooth: hci2: command tx timeout [ 757.506640][T20909] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 757.506659][T20909] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.506688][T20909] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 757.519006][T20909] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 757.519023][T20909] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.519049][T20909] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 757.750635][T15749] usbhid 4-1:0.0: can't add hid device: -71 [ 757.750772][T15749] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 757.834386][T15749] usb 4-1: USB disconnect, device number 39 [ 758.276278][T20986] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5132'. [ 759.496912][T20997] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5136'. [ 759.525067][T20909] hsr_slave_0: entered promiscuous mode [ 759.541889][T20909] hsr_slave_1: entered promiscuous mode [ 759.554444][T20909] debugfs: 'hsr0' already exists in 'hsr' [ 759.554508][T20909] Cannot create hsr debugfs directory [ 760.397569][T16316] Bluetooth: hci2: command tx timeout [ 760.725656][T21001] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 762.514554][ T5616] Bluetooth: hci2: command tx timeout [ 762.832585][ T5616] Bluetooth: hci5: command 0x1003 tx timeout [ 762.833876][T16316] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 765.224833][T15501] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 765.461298][T15501] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 765.461330][T15501] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 765.461351][T15501] usb 5-1: config 0 has no interface number 0 [ 765.461398][T15501] usb 5-1: config 0 interface 251 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 765.504195][T15501] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 765.504228][T15501] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.504248][T15501] usb 5-1: Product: syz [ 765.504263][T15501] usb 5-1: Manufacturer: syz [ 765.504278][T15501] usb 5-1: SerialNumber: syz [ 765.549073][T15501] usb 5-1: config 0 descriptor?? [ 765.570353][T15501] asix 5-1:0.251: probe with driver asix failed with error -22 [ 765.618472][T20909] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.500653][T15501] usb 5-1: USB disconnect, device number 46 [ 767.307495][T21056] 9p: Could not find request transport: xen [ 767.360858][T20909] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.517816][T21061] binder: 21060:21061 ioctl c0306201 200000000580 returned -14 [ 768.045814][T20909] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.396812][T20909] bond0: (slave netdevsim0): Releasing backup interface [ 771.547315][T20909] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 772.900599][T21094] 9p: Could not find request transport: xen [ 775.470557][T21114] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5173'. [ 775.565754][T21114] vlan2: entered promiscuous mode [ 775.565780][T21114] batadv0: entered promiscuous mode [ 775.684338][T21118] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5174'. [ 778.348537][T20909] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 778.979481][T20909] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 778.982044][T20909] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 779.070851][T20909] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 779.089404][T20909] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 779.178345][T20909] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 779.180416][T20909] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 779.230972][T20909] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 779.483808][T20909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 779.851329][T20909] 8021q: adding VLAN 0 to HW filter on device team0 [ 779.953546][ T9058] bridge0: port 1(bridge_slave_0) entered blocking state [ 779.953802][ T9058] bridge0: port 1(bridge_slave_0) entered forwarding state [ 779.984932][ T9058] bridge0: port 2(bridge_slave_1) entered blocking state [ 779.985670][ T9058] bridge0: port 2(bridge_slave_1) entered forwarding state [ 783.600118][T20909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 783.828463][T20909] veth0_vlan: entered promiscuous mode [ 783.915599][T21222] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5207'. [ 783.940109][T20909] veth1_vlan: entered promiscuous mode [ 784.321218][T20909] veth0_macvtap: entered promiscuous mode [ 784.391133][T20909] veth1_macvtap: entered promiscuous mode [ 784.521496][T20909] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 784.586637][T20909] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 784.763796][ T1057] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 784.763865][ T1057] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 785.409271][ T9053] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 785.574663][ T9058] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 787.502784][ T3295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 787.502808][ T3295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 787.723504][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 787.723529][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 790.577153][T21281] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5227'. [ 792.391490][T21299] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5233'. [ 793.239042][T21308] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 794.101367][T21323] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5240'. [ 795.394336][T16316] Bluetooth: hci4: command 0x0406 tx timeout [ 802.251465][T21333] netlink: 72 bytes leftover after parsing attributes in process `syz.0.5244'. [ 805.967451][T21337] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5243'. [ 824.079951][T16316] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 824.133733][T16316] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 824.138965][T16316] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 824.247206][T16316] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 824.257733][T16316] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 828.262562][ T5616] Bluetooth: hci5: command tx timeout [ 830.557248][ T5616] Bluetooth: hci5: command tx timeout [ 832.628442][T16316] Bluetooth: hci5: command tx timeout [ 834.677313][T16316] Bluetooth: hci5: command tx timeout [ 844.822292][ T5616] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 846.769190][T16316] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 846.872601][T16316] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 846.881458][T16316] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 846.900276][T16316] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 846.910313][T16316] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 846.947525][T16316] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 849.325451][T21371] Bluetooth: hci6: Opcode 0x0c03 failed: -110 [ 850.022295][ T5616] Bluetooth: hci7: command tx timeout [ 852.102184][ T5616] Bluetooth: hci7: command tx timeout [ 854.182157][ T5616] Bluetooth: hci7: command tx timeout [ 856.763947][ T5616] Bluetooth: hci7: command tx timeout [ 864.018157][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 864.069609][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 864.084932][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 864.100184][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 864.101109][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 866.832194][ T5612] Bluetooth: hci1: command tx timeout [ 868.904626][ T5612] Bluetooth: hci1: command tx timeout [ 871.002109][ T5612] Bluetooth: hci1: command tx timeout [ 873.082214][ T5612] Bluetooth: hci1: command tx timeout [ 986.911995][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 986.912015][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P21373/1:b..l P21414/1:b..l P15479/1:b..l P56/1:b..l P3326/1:b..l P3295/1:b..l P1753/1:b..l [ 986.912142][ C1] rcu: (detected by 1, t=10502 jiffies, g=97045, q=492 ncpus=2) [ 986.912162][ C1] task:kworker/u8:10 state:D stack:15136 pid:1753 tgid:1753 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 986.912213][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 986.912354][ C1] Call Trace: [ 986.912362][ C1] [ 986.912392][ C1] __schedule+0x16dc/0x5500 [ 986.912481][ C1] ? __pfx___schedule+0x10/0x10 [ 986.912526][ C1] schedule_rtlock+0x30/0x70 [ 986.912551][ C1] rtlock_slowlock_locked+0x35c5/0x3c20 [ 986.912596][ C1] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 986.912621][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 986.912645][ C1] ? unwind_next_frame+0x8f/0x2550 [ 986.912728][ C1] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 986.912768][ C1] ? rcu_is_watching+0x15/0xb0 [ 986.912856][ C1] rt_spin_lock+0x165/0x400 [ 986.912882][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 986.912917][ C1] __refill_objects_node+0x89/0x5b0 [ 986.913020][ C1] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 986.913051][ C1] refill_objects+0x56/0x350 [ 986.913090][ C1] __pcs_replace_empty_main+0x330/0x690 [ 986.913121][ C1] ? rt_spin_trylock+0x13a/0x2b0 [ 986.913149][ C1] __kmalloc_node_track_caller_noprof+0x62d/0x7c0 [ 986.913176][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.913204][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.913240][ C1] __alloc_skb+0x2bd/0x7a0 [ 986.913273][ C1] nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.913316][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 986.913343][ C1] process_scheduled_works+0xa8e/0x14e0 [ 986.913407][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 986.913440][ C1] ? assign_work+0x3cf/0x5d0 [ 986.913471][ C1] worker_thread+0xa47/0xfb0 [ 986.913512][ C1] ? __kthread_parkme+0x71/0x1f0 [ 986.913551][ C1] kthread+0x388/0x470 [ 986.913582][ C1] ? __pfx_worker_thread+0x10/0x10 [ 986.913606][ C1] ? __pfx_kthread+0x10/0x10 [ 986.913638][ C1] ret_from_fork+0x514/0xb70 [ 986.913676][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.913707][ C1] ? __switch_to+0xc89/0x1420 [ 986.913738][ C1] ? __pfx_kthread+0x10/0x10 [ 986.913785][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.913826][ C1] [ 986.913835][ C1] task:kworker/u8:12 state:D stack:21176 pid:3295 tgid:3295 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 986.913893][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 986.913922][ C1] Call Trace: [ 986.913928][ C1] [ 986.913940][ C1] __schedule+0x16dc/0x5500 [ 986.913994][ C1] ? __pfx___schedule+0x10/0x10 [ 986.914038][ C1] schedule_rtlock+0x30/0x70 [ 986.914063][ C1] rtlock_slowlock_locked+0x35c5/0x3c20 [ 986.914106][ C1] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 986.914133][ C1] ? unwind_next_frame+0x8f/0x2550 [ 986.914164][ C1] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 986.914203][ C1] ? rcu_is_watching+0x15/0xb0 [ 986.914235][ C1] rt_spin_lock+0x165/0x400 [ 986.914261][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 986.914295][ C1] __refill_objects_node+0x89/0x5b0 [ 986.914334][ C1] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 986.914364][ C1] refill_objects+0x56/0x350 [ 986.914412][ C1] __pcs_replace_empty_main+0x330/0x690 [ 986.914442][ C1] ? rt_spin_trylock+0x13a/0x2b0 [ 986.914470][ C1] __kmalloc_node_track_caller_noprof+0x62d/0x7c0 [ 986.914496][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.914524][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.914561][ C1] __alloc_skb+0x2bd/0x7a0 [ 986.914590][ C1] nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.914633][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 986.914658][ C1] process_scheduled_works+0xa8e/0x14e0 [ 986.914713][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 986.914745][ C1] ? assign_work+0x3cf/0x5d0 [ 986.914776][ C1] worker_thread+0xa47/0xfb0 [ 986.914830][ C1] kthread+0x388/0x470 [ 986.914860][ C1] ? __pfx_worker_thread+0x10/0x10 [ 986.914900][ C1] ? __pfx_kthread+0x10/0x10 [ 986.914933][ C1] ret_from_fork+0x514/0xb70 [ 986.914966][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.914997][ C1] ? __switch_to+0xc89/0x1420 [ 986.915028][ C1] ? __pfx_kthread+0x10/0x10 [ 986.915060][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.915098][ C1] [ 986.915106][ C1] task:kworker/u8:14 state:D stack:15040 pid:3326 tgid:3326 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 986.915155][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 986.915183][ C1] Call Trace: [ 986.915189][ C1] [ 986.915200][ C1] __schedule+0x16dc/0x5500 [ 986.915255][ C1] ? __pfx___schedule+0x10/0x10 [ 986.915298][ C1] schedule_rtlock+0x30/0x70 [ 986.915324][ C1] rtlock_slowlock_locked+0x35c5/0x3c20 [ 986.915375][ C1] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 986.915400][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 986.915424][ C1] ? unwind_next_frame+0x8f/0x2550 [ 986.915455][ C1] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 986.915495][ C1] ? rcu_is_watching+0x15/0xb0 [ 986.915527][ C1] rt_spin_lock+0x165/0x400 [ 986.915553][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 986.915587][ C1] __refill_objects_node+0x89/0x5b0 [ 986.915627][ C1] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 986.915657][ C1] refill_objects+0x56/0x350 [ 986.915697][ C1] __pcs_replace_empty_main+0x330/0x690 [ 986.915727][ C1] ? rt_spin_trylock+0x13a/0x2b0 [ 986.915754][ C1] __kmalloc_node_track_caller_noprof+0x62d/0x7c0 [ 986.915781][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.915809][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.915845][ C1] __alloc_skb+0x2bd/0x7a0 [ 986.915874][ C1] nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.915918][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 986.915943][ C1] process_scheduled_works+0xa8e/0x14e0 [ 986.915998][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 986.916031][ C1] ? assign_work+0x3cf/0x5d0 [ 986.916062][ C1] worker_thread+0xa47/0xfb0 [ 986.916117][ C1] kthread+0x388/0x470 [ 986.916147][ C1] ? __pfx_worker_thread+0x10/0x10 [ 986.916170][ C1] ? __pfx_kthread+0x10/0x10 [ 986.916202][ C1] ret_from_fork+0x514/0xb70 [ 986.916235][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.916267][ C1] ? __switch_to+0xc89/0x1420 [ 986.916297][ C1] ? __pfx_kthread+0x10/0x10 [ 986.916330][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.916375][ C1] [ 986.916383][ C1] task:kworker/u8:3 state:D stack:20832 pid:56 tgid:56 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 986.916438][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 986.916466][ C1] Call Trace: [ 986.916472][ C1] [ 986.916484][ C1] __schedule+0x16dc/0x5500 [ 986.916538][ C1] ? __pfx___schedule+0x10/0x10 [ 986.916581][ C1] schedule_rtlock+0x30/0x70 [ 986.916607][ C1] rtlock_slowlock_locked+0x35c5/0x3c20 [ 986.916651][ C1] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 986.916676][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 986.916700][ C1] ? unwind_next_frame+0x8f/0x2550 [ 986.916731][ C1] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 986.916769][ C1] ? rcu_is_watching+0x15/0xb0 [ 986.916801][ C1] rt_spin_lock+0x165/0x400 [ 986.916827][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 986.916859][ C1] __refill_objects_node+0x89/0x5b0 [ 986.916898][ C1] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 986.916929][ C1] refill_objects+0x56/0x350 [ 986.916969][ C1] __pcs_replace_empty_main+0x330/0x690 [ 986.916999][ C1] ? rt_spin_trylock+0x13a/0x2b0 [ 986.917028][ C1] __kmalloc_node_track_caller_noprof+0x62d/0x7c0 [ 986.917054][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.917081][ C1] ? nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.917117][ C1] __alloc_skb+0x2bd/0x7a0 [ 986.917146][ C1] nsim_dev_trap_report_work+0x2b1/0xcb0 [ 986.917190][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 986.917216][ C1] process_scheduled_works+0xa8e/0x14e0 [ 986.917271][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 986.917303][ C1] ? assign_work+0x3cf/0x5d0 [ 986.917334][ C1] worker_thread+0xa47/0xfb0 [ 986.917394][ C1] kthread+0x388/0x470 [ 986.917425][ C1] ? __pfx_worker_thread+0x10/0x10 [ 986.917448][ C1] ? __pfx_kthread+0x10/0x10 [ 986.917479][ C1] ret_from_fork+0x514/0xb70 [ 986.917513][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.917544][ C1] ? __switch_to+0xc89/0x1420 [ 986.917574][ C1] ? __pfx_kthread+0x10/0x10 [ 986.917605][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.917643][ C1] [ 986.917650][ C1] task:kworker/1:14 state:R running task stack:26224 pid:15479 tgid:15479 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 986.917715][ C1] Workqueue: events drain_vmap_area_work [ 986.917782][ C1] Call Trace: [ 986.917788][ C1] [ 986.917799][ C1] __schedule+0x16dc/0x5500 [ 986.917852][ C1] ? try_to_take_rt_mutex+0x842/0xb00 [ 986.917876][ C1] ? __pfx___schedule+0x10/0x10 [ 986.917902][ C1] ? __lock_acquire+0x683/0x2ce0 [ 986.917966][ C1] preempt_schedule_irq+0x4d/0xa0 [ 986.917993][ C1] irqentry_exit+0x14f/0x8f0 [ 986.918020][ C1] ? trace_irq_disable+0x3b/0x140 [ 986.918092][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 986.918140][ C1] RIP: 0010:lock_is_held_type+0x106/0x150 [ 986.918169][ C1] Code: 1a 00 00 b8 ff ff ff ff 65 0f c1 05 8c 5d 5a 07 83 f8 01 75 25 9c 58 a9 00 02 00 00 75 39 41 f7 c4 00 02 00 00 74 01 fb 89 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 db c7 03 00 cc 90 0f 0b 90 48 c7 [ 986.918188][ C1] RSP: 0000:ffffc90003a6f5f8 EFLAGS: 00000206 [ 986.918230][ C1] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000046 [ 986.918245][ C1] RDX: 0000000000000000 RSI: ffffffff8daf6cd8 RDI: ffffffff8bca7880 [ 986.918260][ C1] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 986.918274][ C1] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000246 [ 986.918289][ C1] R13: ffff88805fcd5d00 R14: ffffffff8e1c3000 R15: 0000000000000003 [ 986.918322][ C1] ? page_ext_get+0x22/0x2e0 [ 986.918391][ C1] page_ext_get+0x1b0/0x2e0 [ 986.918417][ C1] __reset_page_owner+0x28/0x1f0 [ 986.918464][ C1] __free_frozen_pages+0x10e7/0x11c0 [ 986.918497][ C1] ? __pfx___free_frozen_pages+0x10/0x10 [ 986.918518][ C1] ? rt_spin_unlock+0x157/0x200 [ 986.918546][ C1] ? ___free_pages+0x9a/0x1b0 [ 986.918574][ C1] kasan_depopulate_vmalloc_pte+0x6d/0x90 [ 986.918690][ C1] __apply_to_page_range+0xbd8/0x1420 [ 986.918782][ C1] ? __pfx_kasan_depopulate_vmalloc_pte+0x10/0x10 [ 986.918819][ C1] ? __pfx___apply_to_page_range+0x10/0x10 [ 986.918848][ C1] ? smp_call_function_many_cond+0x12a9/0x1650 [ 986.918915][ C1] __kasan_release_vmalloc+0xa2/0xd0 [ 986.918947][ C1] purge_vmap_node+0x220/0x960 [ 986.918976][ C1] ? reacquire_held_locks+0x104/0x190 [ 986.919009][ C1] ? __pfx_purge_vmap_node+0x10/0x10 [ 986.919035][ C1] ? on_each_cpu_cond_mask+0x62/0x80 [ 986.919060][ C1] ? flush_tlb_kernel_range+0x350/0x460 [ 986.919112][ C1] __purge_vmap_area_lazy+0x783/0xb40 [ 986.919143][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 986.919169][ C1] drain_vmap_area_work+0x27/0x40 [ 986.919192][ C1] process_scheduled_works+0xa8e/0x14e0 [ 986.919247][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 986.919279][ C1] ? assign_work+0x3cf/0x5d0 [ 986.919310][ C1] worker_thread+0xa47/0xfb0 [ 986.919350][ C1] ? __kthread_parkme+0x71/0x1f0 [ 986.919395][ C1] kthread+0x388/0x470 [ 986.919426][ C1] ? __pfx_worker_thread+0x10/0x10 [ 986.919450][ C1] ? __pfx_kthread+0x10/0x10 [ 986.919481][ C1] ret_from_fork+0x514/0xb70 [ 986.919514][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.919546][ C1] ? __switch_to+0xc89/0x1420 [ 986.919576][ C1] ? __pfx_kthread+0x10/0x10 [ 986.919607][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.919645][ C1] [ 986.919652][ C1] task:kworker/u8:23 state:R running task stack:26976 pid:21414 tgid:21414 ppid:9058 task_flags:0x8040 flags:0x00080000 [ 986.919717][ C1] Call Trace: [ 986.919723][ C1] [ 986.919735][ C1] __schedule+0x16dc/0x5500 [ 986.919783][ C1] ? clockevents_program_event+0x4bb/0x630 [ 986.919855][ C1] ? __pfx___schedule+0x10/0x10 [ 986.919896][ C1] preempt_schedule_irq+0x4d/0xa0 [ 986.919922][ C1] irqentry_exit+0x14f/0x8f0 [ 986.919948][ C1] ? trace_irq_disable+0x3b/0x140 [ 986.919975][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 986.919997][ C1] RIP: 0010:__list_add_valid_or_report+0x60/0x130 [ 986.920075][ C1] Code: 08 4c 89 e5 48 c1 ed 03 42 80 7c 2d 00 00 74 08 4c 89 e7 e8 a2 95 61 fd 4d 39 34 24 75 71 4d 89 f4 49 c1 ec 03 43 80 3c 2c 00 <74> 08 4c 89 f7 e8 86 95 61 fd 49 39 1e 0f 85 83 00 00 00 4d 39 f7 [ 986.920092][ C1] RSP: 0018:ffffc900062b7510 EFLAGS: 00000246 [ 986.920110][ C1] RAX: 0000000000000001 RBX: ffff88813ffb1d88 RCX: 0000000000000046 [ 986.920124][ C1] RDX: ffff88813ffb1d88 RSI: ffffea0001818a10 RDI: ffffea0001814210 [ 986.920140][ C1] RBP: 1ffff11027ff63b2 R08: ffffffff8b465b20 R09: 0000000000000000 [ 986.920155][ C1] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 1ffffd4000303142 [ 986.920168][ C1] R13: dffffc0000000000 R14: ffffea0001818a10 R15: ffffea0001814210 [ 986.920192][ C1] ? rt_spin_lock+0x1e0/0x400 [ 986.920227][ C1] add_partial+0x55/0xc0 [ 986.920258][ C1] __slab_free+0x21c/0x2a0 [ 986.920289][ C1] ? qlist_free_all+0x8e/0x100 [ 986.920313][ C1] qlist_free_all+0x99/0x100 [ 986.920337][ C1] kasan_quarantine_reduce+0x148/0x160 [ 986.920361][ C1] __kasan_slab_alloc+0x22/0x80 [ 986.920400][ C1] kmem_cache_alloc_noprof+0x355/0x650 [ 986.920422][ C1] ? ptlock_alloc+0x20/0x70 [ 986.920443][ C1] ? ptlock_alloc+0x20/0x70 [ 986.920471][ C1] ptlock_alloc+0x20/0x70 [ 986.920495][ C1] pte_alloc_one+0x7e/0x380 [ 986.920522][ C1] __pte_alloc+0x25/0x1a0 [ 986.920554][ C1] do_pte_missing+0x1bda/0x28f0 [ 986.920582][ C1] ? rt_spin_unlock+0x163/0x200 [ 986.920607][ C1] ? __pmd_alloc+0x41b/0x5e0 [ 986.920634][ C1] handle_mm_fault+0xd28/0x13f0 [ 986.920656][ C1] ? mt_find+0x186/0x630 [ 986.920716][ C1] ? handle_mm_fault+0xe8/0x13f0 [ 986.920740][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 986.920761][ C1] ? __lock_acquire+0x683/0x2ce0 [ 986.920809][ C1] __get_user_pages+0x166b/0x2590 [ 986.920890][ C1] get_user_pages_remote+0x307/0xb10 [ 986.920915][ C1] ? __pfx_down_read+0x10/0x10 [ 986.920947][ C1] ? __pfx_get_user_pages_remote+0x10/0x10 [ 986.920965][ C1] ? create_init_stack_vma+0x840/0x9b0 [ 986.920999][ C1] ? mmap_read_lock_maybe_expand+0xc6/0x3a0 [ 986.921049][ C1] copy_string_kernel+0x2f9/0x5f0 [ 986.921141][ C1] ? __pfx_copy_string_kernel+0x10/0x10 [ 986.921172][ C1] ? alloc_bprm+0x582/0x640 [ 986.921201][ C1] kernel_execve+0x57e/0x9c0 [ 986.921237][ C1] call_usermodehelper_exec_async+0x212/0x360 [ 986.921282][ C1] ? __pfx_call_usermodehelper_exec_async+0x10/0x10 [ 986.921311][ C1] ret_from_fork+0x514/0xb70 [ 986.921345][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 986.921383][ C1] ? __switch_to+0xc89/0x1420 [ 986.921414][ C1] ? __pfx_call_usermodehelper_exec_async+0x10/0x10 [ 986.921441][ C1] ret_from_fork_asm+0x1a/0x30 [ 986.921480][ C1] [ 986.921488][ C1] task:syz-executor state:R running task stack:25800 pid:21373 tgid:21373 ppid:1 task_flags:0x40054c flags:0x00080002 [ 986.921552][ C1] Call Trace: [ 986.921558][ C1] [ 986.921570][ C1] __schedule+0x16dc/0x5500 [ 986.921618][ C1] ? __lock_acquire+0x683/0x2ce0 [ 986.921643][ C1] ? __pfx___schedule+0x10/0x10 [ 986.921686][ C1] preempt_schedule_irq+0x4d/0xa0 [ 986.921712][ C1] irqentry_exit+0x14f/0x8f0 [ 986.921737][ C1] ? trace_irq_disable+0x3b/0x140 [ 986.921764][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 986.921786][ C1] RIP: 0010:__asan_memset+0x22/0x50