last executing test programs: 11m6.622510747s ago: executing program 32 (id=253): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x15, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000500000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bc8900000000000035090100000003009500000000000000b7080000000100007b9a00fe00000000b509ffffff1f0000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608ebff76000000bf9800000000000056080000000000008500000000000000b70000000000000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10m54.086078192s ago: executing program 3 (id=344): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040)=0x18) ioctl$SNDCTL_DSP_GETISPACE(r0, 0x8010500d, &(0x7f0000000000)) 10m53.834075501s ago: executing program 3 (id=345): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x3c, r1, 0x731, 0x70bd2d, 0x25dfdbfe, {0x38}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}]}, 0x3c}, 0x1, 0x2, 0x0, 0x4000000}, 0x0) 10m53.674070354s ago: executing program 3 (id=346): r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x1c, r0, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0xe256610c62001369}, 0x600000c0) 10m53.50627823s ago: executing program 3 (id=347): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000040)=0x80000001, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x2c, &(0x7f0000000000)={0x0, 0x0}, 0x10) 10m53.11890175s ago: executing program 3 (id=349): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) fcntl$notify(r0, 0x402, 0x8000000b) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) 10m52.905046367s ago: executing program 3 (id=351): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4098}, 0x200080d4) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800a0001006d6174636800c9211c0002800800024000000002080003000000000008000100736574"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) 10m37.847232872s ago: executing program 33 (id=351): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4098}, 0x200080d4) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800a0001006d6174636800c9211c0002800800024000000002080003000000000008000100736574"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) 7m39.269932319s ago: executing program 2 (id=2521): mkdir(&(0x7f0000000040)='./myproc\x00', 0x1ef) mount(0x0, &(0x7f0000000080)='./myproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./myproc/scsi/device_info\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 7m38.783108509s ago: executing program 2 (id=2522): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x10, 0x3, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x66, 0x0, 0x4, 0x0, 0x0, @multicast2, @multicast2, {[@noop]}}}}}) 7m38.692533327s ago: executing program 2 (id=2524): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000080000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x12, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000791838000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 7m38.678833598s ago: executing program 2 (id=2526): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 7m38.555575201s ago: executing program 2 (id=2528): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x40000023, 0xed, 0xd7}]}) 7m35.573071543s ago: executing program 2 (id=2534): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) 7m35.141582925s ago: executing program 34 (id=2534): r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) read$FUSE(r0, &(0x7f0000004800)={0x2020}, 0x2020) 4m11.883542205s ago: executing program 5 (id=5011): mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@nr_inodes={'nr_inodes', 0x3d, [0x31]}}]}) chdir(&(0x7f0000000140)='./file0\x00') symlink(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 4m11.882419936s ago: executing program 5 (id=5014): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x9c, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0xa0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0xa0}}, 0x0) 4m11.795471199s ago: executing program 5 (id=5015): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, 0x0) 4m11.673841732s ago: executing program 5 (id=5017): mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x911091, 0x0) chroot(&(0x7f0000000040)='./file0/file0\x00') mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x2125099, 0x0) 4m11.615530347s ago: executing program 5 (id=5019): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x82, 0x5, 0x6, 0x0, 0x0, 0x7, 0x0, 0x4b, 0xf7, 0x4, 0x6, 0x0, 0x0, 0x1, 0xb, 0x0, 0xf, 0x8, 0xfd, '\x00', 0x2, 0xb4}) 4m11.345373476s ago: executing program 5 (id=5023): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(r0, &(0x7f0000003cc0)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_retopts={{0x10, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x33, 0x0, 0x6}]}}}], 0x10}}], 0x1, 0x50008000) write$binfmt_misc(r0, &(0x7f0000000300), 0xfdef) 4m11.188595247s ago: executing program 35 (id=5023): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(r0, &(0x7f0000003cc0)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000080)=[@ip_retopts={{0x10, 0x0, 0x7, {[@timestamp={0x44, 0x4, 0x33, 0x0, 0x6}]}}}], 0x10}}], 0x1, 0x50008000) write$binfmt_misc(r0, &(0x7f0000000300), 0xfdef) 2m17.633931329s ago: executing program 4 (id=7349): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = msgget$private(0x0, 0x193) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) msgsnd(r0, &(0x7f0000000d40)=ANY=[@ANYBLOB="03"], 0x3f9, 0x0) 2m17.560855312s ago: executing program 4 (id=7351): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x14, 0xa, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000) 2m17.460513399s ago: executing program 4 (id=7353): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000080), 0x4) sendmsg$802154_dgram(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40c0) 2m17.458980453s ago: executing program 4 (id=7354): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="05000000020800"/16, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="0000004001"], 0x80}, 0x1, 0x0, 0x0, 0x200000d0}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="05000000900f0000000000000000e4ff", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="000000400100"], 0x80}}, 0x4044) 2m17.39750217s ago: executing program 4 (id=7357): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) rename(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000100)='./file0\x00') 2m17.386250547s ago: executing program 4 (id=7359): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000100)={&(0x7f00000001c0)={0xa, 0x4e23, 0x80000, @loopback, 0xfffffffe}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="28000000000000007e31d8f12648b1b0ff020251000000000000000000000000000000000000000018"], 0x40}, 0x14090) 2m2.348400481s ago: executing program 36 (id=7359): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000100)={&(0x7f00000001c0)={0xa, 0x4e23, 0x80000, @loopback, 0xfffffffe}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="28000000000000007e31d8f12648b1b0ff020251000000000000000000000000000000000000000018"], 0x40}, 0x14090) 1m13.01163678s ago: executing program 1 (id=8629): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000009c0), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000a00)={@my=0x1}) 1m12.521370668s ago: executing program 1 (id=8639): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) timer_settime(0x0, 0x0, &(0x7f0000000500)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0x100000c01, 0x61, 0x0, 0x0, 0x6e}) 1m12.37279394s ago: executing program 1 (id=8648): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x10, 0x0, &(0x7f00000006c0)=[@acquire, @decrefs], 0x0, 0x0, 0x0}) 1m12.311433161s ago: executing program 1 (id=8650): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 1m12.244275288s ago: executing program 1 (id=8651): mkdir(&(0x7f0000000400)='./file1\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000100)='./file1\x00', &(0x7f0000000080), 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=virtio,access=', @ANYRESDEC=r0]) stat(&(0x7f0000000300)='./file1\x00', 0x0) 1m11.424702981s ago: executing program 1 (id=8655): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xb}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x60}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) 1m11.396350252s ago: executing program 37 (id=8655): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xb}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x60}, 0x1, 0x0, 0x0, 0x40080a5}, 0x20008040) 32.444397087s ago: executing program 7 (id=9262): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="000000f5"], 0xa) 32.304261369s ago: executing program 7 (id=9267): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x4, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 32.213623266s ago: executing program 7 (id=9269): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./myconfig\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/acm.0\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/acm.0\x00', 0x200) 32.094896305s ago: executing program 7 (id=9271): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r0], 0x4c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 32.094514794s ago: executing program 7 (id=9273): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)="2a20000000df", 0x6) 32.014529234s ago: executing program 7 (id=9274): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x3, 0x4, 0x10000, 0x4}, 0x1c) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) 22.00416644s ago: executing program 8 (id=9352): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x2c, r2, 0xa11, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x9}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 21.98014892s ago: executing program 8 (id=9353): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x3, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x3, [{0xd, 0x5}]}]}, {0x0, [0x0]}}, 0x0, 0x2f}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x279, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 21.862914689s ago: executing program 8 (id=9354): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, 0x0) 16.748414961s ago: executing program 38 (id=9274): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x3, 0x4, 0x10000, 0x4}, 0x1c) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x34) 16.258908674s ago: executing program 8 (id=9368): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x40440, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0x1, 0x0, 0x7, 0x5, 0x8, 0xffffffff, 0x7}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x48e, 0x0, 0x40}]}) 16.093598053s ago: executing program 8 (id=9374): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)='\x00\x00', 0x2) 15.979850148s ago: executing program 8 (id=9385): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd(0x84) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) 4.546601074s ago: executing program 0 (id=9457): openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, 0xffffffffffffffff, 0x1000) r0 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r0, 0xc0404807, 0x0) 4.194275028s ago: executing program 0 (id=9465): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x4b564d01, 0x0, 0x1}]}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) 1.079617276s ago: executing program 6 (id=9473): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000740)={@void, @void, @eth={@empty, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @val={@val={0x88a8, 0x5, 0x1, 0x3}, {0x8100, 0x5, 0x1, 0x6}}, {@ipv6={0x86dd, @tcp={0x7, 0x6, '\x00', 0x14, 0x6, 0xff, @private2, @mcast1, {[], {{0x4e1e, 0x4e64, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x80, 0x100, 0x0, 0x8000}}}}}}}}, 0x52) 1.075321222s ago: executing program 0 (id=9474): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x9000001c}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) 960.407631ms ago: executing program 39 (id=9385): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000038c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd(0x84) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) 887.253939ms ago: executing program 6 (id=9481): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@mcast2, @local, @local, 0x1, 0x6, 0x0, 0x100, 0x4, 0x540000, r1}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0, 0x0, 0x6, 0x0, 0x100, 0x6, 0x2, r1}) 790.102416ms ago: executing program 6 (id=9484): mkdir(&(0x7f0000000100)='./mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='stm32g0-typec 0x3', 0x11) openat(0xffffffffffffff9c, &(0x7f0000000700)='./mnt/bus/i2c/devices/i2c-1/new_device\x00', 0x1, 0x0) 743.000702ms ago: executing program 6 (id=9485): writev(0xffffffffffffffff, &(0x7f0000002240)=[{&(0x7f0000001080)="c668bc73132a5aff44007b4c6d094f35aa81232a24322f9a2e17f70cee940719931013c005507377fee4f043a0f28a06f967f2518ab10d48491095ae200186e299ed832ae337fcab1b77d6e0c96cc2db5972513e3c7edf72af0e0d4573516255dcf83c095688ed997dfab04ee615fedb0482d7e5b897d4fd9948a79a3735e881294ff3d907115e710eab3ec4855e98e2fbc8f62ac9c7adbe2c58cd83d7fca435224904cbc0079aad731bc992fb7bc4341a72b71b94693ef84edc09f9b7c2331d8561141b3fb9dc3875f08688fd2f952b6ac67e32f4a5b3022370ddab3ba9f6d3a11c30d52bee1158d3b4ecc517c6254eb00a89c99ab0807125b4c2097071a920077cf3a923788c29ddd4551a67de22174dc169fbf920f982e97ed9f29dabd2652775a64d65f1b4622a1071e63be6501f0fcdf2e00b804a26a35b2e01a9a08825ea2eeea98db7adfb5b68d05bd1f9c202368f60f4e955283cbd108c3ed933c3f7fe406e65849b0e15b398d06e677a5b99f831fbdeb54f07076e136a10efaba02a0fa740f9e0b60811bb141f06e3e5bedaba3d6c79b4d76e30b40ab6a707b96c3c608881d803d1fb21eb63054811232c8f59d9f3fa8ebf29a756c9217326bbb3697f1fa373401d2dbc53f2d4e61f40dd9ecc27c98108a2e1e08a8e8731e6836a816911a8f53ee9fb742899f7d7887c13d85e28f7c6f5e014b74ee89040d6ae4d61cf1a620204ded033a3bdd16e9e9841bd39ec4db9ba42ce16453f3dd1b6f21b2d048fba16448fd8bc8fe8d67ba0d55f936a35fce819f49f581f8db2d54ffa08985c78cd3a6199d018224d05aac1211a59b7149f51c2dc37ef04415510dc07ce896af202741e44556d3c395cfa4828696d78216b9397b4353d2daaa4be026e93eeaa0bf1012f28c706eb5f560a037ab1999202f9cbabedfe522250c33f0869c758c73d684fb1b08289a78aea8014c995c5aeb2c7be56e243aa2ff9a879997478098896e249827b58a7a2061807892497b7eb56055c0b141ac704fa8d0b1c08c107edbf00d0936614ef8bc8520d8f7e65664a603c71bceba727ccf51ccfd32cb1352263f4b7cd908d87d3187b8cbc9ae267d48736f66b43d61f10acb78931d1b6c61e4d088c73967a4406ccc73b004b1e86f382c2afbbf891fb2d6d94112497a801af9b0b27d72a4c730c0c53c99b7449b8a2e64168eae10bf6cce557751b6b4221d5abbec2c94e0614c45a5bbceffe1e1c4ad4edfc9418c63feb162bfaa51b8e91e21f6ed0844c17604d9f91e0a4528da2bb9cebfd81794f6a611a6000ab8b9f9bc780ab868259e85abbf2ac9439cb6bfde7283152a5d9ed409934c9c3b4d7c193061d184b5965f8f642ff6710f3f50d703a847498988a83c6ba0c1707b3294fa65f2c50e5121426d5dc240171f1dae27b455a39b5a80196c8fa416f5ac6fcbac6eecb383f42b80c938ad13e2ef200bc0b0f155d8376f738e351f48ca1476f03618677fa761399ff2912e593d6c90f6f82eee8cf102f547604d28efdadbe6acd87979b780098b66dba9524441d8d37700729a6610107ebe29b5c9d4d2a77e8d619d304e84546bb15aeb39e54f50e5d287b0e2264780497654c53022b11af0a2b23ac05ea328c6dd55627c191ccd004aef9c7de0888c424a537ee0074e0dbacebea1a89d74c97529272b867c42222c6e457b067d26d63b949ed9b1103889b0754d6efea9c5096fb472979f62e11ec1d4539b471b0af008fa225a1e7bd697e86e3b87c2c85a3c060906f2611171a8264c2e2a859f7fcd3116749269f6309dab832aab9ada9ea652a8b3e53e4c183245bc26979b58a8f2286623b8c334bd8a36b0a45a1f15ee0ffcf9edaea69fc15c6df27efb88cd3058b2e6004249ff0afdf8b165d42efb86377434402cc249b8d2c24d017e7d30d35eb40de39b0b1f418493e6d926b1d5e2f929473b5b4d7290ac45a4faaa009fb54881cda265a6b2785c7c42347c916afd80f7fdb6b181a3d2c5dcd901fa66eb4a62b1e6802c4bcd2b66479065e94d206dfb21197b24341ca105525658dd15cf1c22ea2485e580fdde08d64e8ba036e299bbc6acd0d48f7cdf287ba249eaadde631695c3a3240a4f0d32d7baf2759224235fc17eff0c432c761bc0c299f556829071d10caf1898612c3a621008a6353df7a55bb6b223cd2339cd446b619d2eb004fc4526a25731ca7755be5eec9879101e3f41a7ca43bf3433ecdb1dc44c9168af76a829659e60171af3e1685871b0972e61ab2043c282510e289c2065cb77ca461640e0b3e433c7f618ae7ebbfe31f1350edf8d3680befe0e718064a7ca8c9a1d526ca78c4aa4079717ac8bcd6219a800eed8746ec0bed42f1943647122f9927df2c8683adfa16c8fc972a5428bb1e6e4d5d98d8fd2708d960edd4802f05f6d40eca95adf44f916c42f92b3e3892baa1387d4451fcfdac05eb3db6e0f6dd67e62e3222b6211073097cfcb2ded0a49510729e3eb362f4d171c1d8dc75760661ab0759a14eddf13913a30ea7f744292cb5c05aaf8283584ea835898b79b1f135c143349fa906333f5bcfa4291da6036f3b964a0b7ce31ba12e9493a01fa33a3741027397401d8cf85dc2c5b16959714fba4a58fbf1bc6bfe1cf31401f82ee0130545f781fb2adb8b2feb9bbc6cc00961660a8bf04d5f2205c0a3bd4c5064756dae35d64f34609c56c78352224ceb6e07a9a0a4c4a5632da6553f50a1b87463f5a00b3c4e8c6a8cfc9d217cab948a02e8fc9f22718850d295a4f52168423cfbc8535a8d3bd188af1b21239f5b67ec4d632666a33e4a61cb789b319c49d6de428d0e2a55576aac682532ccb061fea90d8c40f6ae0e8dcf3c4ea0664a8dd1843f593b3b910740771fc788d53ade3a0a490d405d18f153921fbb4969c87335c8a01beee463a20edb93362e369a71457c1f1bd07ead02adf1fe0132e38ac8c8c783eaa0a4f3853ebc880c755b0f42c878c67d6d3d1963880550545a19cfee51bec19b57d75b22ec7b427ec1c214158c5b81c08d5b0062a338fd0f28033251d53fab0ab12b5df515c07bca7b1b89ac16d8f57751a34f53f46f53e09595342f671502f8ff14223b1e8b659e569456d529d37ed5dbbabd418bb4909dde26e383074b06a74961ad2eafcc8d51f72edc0c27255b0f18415260a4dd7890023a2ae9d70fb5ee394c301b02f4a144e915f95820f879c39cfcb29b44759aaa17c703f8732e42346b6c7c31bb88e5044a37919eb58ca2ada699d36905677ff82776a9bb0e40001d1b0bf2c5e5a3248bfd429507acc78242536c28b59f0c8898216ced7a6823e4064a03a06323bd65077e2f9568996c5d945d3fe2a6e7338ef9cd4d3784b9ced97184c6df6841793f64f768c0c6327aeb775cb186dea645c9ebb34a4e8dc67d904304c1fbaa69d77859dfcc2c4ff7d9afe7a0fb37d9d83061aa5f0ebca84f510f3779c43b90718168b0a35a469e89d965bc43570f14f7898981916b954e030ae7841ad33cb96c6740bf8979e2504311ad6db1d551fb8dd2d14df5b47b2d719d920a44ef9186c141343f14555d76d545165f8ede11d57f309bf78439b7b1cd83ed1acfd94b3e06d07137cc9372978276173fd48ede04828e1d89f96c9fd3dab155f60833d4a5f2b483a11cc7d110a75ba42683be493d26b11bbfbc9a8c6be5ef55916ca9c492610731ba64d2cdec2375af24fcf8112e325f0c056dc9bc67ecd8c599cfee46231d06fa16cf072c728e02db1ace9cb833fb613588cec0dcf58fd295da5bbf5495b9397bf8224dbc930ae69961c2b1c3a89c67d9aa3c6a95f4177bc3508b94817696613dd6066f51842015ce7d749328c396c1d5c3ca7248975d4b74bd939e7afc8f3a074b44a68021aa85ca74df1b36dff1697668c3bbcab88fee1b5e990fca66bb099d4d697e6091056714e3ae944285f61421c9d54885c58cd73d1574b1192f61e4cff28bda0fe0854b59c9d58c1ad6f3976d4f5eb0167ae3891d61a081bd8dd10fe014b8d679c7f836c06e385a9479826a4585db46b0a8205c4add73b4da4c32c8f505d4b6f2ac635fb2f28d1e450808fbb2488267ca411a66a91b91782acdb61864573dff6772f48f866c32a2584b8b9dff228d78c33ab28f20f725c1629ed61fed32cb63c789bd1114e9468474", 0xb85}], 0x1) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001c00)) 701.75388ms ago: executing program 6 (id=9487): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008002b00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 518.140717ms ago: executing program 6 (id=9491): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, 0x0, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, 0x0) 424.463518ms ago: executing program 9 (id=9492): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000002d80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000002dc0)=ANY=[@ANYBLOB="100000001701000004000000ffffffffc40000001701000002000000b4000000af03048e23c2436d397dc10b18c5e619b8a72547545d5479f3330470ef97eb11c67677391f074684f73bd6a76d344e5e354b5c74bc74b160c5642a352575a68748c21aa2ad68ff358d770a7f7cc88cfee7d32538a769ed68a3d6061d7995d19ba82575f123dabd656ddf883c480c1eb48650b6c759d078de4b3b68e02c1ef309570a61e1cd0d28a96ca036358156f56db81dc2aa0439f2fe836574d5b615cb673d63a5814425f723da930e1d72026bc3ef29fd9e10000000170100000400000007000000100000001701000003000000010000002400000017010000020000001100000079c4d645be46be97ef961ce783b8a659b100000010000000170100a2ffd945000000000010000000170100000400000000000000100000001701000004000000010000008800"], 0x1d0, 0x40000}], 0x1, 0x240008d1) 424.055433ms ago: executing program 9 (id=9493): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$unix(r1, &(0x7f0000000f80)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000f00)=[@cred={{0x18, 0x1, 0x2, {0x0, 0x0, 0xee01}}}], 0x18, 0x8000}}], 0x1, 0x0) 363.857025ms ago: executing program 9 (id=9494): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getpid() ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f0000000180)) 243.432065ms ago: executing program 9 (id=9495): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x10, 0x0, 0x8001786}]}) 158.751535ms ago: executing program 0 (id=9496): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e1d, 0x4, 0x0, 0x0, 0x2, 0x0, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x8, 0xfffffffffffffffe}, {0x2, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe4) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 154.73574ms ago: executing program 9 (id=9497): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="034886dd01000000000014000000600000000028"], 0xfdef) 13.281477ms ago: executing program 0 (id=9498): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f00000000c0)='./file0\x00', 0x100) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) lremovexattr(&(0x7f0000000040)='./file0/file1\x00', &(0x7f0000000080)=@random={'security.', 'system.posix_acl_access\x00'}) 2.936162ms ago: executing program 0 (id=9499): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSET={0x204, 0xb, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0xd}, @NFTA_SET_DESC={0x1e8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0xb8, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffff8001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x724}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x4}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_DESC_CONCAT={0x114, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb387}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xe}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x22cd}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x800}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x22c}, 0x1, 0x0, 0x0, 0x800}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 9 (id=9500): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="98000000", @ANYRES16=r1, @ANYBLOB="19922dbd7000fddbdf250100000008000100", @ANYRES32=r3, @ANYBLOB="7c0002806a000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000b"], 0x98}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 0s ago: executing program 0 (id=9501): syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read(r0, &(0x7f0000000380)=""/144, 0x90) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x40, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) kernel console output (not intermixed with test programs): wn main item tag 0x0 [ 651.018551][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.024142][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.027470][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.031692][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.036087][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.038483][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.042273][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.047720][ T3263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 651.052733][ T3263] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [Zw[ba|\rn)A#6oү?aIs5hV3(; [ 651.052733][ T3263] ѝP$zɷX$w[SRezxuSrl[5l'ZCz2] on tDKY縣Ϫ򞿹,UOp{"ixA[ewÒ}ZXA [ 651.075155][T22985] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 651.079362][ T5844] team_slave_0: entered promiscuous mode [ 651.084666][ T5844] team_slave_1: entered promiscuous mode [ 651.107174][T22988] fido_id[22988]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 651.119246][T22993] vivid-000: disconnect [ 651.142311][T22986] vivid-000: reconnect [ 651.150149][T22996] netlink: 52 bytes leftover after parsing attributes in process `syz.7.7198'. [ 651.151139][T22997] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7197'. [ 651.161928][T22997] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7197'. [ 651.199325][T23001] CIFS: Attempting to mount //127.0.0.1/share [ 651.224016][T23007] openvswitch: netlink: Actions may not be safe on all matching packets [ 651.364827][T23011] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 651.376374][T23011] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 651.380526][T23011] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 651.425707][T23011] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 651.561294][T23035] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7216'. [ 651.767962][T23043] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 651.776436][T23043] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 651.799810][T23043] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 651.854467][T23056] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 651.857426][ T5864] team_slave_0: entered promiscuous mode [ 651.859281][ T5864] team_slave_1: entered promiscuous mode [ 652.044978][T23001] CIFS: VFS: Error connecting to socket. Aborting operation. [ 652.047859][T23001] CIFS: VFS: cifs_mount failed w/return code = -4 [ 652.070855][T23064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7231'. [ 652.212735][T23070] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 652.216413][T23070] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 652.218882][T23070] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 652.280548][T23088] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 652.286083][T23088] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 652.357413][T23098] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7245'. [ 652.396971][T23104] netlink: 'syz.1.7247': attribute type 1 has an invalid length. [ 652.401479][T23104] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.7247'. [ 652.405114][T23104] netlink: 'syz.1.7247': attribute type 1 has an invalid length. [ 652.408279][T23104] netlink: 2016 bytes leftover after parsing attributes in process `syz.1.7247'. [ 652.511539][T23111] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7248'. [ 653.600200][T23178] misc userio: Can't change port type on an already running userio instance [ 653.813501][ T5910] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 653.973433][T23203] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7287'. [ 653.974702][ T5910] usb 6-1: not running at top speed; connect to a high speed hub [ 653.980689][ T5910] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 653.985646][ T5910] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 653.991017][ T5910] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.253571][T17098] Bluetooth: hci3: command 0x2016 tx timeout [ 654.253634][ T5766] Bluetooth: hci2: command 0x0c1a tx timeout [ 656.333740][T17098] Bluetooth: hci3: command 0x2016 tx timeout [ 656.343534][T17098] Bluetooth: hci2: command 0x0c1a tx timeout [ 656.565888][ T3263] usb 6-1: USB disconnect, device number 17 [ 656.595193][ T42] kauditd_printk_skb: 1009 callbacks suppressed [ 656.595209][ T42] audit: type=1326 audit(1785494244.302:1473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23247 comm="syz.7.7308" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x0 [ 656.693100][T23262] netlink: 'syz.1.7312': attribute type 2 has an invalid length. [ 656.697212][T23262] netlink: 'syz.1.7312': attribute type 11 has an invalid length. [ 656.699786][T23262] __nla_validate_parse: 3 callbacks suppressed [ 656.699795][T23262] netlink: 88 bytes leftover after parsing attributes in process `syz.1.7312'. [ 657.424908][T23248] ceph: No mds server is up or the cluster is laggy [ 657.656523][ T42] audit: type=1800 audit(1785494245.362:1474): pid=23307 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.7332" name="bMaxPacketSize0" dev="configfs" ino=97590 res=0 errno=0 [ 657.659582][T23313] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7334'. [ 657.685609][T23310] pci 0000:00:04.0: PCI bridge to [bus 01] [ 657.696260][T23310] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 657.704870][T23310] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 657.709996][T23310] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 657.768090][T23318] program syz.1.7337 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 657.821663][T23322] pimreg: tun_chr_ioctl cmd 1074025672 [ 657.824822][T23322] pimreg: ignored: set checksum disabled [ 658.168466][T23354] ieee802154 phy0 wpan0: encryption failed: -126 [ 658.170468][T23355] base or size exceeds the MTRR width [ 658.326572][T23367] comedi comedi0: Minor 3 could not be opened [ 658.414010][T17098] Bluetooth: hci3: command 0x2016 tx timeout [ 659.603516][ T5910] usb 11-1: new high-speed USB device number 11 using dummy_hcd [ 659.754222][ T5910] usb 11-1: too many configurations: 9, using maximum allowed: 8 [ 659.768549][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.772421][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.778846][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.782153][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.788129][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.790562][T23411] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7380'. [ 659.797107][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.810676][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.816425][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.818537][T23413] syz.7.7381 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 659.820912][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.829808][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.833928][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.838554][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.842723][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.847686][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.852556][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.855957][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.858980][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.862983][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.868788][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.873606][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.877896][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.881387][ T5910] usb 11-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 659.884760][ T5910] usb 11-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 659.888325][ T5910] usb 11-1: config 0 interface 0 has no altsetting 0 [ 659.892109][ T5910] usb 11-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 659.895831][ T5910] usb 11-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 659.898698][ T5910] usb 11-1: Product: syz [ 659.900479][ T5910] usb 11-1: Manufacturer: syz [ 659.902334][ T5910] usb 11-1: SerialNumber: syz [ 660.170656][T23439] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7392'. [ 660.217768][T23442] nbd: nbd7 already in use [ 660.287645][ T42] audit: type=1800 audit(1785494247.992:1475): pid=23447 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.7396" name="manufacturer" dev="configfs" ino=98885 res=0 errno=0 [ 660.415497][T23455] vhci_hcd vhci_hcd.0: remove, state 4 [ 660.417306][T23455] usb usb38: USB disconnect, device number 1 [ 660.450461][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.452591][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.455667][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.458261][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.460391][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.462579][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.470325][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.472496][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.475125][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.477693][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.479839][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.482027][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.490264][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.492517][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.495096][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.497671][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.499868][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.502064][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.503761][T17098] Bluetooth: hci3: command 0x2016 tx timeout [ 660.508849][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.511150][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.513547][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.518102][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.520266][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.522482][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.525187][T23455] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 660.537145][T23455] vhci_hcd vhci_hcd.0: remove, state 4 [ 660.539323][T23455] usb usb37: USB disconnect, device number 1 [ 660.579592][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.583615][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.585901][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.588513][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.590667][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.592878][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.595746][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.597937][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.599886][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.602312][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.605331][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.607598][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.610072][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.612222][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.618638][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.620700][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.622485][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.625645][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.627615][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.629300][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.631236][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.633874][ T5834] vhci_hcd vhci_hcd.0: stop threads [ 660.636015][ T5834] vhci_hcd vhci_hcd.0: release socket [ 660.638079][ T5834] vhci_hcd vhci_hcd.0: disconnect device [ 660.640332][T23455] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 661.918530][T23482] netlink: 72 bytes leftover after parsing attributes in process `syz.7.7420'. [ 662.006048][T23487] FAULT_INJECTION: forcing a failure. [ 662.006048][T23487] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 662.011228][T23487] CPU: 3 UID: 0 PID: 23487 Comm: syz.1.7414 Tainted: G L syzkaller #0 PREEMPT(full) [ 662.011253][T23487] Tainted: [L]=SOFTLOCKUP [ 662.011258][T23487] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 662.011269][T23487] Call Trace: [ 662.011288][T23487] [ 662.011295][T23487] dump_stack_lvl+0x100/0x190 [ 662.011381][T23487] should_fail_ex.cold+0x5/0xa [ 662.011415][T23487] _copy_from_user+0x2e/0xd0 [ 662.011444][T23487] get_old_timespec32+0x82/0x130 [ 662.011473][T23487] ? __pfx_get_old_timespec32+0x10/0x10 [ 662.011497][T23487] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 662.011522][T23487] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 662.011546][T23487] __ia32_sys_futex_time32+0x1cc/0x470 [ 662.011578][T23487] ? xfd_validate_state+0x129/0x190 [ 662.011600][T23487] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 662.011628][T23487] __do_fast_syscall_32+0xe7/0x970 [ 662.011658][T23487] do_fast_syscall_32+0x32/0x70 [ 662.011678][T23487] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 662.011704][T23487] RIP: 0023:0xf7f43fec [ 662.011725][T23487] Code: Unable to access opcode bytes at 0xf7f43fc2. [ 662.011732][T23487] RSP: 002b:00000000ffebbf8c EFLAGS: 00000202 ORIG_RAX: 00000000000000f0 [ 662.011748][T23487] RAX: ffffffffffffffda RBX: 00000000f7404f8c RCX: 0000000000000080 [ 662.011759][T23487] RDX: 0000000000000000 RSI: 00000000ffebc128 RDI: 0000000000000000 [ 662.011768][T23487] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000000000000000 [ 662.011777][T23487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 662.011786][T23487] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 662.011807][T23487] [ 662.375753][ T29] usb 11-1: USB disconnect, device number 11 [ 662.795989][ T42] audit: type=1326 audit(1785494250.502:1476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23485 comm="syz.7.7415" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7fc00000 [ 663.182445][ T60] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 663.449354][ T60] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 663.957594][T23528] ceph: No mds server is up or the cluster is laggy [ 663.965474][ T60] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 664.763767][ T60] usb 11-1: new low-speed USB device number 12 using dummy_hcd [ 664.925799][ T60] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 664.933193][ T60] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 664.940933][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 664.946793][ T60] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 664.951039][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 664.954860][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 664.958437][ T60] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 664.962919][ T60] usb 11-1: config 168 interface 0 has no altsetting 0 [ 664.970496][ T60] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 664.973011][ T60] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 664.977269][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 664.980774][ T60] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 664.984941][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 664.988557][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 664.992328][ T60] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 664.996743][ T60] usb 11-1: config 168 interface 0 has no altsetting 0 [ 664.999884][ T60] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 665.002265][ T60] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.006207][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.009785][ T60] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.015670][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.019440][ T60] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.023007][ T60] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.030661][ T60] usb 11-1: config 168 interface 0 has no altsetting 0 [ 665.035458][ T60] usb 11-1: string descriptor 0 read error: -22 [ 665.037551][ T60] usb 11-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 665.040493][ T60] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.308190][T23583] Bluetooth: hci4: Frame reassembly failed (-84) [ 667.373717][ T5766] Bluetooth: hci4: command 0x1003 tx timeout [ 667.373750][T17098] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 667.507228][ T5903] usb 11-1: USB disconnect, device number 12 [ 673.464006][ T5766] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 673.474907][ T5766] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 673.482125][ T5766] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 673.486261][ T5766] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 673.489890][ T5766] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 673.564346][T23608] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7469'. [ 673.583962][T23614] netlink: 68 bytes leftover after parsing attributes in process `syz.7.7471'. [ 673.757762][T23639] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 673.760011][T23639] IPv6: NLM_F_CREATE should be set when creating new route [ 673.762186][T23639] IPv6: NLM_F_CREATE should be set when creating new route [ 673.770441][ T1168] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 673.779229][T23639] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 674.000583][T23600] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.006902][T23600] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.010293][T23600] bridge_slave_0: entered allmulticast mode [ 674.015048][T23600] bridge_slave_0: entered promiscuous mode [ 674.020127][T23600] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.023263][T23600] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.026968][T23600] bridge_slave_1: entered allmulticast mode [ 674.031460][T23600] bridge_slave_1: entered promiscuous mode [ 674.064657][T23600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 674.076597][T23600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 674.102856][T23600] team0: Port device team_slave_0 added [ 674.107082][T23600] team0: Port device team_slave_1 added [ 674.123047][T23600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.125639][T23600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.135732][T23600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.142457][T23600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 674.145730][T23600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 674.156531][T23600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 674.199740][T23600] hsr_slave_0: entered promiscuous mode [ 674.203023][T23600] hsr_slave_1: entered promiscuous mode [ 674.206168][T23600] debugfs: 'hsr0' already exists in 'hsr' [ 674.208861][T23600] Cannot create hsr debugfs directory [ 674.338051][T23675] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7494'. [ 674.407549][T23600] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 674.421251][T23600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 674.425528][T23600] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 674.433091][T23600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 674.437032][T23600] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 674.441853][T23600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 674.445567][T23600] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 674.455908][T23600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 674.494815][T23600] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.497227][T23600] bridge0: port 2(bridge_slave_1) entered forwarding state [ 674.499569][T23600] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.501788][T23600] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.507792][T23693] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7499'. [ 674.556614][T23600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 674.573849][ T41] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.590238][ T41] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.612864][T23600] 8021q: adding VLAN 0 to HW filter on device team0 [ 674.624123][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.627530][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.633836][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.636193][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 675.005782][T23600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 675.157628][T23742] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7514'. [ 675.236020][T23600] veth0_vlan: entered promiscuous mode [ 675.249560][T23600] veth1_vlan: entered promiscuous mode [ 675.271368][T23600] veth0_macvtap: entered promiscuous mode [ 675.276118][T23600] veth1_macvtap: entered promiscuous mode [ 675.292391][T23600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 675.301683][T23750] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7518'. [ 675.307228][T23600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 675.365132][T16669] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.373041][T16669] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.380446][T16669] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.388518][T16669] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.391134][ T5766] Bluetooth: hci3: command 0x2016 tx timeout [ 675.470974][ T1168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.474019][ T1168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.501975][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.504722][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.563567][T23381] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 675.623599][ T5766] Bluetooth: hci4: command tx timeout [ 675.715476][T23381] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 675.719104][T23381] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 675.723127][T23381] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 675.727036][T23381] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 675.732886][T23381] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 675.736701][T23381] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 675.739633][T23381] usb 6-1: Product: syz [ 675.741065][T23381] usb 6-1: Manufacturer: syz [ 675.779546][T17098] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 675.883815][ T5903] usb 12-1: new high-speed USB device number 7 using dummy_hcd [ 676.043752][ T5903] usb 12-1: Using ep0 maxpacket: 8 [ 676.050537][ T5903] usb 12-1: unable to get BOS descriptor or descriptor too short [ 676.058505][ T5903] usb 12-1: no configurations [ 676.060476][ T5903] usb 12-1: can't read configurations, error -22 [ 676.524650][T23785] block nbd11: Unsupported socket: should be TCP or UNIX. [ 677.243649][ T5869] kernel write not supported for file bpf-map (pid: 5869 comm: kworker/0:5) [ 677.525128][ T5869] usb 12-1: new full-speed USB device number 9 using dummy_hcd [ 677.598646][T23858] overlayfs: upper fs does not support tmpfile. [ 677.675445][ T5869] usb 12-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 677.679804][ T5869] usb 12-1: config 0 interface 0 has no altsetting 0 [ 677.686985][ T5869] usb 12-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 677.691076][ T5869] usb 12-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 677.693598][T17098] Bluetooth: hci4: command tx timeout [ 677.694921][ T5869] usb 12-1: Product: syz [ 677.698429][ T5869] usb 12-1: Manufacturer: syz [ 677.700619][ T5869] usb 12-1: SerialNumber: syz [ 678.143540][ T5910] usb 11-1: new high-speed USB device number 13 using dummy_hcd [ 678.293705][ T5910] usb 11-1: Using ep0 maxpacket: 8 [ 678.297779][ T5910] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 678.302522][ T5910] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 678.308605][ T5910] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 678.312795][ T5910] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 678.317511][ T5910] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 678.323911][ T5910] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 678.328457][ T5910] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 678.350001][ T3263] usb 6-1: USB disconnect, device number 18 [ 679.668541][T23943] gretap0: entered promiscuous mode [ 679.773966][T17098] Bluetooth: hci4: command tx timeout [ 680.300021][ T5869] usb 12-1: USB disconnect, device number 9 [ 680.403353][T23961] netlink: 24 bytes leftover after parsing attributes in process `syz.7.7611'. [ 680.543939][ T5545] kernel read not supported for file /dsp1 (pid: 5545 comm: kworker/2:3) [ 680.930670][ T5430] usb 11-1: USB disconnect, device number 13 [ 680.942845][T23989] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 680.945027][T23989] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 681.049880][T24000] bond3: invalid ARP target 0.0.0.0 specified for addition [ 681.052929][T24000] bond3: option arp_ip_target: invalid value (0) [ 681.065781][T24000] bond3 (unregistering): Released all slaves [ 681.155456][T24012] netlink: 'syz.8.7635': attribute type 2 has an invalid length. [ 681.158867][T24012] netlink: 4 bytes leftover after parsing attributes in process `syz.8.7635'. [ 681.616768][T24033] overlayfs: upper fs does not support tmpfile. [ 681.863854][T17098] Bluetooth: hci4: command tx timeout [ 682.291411][T24077] W [ 683.035906][ T5545] IPVS: starting estimator thread 0... [ 683.134157][T24103] IPVS: using max 43 ests per chain, 103200 per kthread [ 683.871904][T24147] GUP no longer grows the stack in syz.6.7693 (24147): 80009000-8000a000 (80005000) [ 683.877947][T24147] CPU: 0 UID: 0 PID: 24147 Comm: syz.6.7693 Tainted: G L syzkaller #0 PREEMPT(full) [ 683.877973][T24147] Tainted: [L]=SOFTLOCKUP [ 683.877977][T24147] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 683.877985][T24147] Call Trace: [ 683.877989][T24147] [ 683.877994][T24147] dump_stack_lvl+0x100/0x190 [ 683.878015][T24147] gup_vma_lookup.cold+0x83/0x96 [ 683.878035][T24147] __get_user_pages+0x241/0x32a0 [ 683.878057][T24147] ? down_read_killable+0x35e/0x520 [ 683.878076][T24147] ? __pfx___get_user_pages+0x10/0x10 [ 683.878096][T24147] __gup_longterm_locked+0x87d/0x16f0 [ 683.878116][T24147] ? __pfx___gup_longterm_locked+0x10/0x10 [ 683.878132][T24147] ? lock_acquire+0x1b9/0x370 [ 683.878170][T24147] gup_fast_fallback+0x16dc/0x2790 [ 683.878198][T24147] ? __pfx_gup_fast_fallback+0x10/0x10 [ 683.878214][T24147] ? find_held_lock+0x2b/0x80 [ 683.878231][T24147] ? __lock_acquire+0x49f/0x1a40 [ 683.878248][T24147] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 683.878268][T24147] ? lockdep_hardirqs_on+0x78/0x100 [ 683.878284][T24147] get_user_pages_fast+0xa7/0xf0 [ 683.878300][T24147] ? __pfx_get_user_pages_fast+0x10/0x10 [ 683.878316][T24147] ? iov_iter_advance+0xac/0x6d0 [ 683.878337][T24147] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 683.878359][T24147] ? pipe_lock+0x69/0x80 [ 683.878372][T24147] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 683.878390][T24147] ? __pfx___mutex_lock+0x10/0x10 [ 683.878404][T24147] ? iovec_from_user+0xda/0x140 [ 683.878424][T24147] iov_iter_get_pages2+0xa3/0x100 [ 683.878441][T24147] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 683.878457][T24147] ? wait_for_space+0x2ca/0x3b0 [ 683.878475][T24147] __do_sys_vmsplice+0x7dd/0x13c0 [ 683.878493][T24147] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 683.878509][T24147] ? __pfx_futex_wait+0x10/0x10 [ 683.878547][T24147] ? __do_fast_syscall_32+0xe7/0x970 [ 683.878562][T24147] __do_fast_syscall_32+0xe7/0x970 [ 683.878578][T24147] do_fast_syscall_32+0x32/0x70 [ 683.878593][T24147] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 683.878607][T24147] RIP: 0023:0xf7f28fec [ 683.878623][T24147] Code: Unable to access opcode bytes at 0xf7f28fc2. [ 683.878627][T24147] RSP: 002b:00000000f53e650c EFLAGS: 00000292 ORIG_RAX: 000000000000013c [ 683.878638][T24147] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 683.878645][T24147] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 683.878651][T24147] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 683.878657][T24147] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 683.878663][T24147] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 683.878676][T24147] [ 684.065646][T24155] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7697'. [ 685.297243][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.299424][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.032640][ T42] audit: type=1326 audit(1785494273.732:1477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 686.044691][ T42] audit: type=1326 audit(1785494273.732:1478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 686.061747][ T42] audit: type=1326 audit(1785494273.742:1479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 686.069373][ T42] audit: type=1326 audit(1785494273.742:1480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 686.076997][ T42] audit: type=1326 audit(1785494273.742:1481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf6fcefec code=0x7ffc0000 [ 686.087273][ T42] audit: type=1326 audit(1785494273.742:1482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7ffc0000 [ 686.105049][ T42] audit: type=1326 audit(1785494273.742:1483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7ffc0000 [ 686.112432][ T42] audit: type=1326 audit(1785494273.742:1484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7ffc0000 [ 686.119999][ T42] audit: type=1326 audit(1785494273.742:1485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7ffc0000 [ 686.127171][ T42] audit: type=1326 audit(1785494273.742:1486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24197 comm="syz.7.7713" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7ffc0000 [ 686.327403][T24214] overlayfs: upper fs does not support file handles, falling back to index=off. [ 686.330426][T24214] overlayfs: fs on '.' does not support file handles, falling back to xino=off. [ 686.365078][T24216] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 686.916887][T24274] input: syz0 as /devices/virtual/input/input51 [ 687.165009][T24296] ieee802154 phy0 wpan0: encryption failed: -126 [ 687.273031][T24301] ieee802154 phy0 wpan0: encryption failed: -126 [ 687.642173][T24320] netlink: 76 bytes leftover after parsing attributes in process `syz.1.7771'. [ 687.647054][T24320] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 687.654693][T24321] netlink: 318 bytes leftover after parsing attributes in process `syz.6.7770'. [ 688.723514][ T5864] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 688.757409][T24386] input: syz0 as /devices/virtual/input/input52 [ 688.905912][ T5864] usb 13-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 688.909780][ T5864] usb 13-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 688.914057][ T5864] usb 13-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 688.921452][ T5864] usb 13-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 688.926800][ T5864] usb 13-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 688.930361][ T5864] usb 13-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 688.935988][ T5864] usb 13-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 688.939948][ T5864] usb 13-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 688.943789][ T5864] usb 13-1: Product: syz [ 688.945984][ T5864] usb 13-1: Manufacturer: syz [ 689.075320][T24404] loop4: detected capacity change from 0 to 7 [ 689.099284][ C3] blk_print_req_error: 108 callbacks suppressed [ 689.099304][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.106091][ C3] buffer_io_error: 8 callbacks suppressed [ 689.106107][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.115480][ C2] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.118876][ C2] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.121691][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.125429][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.128903][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.132913][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.137204][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.141241][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.145290][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.149284][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.152855][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.156563][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.159459][T24404] ldm_validate_partition_table(): Disk read failed. [ 689.162691][ C2] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.165851][ C2] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.171232][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.174951][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.178799][ C2] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 689.182598][ C2] Buffer I/O error on dev loop4, logical block 0, async page read [ 689.186152][T24404] Dev loop4: unable to read RDB block 0 [ 689.194201][T24404] loop4: unable to read partition table [ 689.196720][T24404] loop4: partition table beyond EOD, truncated [ 689.208635][T24404] loop_reread_partitions: partition scan of loop4 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 689.383325][T24417] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 689.393734][T24417] overlayfs: overlapping lowerdir path [ 689.714280][ T3263] usb 12-1: new high-speed USB device number 10 using dummy_hcd [ 689.718078][ T5454] veth1_vlan: left promiscuous mode [ 689.873633][ T3263] usb 12-1: Using ep0 maxpacket: 16 [ 689.877631][ T3263] usb 12-1: config 0 has no interfaces? [ 689.880235][ T3263] usb 12-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 689.888606][ T3263] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 689.932987][ T5454] veth1_vlan: entered promiscuous mode [ 690.133511][ T5864] usb 11-1: new high-speed USB device number 14 using dummy_hcd [ 690.307228][ T5864] usb 11-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 690.312808][ T5864] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 690.317234][ T5864] usb 11-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 690.320962][ T5864] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.327701][ T5864] usb 11-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 690.331353][ T5864] usb 11-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 690.336252][ T5864] usb 11-1: Product: syz [ 690.337797][ T5864] usb 11-1: Manufacturer: syz [ 690.733544][ T5430] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 690.909889][ T5430] usb 6-1: unable to get BOS descriptor or descriptor too short [ 690.914165][ T5430] usb 6-1: no configurations [ 690.916233][ T5430] usb 6-1: can't read configurations, error -22 [ 691.465599][T24491] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7833'. [ 691.505834][ T3263] usb 13-1: USB disconnect, device number 2 [ 692.223553][ T3263] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 692.383553][ T3263] usb 6-1: Using ep0 maxpacket: 8 [ 692.387860][ T3263] usb 6-1: config 0 has an invalid interface number: 186 but max is 0 [ 692.392311][ T3263] usb 6-1: config 0 has no interface number 0 [ 692.402241][ T3263] usb 6-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 692.407383][ T3263] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 692.410536][ T3263] usb 6-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 692.414540][ T3263] usb 6-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 692.418164][ T3263] usb 6-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 692.424444][ T3263] usb 6-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 692.427363][ T3263] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.430000][ T3263] usb 6-1: Product: syz [ 692.431314][ T3263] usb 6-1: Manufacturer: syz [ 692.432736][ T3263] usb 6-1: SerialNumber: syz [ 692.475855][ T5910] usb 12-1: USB disconnect, device number 10 [ 692.587823][T24532] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7850'. [ 692.594183][T24532] netlink: 28 bytes leftover after parsing attributes in process `syz.7.7850'. [ 692.597239][T24532] netlink: 28 bytes leftover after parsing attributes in process `syz.7.7850'. [ 692.892825][ T5545] usb 11-1: USB disconnect, device number 14 [ 693.169819][ C0] IPv4: Oversized IP packet from 127.0.0.1 [ 693.488212][T24569] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7866'. [ 693.797119][T24587] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7874'. [ 693.803168][T24587] netlink: 72 bytes leftover after parsing attributes in process `syz.6.7874'. [ 693.843761][T17098] Bluetooth: hci2: Unknown advertising packet type: 0x70 [ 693.843834][T17098] Bluetooth: hci2: Malformed LE Event: 0x0d [ 693.913810][T24594] netlink: 16 bytes leftover after parsing attributes in process `syz.8.7878'. [ 693.925187][T24594] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.347702][T24618] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7889'. [ 694.371381][T24618] veth0_macvtap: left promiscuous mode [ 694.573670][T24632] Invalid logical block size (4095) [ 694.872601][T24657] input: syz1 as /devices/virtual/input/input53 [ 694.986417][ T3263] usb 6-1: USB disconnect, device number 21 [ 695.519506][T24698] ieee802154 phy0 wpan0: encryption failed: -126 [ 695.678533][T24711] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7931'. [ 695.682740][T24711] netlink: 'syz.6.7931': attribute type 1 has an invalid length. [ 695.686453][T24711] netlink: 'syz.6.7931': attribute type 2 has an invalid length. [ 695.767281][T24718] netlink: 'syz.6.7934': attribute type 8 has an invalid length. [ 696.006799][T24730] serio: Serial port ttynull [ 697.030654][T24779] bridge0: left allmulticast mode [ 697.465489][T24806] tipc: Started in network mode [ 697.467144][T24806] tipc: Node identity ac14140f, cluster identity 4711 [ 697.469710][T24806] tipc: New replicast peer: 255.255.255.255 [ 697.472248][T24806] tipc: Enabled bearer , priority 10 [ 697.586806][T24814] netlink: 27 bytes leftover after parsing attributes in process `syz.1.7976'. [ 697.824478][T24825] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7980'. [ 697.829073][T24825] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7980'. [ 698.483550][ T5430] tipc: Node number set to 2886997007 [ 698.811978][T24850] Format for adding new device is "id port_count num_queues" (uint uint uint). [ 699.065815][T24873] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 699.103624][T24875] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.127072][T24874] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.130619][ T5430] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.135638][ T5430] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.145415][ T5430] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.149386][ T5430] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 699.151997][ T5430] rtc rtc0: __rtc_set_alarm: err=-22 [ 699.208378][T24882] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8006'. [ 699.253074][T24888] netpci0: tun_chr_ioctl cmd 1074025681 [ 699.692529][T24910] sch_fq: defrate 0 ignored. [ 699.751411][T24912] pimreg: tun_chr_ioctl cmd 1074025684 [ 700.197624][ T5545] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 700.270973][T24957] netlink: 56 bytes leftover after parsing attributes in process `syz.7.8040'. [ 700.278573][T24957] netlink: 56 bytes leftover after parsing attributes in process `syz.7.8040'. [ 702.277441][T25044] loop9: detected capacity change from 0 to 7 [ 702.461407][ C0] blk_print_req_error: 10 callbacks suppressed [ 702.461420][ C0] invalid error, dev loop9, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 702.468375][ C0] buffer_io_error: 10 callbacks suppressed [ 702.468387][ C0] Buffer I/O error on dev loop9, logical block 0, lost async page write [ 703.161509][ T5766] Bluetooth: hci0: sending frame failed (-49) [ 703.167296][T17098] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 703.323648][T23381] usb 12-1: new high-speed USB device number 11 using dummy_hcd [ 703.493539][T23381] usb 12-1: Using ep0 maxpacket: 8 [ 703.497368][T23381] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 703.501937][T23381] usb 12-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 703.505769][T23381] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 703.751850][ T5766] Bluetooth: hci0: sending frame failed (-49) [ 703.754384][T17098] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 703.994156][ T42] kauditd_printk_skb: 587 callbacks suppressed [ 703.994174][ T42] audit: type=1326 audit(1785494291.702:2074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25156 comm="syz.8.8120" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 704.517643][T25184] io-wq is not configured for unbound workers [ 705.482879][T25250] CIFS: bad ip= option (1270.0.1) [ 705.488523][T25250] CIFS: Attempting to mount (null) [ 705.492155][T25250] CIFS: VFS: Error connecting to socket. Aborting operation. [ 705.497836][T25250] CIFS: VFS: cifs_mount failed w/return code = -111 [ 705.853947][T25264] input: syz0 as /devices/virtual/input/input56 [ 706.089936][ T5903] usb 12-1: USB disconnect, device number 11 [ 706.449309][T25312] usbcore.quirks: string doesn't fit in 127 chars. [ 706.573923][T23381] usb 11-1: new high-speed USB device number 15 using dummy_hcd [ 706.743590][T23381] usb 11-1: Using ep0 maxpacket: 8 [ 706.747280][T23381] usb 11-1: config index 0 descriptor too short (expected 74, got 45) [ 706.750093][T23381] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 706.753622][T23381] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 706.756862][T23381] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 65535, setting to 1024 [ 706.760605][T23381] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 706.763974][T23381] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 706.768242][T23381] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 706.771250][T23381] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 706.859269][T25332] block2mtd: error: cannot open device #! [ 707.228990][T25359] C: renamed from veth1_to_team (while UP) [ 707.233608][T25359] netlink: 'syz.7.8215': attribute type 2 has an invalid length. [ 707.236660][T25359] netlink: 128 bytes leftover after parsing attributes in process `syz.7.8215'. [ 707.240086][T25359] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 707.364751][T25368] scsi_dev_info_list_add_str: bad dev info string 'end' '' '' [ 707.769967][T25406] loop5: detected capacity change from 0 to 7 [ 707.955077][T25406] Dev loop5: unable to read RDB block 7 [ 707.957334][T25406] loop5: unable to read partition table [ 707.959771][T25406] loop5: partition table beyond EOD, truncated [ 707.962320][T25406] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 709.124558][T25467] syzkaller1: tun_chr_ioctl cmd 35108 [ 709.156430][T25464] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8264'. [ 709.349122][T23381] usb 11-1: USB disconnect, device number 15 [ 709.624290][T25511] usbip-vudc usbip-vudc.0: gadget not bound [ 709.654249][T25517] netlink: 8 bytes leftover after parsing attributes in process `syz.8.8287'. [ 709.814628][T25539] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.828006][T25543] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8299'. [ 709.946800][T25556] netlink: 'syz.7.8305': attribute type 5 has an invalid length. [ 709.949403][T25556] netlink: 3657 bytes leftover after parsing attributes in process `syz.7.8305'. [ 710.093671][T23381] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 710.260472][T23381] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 710.264771][T23381] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 710.268887][T23381] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 710.272541][T23381] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 710.276894][T23381] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 710.282656][T23381] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 710.286383][T23381] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 710.288988][T23381] usb 6-1: Product: syz [ 710.290295][T23381] usb 6-1: Manufacturer: syz [ 710.296722][T25580] loop9: detected capacity change from 0 to 255852544 [ 710.383927][T25580] loop9: detected capacity change from 255852544 to 524287871 [ 710.699422][T25610] /dev/loop0: Can't open blockdev [ 710.904766][T25622] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8337'. [ 711.173602][ T5430] usb 13-1: new full-speed USB device number 3 using dummy_hcd [ 711.365599][ T5430] usb 13-1: unable to get BOS descriptor or descriptor too short [ 711.371380][ T5430] usb 13-1: unable to read config index 0 descriptor/start: -71 [ 711.379035][ T5430] usb 13-1: can't read configurations, error -71 [ 711.489144][T25645] block2mtd: error: cannot open device #! [ 711.680223][ T5910] hid-generic 0005:16C0:5505.0008: item fetching failed at offset 0/1 [ 711.690268][ T5910] hid-generic 0005:16C0:5505.0008: probe with driver hid-generic failed with error -22 [ 711.716240][T25662] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8355'. [ 712.025820][T25678] batadv_slave_1: entered promiscuous mode [ 712.029084][T25678] batadv_slave_1: left promiscuous mode [ 712.321105][T25696] netlink: 3 bytes leftover after parsing attributes in process `syz.6.8370'. [ 712.871805][ T5844] usb 6-1: USB disconnect, device number 22 [ 713.394376][T25725] loop9: detected capacity change from 0 to 7 [ 713.406706][T25726] netlink: 7 bytes leftover after parsing attributes in process `syz.1.8385'. [ 713.450059][ T5910] hid_parser_main: 6 callbacks suppressed [ 713.450073][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x3 [ 713.456881][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x3 [ 713.459464][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.463861][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.466732][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.469359][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.490513][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.493237][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.506471][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.516634][ T5910] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 713.545507][ T5910] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.03 Device [syz1] on syz1 [ 713.597002][ C1] invalid error, dev loop9, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 713.600552][ C1] Buffer I/O error on dev loop9, logical block 0, lost async page write [ 713.665023][T25734] fido_id[25734]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 714.462464][ T42] audit: type=1326 audit(1785494302.162:2075): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25737 comm="syz.1.8389" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7fc00000 [ 714.626574][T25773] netlink: 'syz.7.8404': attribute type 1 has an invalid length. [ 714.840608][T25787] team0: No ports can be present during mode change [ 715.034041][ T5430] usb 13-1: new high-speed USB device number 5 using dummy_hcd [ 715.186690][ T5430] usb 13-1: unable to get BOS descriptor or descriptor too short [ 715.193231][ T5430] usb 13-1: unable to read config index 0 descriptor/start: -71 [ 715.196367][ T5430] usb 13-1: can't read configurations, error -71 [ 715.542611][T25825] netlink: 16 bytes leftover after parsing attributes in process `syz.6.8429'. [ 715.546951][T25825] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8429'. [ 715.550829][T25825] netlink: 12 bytes leftover after parsing attributes in process `syz.6.8429'. [ 715.888283][T25847] bond0: (slave macvlan0): Error -98 calling set_mac_address [ 716.033327][T25856] ima: policy update failed [ 716.035995][ T42] audit: type=1802 audit(1785494303.742:2076): pid=25856 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.7.8443" res=0 errno=0 [ 716.694248][T25899] Format for deleting device is "id" (uint). [ 716.775628][ T42] audit: type=1326 audit(1785494304.472:2077): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25904 comm="syz.6.8466" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f28fec code=0x0 [ 717.223686][ T5844] usb 13-1: new high-speed USB device number 7 using dummy_hcd [ 717.362167][T25959] netlink: 52 bytes leftover after parsing attributes in process `syz.1.8491'. [ 717.371060][T25959] bridge0: port 1(bridge_slave_0) entered disabled state [ 717.396099][ T5844] usb 13-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 717.401097][ T5844] usb 13-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 717.407533][ T5844] usb 13-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 717.410585][ T5844] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 717.414206][ T5844] usb 13-1: Product: syz [ 717.416804][ T5844] usb 13-1: Manufacturer: syz [ 717.418573][ T5844] usb 13-1: SerialNumber: syz [ 717.506716][T25970] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8496'. [ 717.513059][T25970] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8496'. [ 718.085541][ T42] audit: type=1326 audit(1785494305.792:2078): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26016 comm="syz.1.8520" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f43fec code=0x0 [ 718.104015][ T5545] usb 12-1: new high-speed USB device number 12 using dummy_hcd [ 718.255997][ T5545] usb 12-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 718.259486][ T5545] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 718.262597][ T5545] usb 12-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 718.268899][ T5545] usb 12-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 718.271879][ T5545] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 718.275058][ T5545] usb 12-1: Product: syz [ 718.276477][ T5545] usb 12-1: Manufacturer: syz [ 718.277918][ T5545] usb 12-1: SerialNumber: syz [ 718.624183][T26037] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 718.626213][T26037] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 718.628146][T26037] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 718.630171][T26037] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 718.667395][T26037] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 719.304091][T26075] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 719.483208][T26080] block2mtd: device name too long [ 719.519317][ T42] audit: type=1326 audit(1785494307.222:2079): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.526606][ T42] audit: type=1326 audit(1785494307.222:2080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.534069][ T42] audit: type=1326 audit(1785494307.232:2081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.542437][ T42] audit: type=1326 audit(1785494307.232:2082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.552656][ T42] audit: type=1326 audit(1785494307.232:2083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.565182][ T42] audit: type=1326 audit(1785494307.232:2084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.573225][ T42] audit: type=1326 audit(1785494307.242:2085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.581314][ T42] audit: type=1326 audit(1785494307.242:2086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.589950][ T42] audit: type=1326 audit(1785494307.242:2087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=371 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.597805][ T42] audit: type=1326 audit(1785494307.242:2088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26083 comm="syz.1.8548" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f43fec code=0x7ffc0000 [ 719.995566][ T5910] usb 13-1: USB disconnect, device number 7 [ 720.070292][T26101] overlayfs: invalid origin (0000) [ 720.540194][T26119] printk: legacy console [ttyGS0] disabled [ 720.663957][ T5766] Bluetooth: hci4: command 0x0c1a tx timeout [ 720.664082][T17098] Bluetooth: hci3: command 0x2016 tx timeout [ 720.666743][ T5766] Bluetooth: hci2: command 0x0c1a tx timeout [ 720.744770][T26130] netlink: 16 bytes leftover after parsing attributes in process `syz.8.8566'. [ 720.748296][T26130] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8566'. [ 720.751203][T26130] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8566'. [ 720.874111][ T5430] usb 12-1: USB disconnect, device number 12 [ 721.134013][ C0] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 721.349426][T12440] block nbd11: Receive control failed (result -32) [ 721.472576][T26175] e1000e 0000:00:02.0 eth1: removed PHC [ 721.728666][T26186] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8592'. [ 721.732129][T26186] netlink: 'syz.7.8592': attribute type 1 has an invalid length. [ 721.740203][T26186] gretap0: entered promiscuous mode [ 721.744610][T26186] macvlan3: entered allmulticast mode [ 721.746514][T26186] gretap0: entered allmulticast mode [ 722.331052][T26236] kvm: kvm [26235]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x4000008a) = 0x39 [ 722.733600][ T5766] Bluetooth: hci4: command 0x0c1a tx timeout [ 724.328290][T26321] uhci_hcd 0000:00:1d.0: remove, state 4 [ 724.332129][T26321] usb usb2: USB disconnect, device number 1 [ 724.380472][T17098] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 724.387753][T17098] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 724.394678][T17098] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 724.403882][T17098] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 724.408887][T17098] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 724.443626][T23381] usb 11-1: new full-speed USB device number 16 using dummy_hcd [ 724.510178][T26321] uhci_hcd 0000:00:1d.0: USB bus 2 deregistered [ 724.692343][T23381] usb 11-1: unable to get BOS descriptor or descriptor too short [ 724.697838][T23381] usb 11-1: unable to read config index 0 descriptor/start: -71 [ 724.701050][T23381] usb 11-1: can't read configurations, error -71 [ 724.810519][T26344] syz.8.8663 (26344) used greatest stack depth: 18712 bytes left [ 724.813557][ T5766] Bluetooth: hci4: command 0x0c1a tx timeout [ 724.930698][T26323] bridge0: port 1(bridge_slave_0) entered blocking state [ 724.933140][T26323] bridge0: port 1(bridge_slave_0) entered disabled state [ 724.935766][T26323] bridge_slave_0: entered allmulticast mode [ 724.938650][T26323] bridge_slave_0: entered promiscuous mode [ 724.942301][T26323] bridge0: port 2(bridge_slave_1) entered blocking state [ 724.944826][T26323] bridge0: port 2(bridge_slave_1) entered disabled state [ 724.947336][T26323] bridge_slave_1: entered allmulticast mode [ 724.950236][T26323] bridge_slave_1: entered promiscuous mode [ 725.002293][T26323] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 725.011440][T26323] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 725.039072][T26323] team0: Port device team_slave_0 added [ 725.044328][T26323] team0: Port device team_slave_1 added [ 725.083983][T26323] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 725.086987][T26323] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 725.102451][T26323] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 725.115454][T26323] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 725.118400][T26323] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 725.122704][ T5910] hid-generic 0005:16C0:5505.000A: item fetching failed at offset 0/1 [ 725.130886][T26323] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 725.135280][ T5910] hid-generic 0005:16C0:5505.000A: probe with driver hid-generic failed with error -22 [ 725.217677][T26323] hsr_slave_0: entered promiscuous mode [ 725.221037][T26323] hsr_slave_1: entered promiscuous mode [ 725.227510][T26323] debugfs: 'hsr0' already exists in 'hsr' [ 725.230018][T26323] Cannot create hsr debugfs directory [ 725.520906][T26323] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 725.527923][T26323] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 725.536310][T26323] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 725.542352][T26323] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 725.554932][T26323] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 725.561899][T26323] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 725.566936][T26323] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 725.583208][T26323] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 725.625042][T26323] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.627374][T26323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 725.629741][T26323] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.631949][T26323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 725.669612][T26323] 8021q: adding VLAN 0 to HW filter on device bond0 [ 725.682830][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.686788][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.698662][T26323] 8021q: adding VLAN 0 to HW filter on device team0 [ 725.709634][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.712737][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 725.720627][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.723691][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 726.057677][T26323] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 726.063507][ T5844] usb 12-1: new full-speed USB device number 13 using dummy_hcd [ 726.279751][ T5844] usb 12-1: unable to get BOS descriptor or descriptor too short [ 726.284668][ T5844] usb 12-1: unable to read config index 0 descriptor/start: -71 [ 726.287971][ T5844] usb 12-1: can't read configurations, error -71 [ 726.292060][T26323] veth0_vlan: entered promiscuous mode [ 726.308792][T26323] veth1_vlan: entered promiscuous mode [ 726.344774][T26323] veth0_macvtap: entered promiscuous mode [ 726.350427][T26323] veth1_macvtap: entered promiscuous mode [ 726.362065][T26323] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 726.372267][T26323] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 726.485904][ T13] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.488878][ T13] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.491700][ T13] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.495027][ T13] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.549931][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 726.555449][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 726.578269][ T5766] Bluetooth: hci0: command tx timeout [ 726.602107][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 726.606468][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 726.953286][T26441] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8692'. [ 727.353677][ T5844] usb 12-1: new high-speed USB device number 14 using dummy_hcd [ 727.511072][ T5844] usb 12-1: unable to get BOS descriptor or descriptor too short [ 727.515306][ T5844] usb 12-1: unable to read config index 0 descriptor/start: -71 [ 727.517786][ T5844] usb 12-1: can't read configurations, error -71 [ 727.519951][ T5844] usb usb12-port1: attempt power cycle [ 728.284160][ T5864] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 729.421338][ T5903] hid_parser_main: 68 callbacks suppressed [ 729.421351][ T5903] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 729.433615][ T5903] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 729.471558][T26505] fido_id[26505]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 729.644107][ T5844] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 729.890387][T26523] [U] [ 729.892378][T26523] [U] [ 729.893320][T26523] [U] [ 729.894222][T26523] [U] [ 729.895129][T26523] [U] [ 729.896024][T26523] [U] [ 729.896907][T26523] [U] [ 729.897772][T26523] [U] [ 729.899954][T26523] [U] [ 729.900853][T26523] [U] [ 729.901731][T26523] [U] [ 729.902620][T26523] [U] [ 729.903543][T26523] [U] [ 729.904428][T26523] [U] [ 729.905328][T26523] [U] [ 729.906226][T26523] [U] [ 729.907376][T26523] [U] [ 729.908317][T26523] [U] [ 729.909166][T26523] [U] [ 729.910060][T26523] [U] [ 729.910956][T26523] [U] [ 729.911865][T26523] [U] [ 729.912759][T26523] [U] [ 729.913668][T26523] [U] [ 729.915544][T26523] [U] [ 729.916459][T26523] [U] [ 729.917343][T26523] [U] [ 729.918228][T26523] [U] [ 729.919120][T26523] [U] [ 729.920003][T26523] [U] [ 729.920890][T26523] [U] [ 729.921782][T26523] [U] [ 729.922769][T26523] [U] [ 729.923715][T26523] [U] [ 729.924627][T26523] [U] [ 729.925513][T26523] [U] [ 729.926401][T26523] [U] [ 729.927301][T26523] [U] [ 729.928187][T26523] [U] [ 729.929087][T26523] [U] [ 729.930168][T26523] [U] [ 729.931082][T26523] [U] [ 729.931979][T26523] [U] [ 729.932858][T26523] [U] [ 729.933820][T26523] [U] [ 729.934740][T26523] [U] [ 729.935634][T26523] [U] [ 729.936521][T26523] [U] [ 729.937910][T26523] [U] [ 729.938776][T26523] [U] [ 729.939644][T26523] [U] [ 729.940509][T26523] [U] [ 729.941374][T26523] [U] [ 729.942235][T26523] [U] [ 729.943114][T26523] [U] [ 729.944022][T26523] [U] [ 729.945628][T26523] [U] [ 729.946530][T26523] [U] [ 729.947386][T26523] [U] [ 729.948305][T26523] [U] [ 729.949202][T26523] [U] [ 729.950078][T26523] [U] [ 729.950950][T26523] [U] [ 729.951867][T26523] [U] [ 729.952879][T26523] [U] [ 729.953801][T26523] [U] [ 729.954704][T26523] [U] [ 729.955605][T26523] [U] [ 729.956484][T26523] [U] [ 729.957359][T26523] [U] [ 729.958236][T26523] [U] [ 729.959126][T26523] [U] [ 729.960736][T26523] [U] [ 729.961735][T26523] [U] [ 729.962651][T26523] [U] [ 729.963572][T26523] [U] [ 729.964474][T26523] [U] [ 729.965355][T26523] [U] [ 729.966400][T26523] [U] [ 729.967482][T26523] [U] [ 729.969048][T26523] [U] [ 729.970102][T26523] [U] [ 729.970956][T26523] [U] [ 729.971850][T26523] [U] [ 729.972731][T26523] [U] [ 729.973632][T26523] [U] [ 729.974540][T26523] [U] [ 729.975444][T26523] [U] [ 729.976490][T26523] [U] [ 729.977389][T26523] [U] [ 729.978284][T26523] [U] [ 729.979189][T26523] [U] [ 729.980076][T26523] [U] [ 729.980994][T26523] [U] [ 729.982094][T26523] [U] [ 729.983191][T26523] [U] [ 729.984486][T26523] [U] [ 729.985588][T26523] [U] [ 729.986670][T26523] [U] [ 729.987768][T26523] [U] [ 729.988849][T26523] [U] [ 729.989947][T26523] [U] [ 729.991047][T26523] [U] [ 729.992141][T26523] [U] [ 729.993320][T26523] [U] [ 729.994266][T26523] [U] [ 729.995168][T26523] [U] [ 729.996059][T26523] [U] [ 729.997006][T26523] [U] [ 729.998100][T26523] [U] [ 729.999051][T26523] [U] [ 729.999942][T26523] [U] [ 730.001055][T26523] [U] [ 730.001965][T26523] [U] [ 730.003162][T26523] [U] [ 730.004381][T26523] [U] [ 730.005564][T26523] [U] [ 730.006637][T26523] [U] [ 730.007812][T26523] [U] [ 730.009000][T26523] [U] [ 730.012002][T26523] [U] [ 730.013223][T26523] [U] [ 730.014175][T26523] [U] [ 730.015097][T26523] [U] [ 730.015972][T26523] [U] [ 730.016848][T26523] [U] [ 730.017734][T26523] [U] [ 730.024611][T26522] [U] [ 730.037632][T26525] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 730.042417][T26525] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 730.047864][T26525] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 730.049999][T26525] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 730.052500][T26525] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 730.097995][T26525] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 731.375517][ T5766] Bluetooth: hci1: Entering manufacturer mode failed (-110) [ 731.445649][T26559] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 731.448548][T26559] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 731.452049][T26559] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 731.455722][T26559] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 731.863899][T26586] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 731.873176][T26586] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 731.876586][T26586] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 731.879792][T26586] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 732.179932][T26609] input: syz0 as /devices/virtual/input/input59 [ 733.310864][T26665] block2mtd: error: cannot open device [ 733.933599][ T5766] Bluetooth: hci0: command 0x0419 tx timeout [ 733.934878][ T64] Bluetooth: hci4: command 0x0c1a tx timeout [ 733.937592][ T64] Bluetooth: hci3: command 0x2016 tx timeout [ 733.939066][T17098] Bluetooth: hci2: command 0x0c1a tx timeout [ 734.051347][T26705] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 734.101454][T26709] bond0: invalid NS target ff00:: specified for addition [ 734.115175][T26709] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 735.360175][T26747] loop5: detected capacity change from 0 to 7 [ 735.363648][T26747] Dev loop5: unable to read RDB block 7 [ 735.365980][T26747] loop5: unable to read partition table [ 735.368351][T26747] loop5: partition table beyond EOD, truncated [ 735.372820][T26747] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 735.581436][T26765] Bluetooth: MGMT ver 1.23 [ 735.884378][T26782] binder: 26781:26782 ioctl c0306201 800001c0 returned -14 [ 736.023546][ T5766] Bluetooth: hci0: command 0x0419 tx timeout [ 736.539117][T26798] netlink: 'syz.9.8849': attribute type 3 has an invalid length. [ 737.323542][ T5909] usb 14-1: new high-speed USB device number 2 using dummy_hcd [ 737.403565][ T5545] usb 12-1: new high-speed USB device number 16 using dummy_hcd [ 737.475044][ T5909] usb 14-1: Using ep0 maxpacket: 16 [ 737.478947][ T5909] usb 14-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 737.483316][ T5909] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 737.487911][ T5909] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 737.491700][ T5909] usb 14-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 737.495799][ T5909] usb 14-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 737.502156][ T5909] usb 14-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 737.506011][ T5909] usb 14-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 737.509337][ T5909] usb 14-1: Manufacturer: syz [ 737.553497][ T5545] usb 12-1: Using ep0 maxpacket: 16 [ 737.557434][ T5545] usb 12-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 737.561824][ T5545] usb 12-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 737.566088][ T5545] usb 12-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 737.569781][ T5545] usb 12-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 737.574739][ T5545] usb 12-1: config 7 interface 0 has no altsetting 0 [ 737.576992][ T5545] usb 12-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 737.580707][ T5545] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 737.873641][T26844] input: syz1 as /devices/virtual/input/input60 [ 738.093543][ T5766] Bluetooth: hci0: command 0x0419 tx timeout [ 740.100801][T23381] usb 14-1: USB disconnect, device number 2 [ 740.141679][T26868] overlayfs: upper fs does not support file handles, falling back to index=off. [ 740.171707][ T5909] usb 12-1: USB disconnect, device number 16 [ 740.175386][T17098] Bluetooth: hci0: command 0x0419 tx timeout [ 740.193663][T26870] netlink: 48 bytes leftover after parsing attributes in process `syz.9.8882'. [ 740.479322][T26893] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8892'. [ 740.593109][T26905] netlink: 68 bytes leftover after parsing attributes in process `syz.7.8898'. [ 740.596889][T26905] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8898'. [ 740.600625][T26905] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8898'. [ 741.146210][T26949] netlink: 'syz.7.8919': attribute type 1 has an invalid length. [ 741.149033][T26949] netlink: 193500 bytes leftover after parsing attributes in process `syz.7.8919'. [ 741.152062][T26949] netlink: 'syz.7.8919': attribute type 1 has an invalid length. [ 741.154873][T26949] netlink: 2016 bytes leftover after parsing attributes in process `syz.7.8919'. [ 741.489285][T26968] CacheFiles: Failed to register: -95 [ 741.659631][T26976] bridge0: port 2(bridge_slave_1) entered blocking state [ 741.662033][T26976] bridge0: port 2(bridge_slave_1) entered listening state [ 741.664560][T26976] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.666850][T26976] bridge0: port 1(bridge_slave_0) entered listening state [ 741.907108][T26991] netlink: 16 bytes leftover after parsing attributes in process `syz.6.8938'. [ 741.949614][T26996] netlink: 4 bytes leftover after parsing attributes in process `syz.6.8941'. [ 742.783875][T27018] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 742.804219][T27018] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8950'. [ 742.895578][T27022] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 743.003800][T27031] syzkaller1: entered promiscuous mode [ 743.006167][T27031] syzkaller1: entered allmulticast mode [ 743.185458][ T42] kauditd_printk_skb: 2 callbacks suppressed [ 743.185470][ T42] audit: type=1326 audit(1785494586.891:2091): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27037 comm="syz.9.8959" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 743.430856][ T42] audit: type=1326 audit(1785494587.131:2092): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27057 comm="syz.6.8969" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f28fec code=0x0 [ 744.325636][ T5430] usb 13-1: new high-speed USB device number 8 using dummy_hcd [ 744.413641][ T36] wlan1: Trigger new scan to find an IBSS to join [ 744.483501][ T5430] usb 13-1: Using ep0 maxpacket: 8 [ 744.487073][ T5430] usb 13-1: config 0 interface 0 altsetting 254 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 744.490685][ T5430] usb 13-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid wMaxPacketSize 0 [ 744.494347][ T5430] usb 13-1: config 0 interface 0 has no altsetting 0 [ 744.496979][ T5430] usb 13-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 744.499911][ T5430] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.836817][T27116] can0: slcan on ptm0. [ 744.924305][T27115] can0 (unregistered): slcan off ptm0. [ 745.383547][ T60] usb 12-1: new high-speed USB device number 17 using dummy_hcd [ 745.533844][ T60] usb 12-1: Using ep0 maxpacket: 8 [ 745.541292][ T60] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 745.550334][ T60] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 745.554895][ T60] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 745.558922][ T60] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 745.564212][ T60] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 745.567900][ T60] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.700553][T17098] Bluetooth: hci2: Invalid handle: 0xffc9 > 0x0eff [ 746.519258][T27156] loop8: detected capacity change from 0 to 7 [ 746.536517][T27156] Dev loop8: unable to read RDB block 7 [ 746.538998][T27156] loop8: unable to read partition table [ 746.541553][T27156] loop8: partition table beyond EOD, truncated [ 746.544679][T27156] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 746.735223][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.737880][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.070976][ T5430] usb 13-1: USB disconnect, device number 8 [ 747.388247][ T1162] wlan1: Trigger new scan to find an IBSS to join [ 747.643653][T24478] usb 13-1: new high-speed USB device number 9 using dummy_hcd [ 747.793541][T24478] usb 13-1: Using ep0 maxpacket: 8 [ 747.796897][T24478] usb 13-1: config 0 has an invalid interface number: 143 but max is 0 [ 747.799696][T24478] usb 13-1: config 0 has no interface number 0 [ 747.802085][T24478] usb 13-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 747.805526][T24478] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 748.137634][T24478] usb 12-1: USB disconnect, device number 17 [ 748.512507][T27199] can0: slcan on ptm0. [ 748.594433][T27197] can0 (unregistered): slcan off ptm0. [ 750.264271][ T36] wlan1: Creating new IBSS network, BSSID f6:25:cf:fe:d9:71 [ 750.422413][ T5903] usb 13-1: USB disconnect, device number 9 [ 751.445935][T27276] zero sized request [ 751.717074][T27299] __nla_validate_parse: 1 callbacks suppressed [ 751.717086][T27299] netlink: 16 bytes leftover after parsing attributes in process `syz.8.9068'. [ 752.581048][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.584825][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.587920][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.591026][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.594875][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.598019][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.601092][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.605360][ T5903] hid-generic 0006:0008:0001.000C: unknown main item tag 0x0 [ 752.616467][ T5903] hid-generic 0006:0008:0001.000C: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 752.700963][T27350] fido_id[27350]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 752.933888][ T5903] usb 11-1: new high-speed USB device number 18 using dummy_hcd [ 752.935161][ T5909] usb 14-1: new high-speed USB device number 3 using dummy_hcd [ 752.993605][T23381] usb 12-1: new high-speed USB device number 18 using dummy_hcd [ 753.093482][ T5903] usb 11-1: Using ep0 maxpacket: 16 [ 753.093553][T24478] usb 13-1: new full-speed USB device number 10 using dummy_hcd [ 753.093585][ T5909] usb 14-1: Using ep0 maxpacket: 8 [ 753.097080][ T5903] usb 11-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.100871][ T5909] usb 14-1: config 179 has an invalid interface number: 65 but max is 0 [ 753.104044][ T5903] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 753.106878][ T5909] usb 14-1: config 179 has no interface number 0 [ 753.106908][ T5909] usb 14-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 753.111158][ T5903] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 753.113465][ T5909] usb 14-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 753.118005][ T5903] usb 11-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 753.121076][ T5909] usb 14-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 753.121101][ T5909] usb 14-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 753.125433][ T5903] usb 11-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 753.127719][ T5903] usb 11-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 753.129197][ T5909] usb 14-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 753.133452][ T5903] usb 11-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 753.133467][ T5903] usb 11-1: Manufacturer: syz [ 753.157447][ T5909] usb 14-1: config 179 interface 65 has no altsetting 0 [ 753.160384][ T5909] usb 14-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 753.164242][ T5909] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.175679][T23381] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 753.180752][T23381] usb 12-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 753.184533][T23381] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 753.187682][T23381] usb 12-1: Product: syz [ 753.189266][T23381] usb 12-1: Manufacturer: syz [ 753.265368][T24478] usb 13-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 753.269042][T24478] usb 13-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 753.273198][T24478] usb 13-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 753.276985][T24478] usb 13-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 14385, setting to 64 [ 753.284415][T24478] usb 13-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 753.288241][T24478] usb 13-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 753.291591][T24478] usb 13-1: Product: syz [ 753.293489][T24478] usb 13-1: Manufacturer: syz [ 755.687731][T23381] usb 14-1: USB disconnect, device number 3 [ 755.710094][ T5909] usb 11-1: USB disconnect, device number 18 [ 755.756644][ T5430] usb 12-1: USB disconnect, device number 18 [ 755.870820][ T5903] usb 13-1: USB disconnect, device number 10 [ 756.346121][ T41] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.352468][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.357440][ T220] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.361352][ T220] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.367821][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.374238][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.382290][ T5430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.388040][ T5430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.391749][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.744244][T27402] bridge_slave_0: left allmulticast mode [ 756.750357][T27402] bridge_slave_0: left promiscuous mode [ 756.753989][T27402] bridge0: port 1(bridge_slave_0) entered disabled state [ 756.761027][T27402] bridge_slave_1: left promiscuous mode [ 756.765391][T27402] bridge0: port 2(bridge_slave_1) entered disabled state [ 756.789127][T27402] bond0: (slave bond_slave_0): Releasing backup interface [ 756.801579][T27402] bond0: (slave bond_slave_1): Releasing backup interface [ 756.825545][T27407] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9105'. [ 756.828567][T27407] netlink: 12 bytes leftover after parsing attributes in process `syz.7.9105'. [ 756.828738][T27402] team_slave_0: left promiscuous mode [ 756.838654][T27402] team0: Port device team_slave_0 removed [ 756.842343][T27402] team_slave_1: left promiscuous mode [ 756.846046][T27402] team0: Port device team_slave_1 removed [ 756.849048][T27402] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 756.851675][T27402] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 756.855654][T27402] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 756.858155][T27402] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 756.861545][T27402] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 756.942503][ T5834] tipc: Subscription rejected, illegal request [ 756.985154][ C2] bridge0: port 1(bridge_slave_0) entered learning state [ 756.990658][ C2] bridge0: port 2(bridge_slave_1) entered learning state [ 757.115074][T27420] ipvlan2: entered promiscuous mode [ 757.116870][T27420] ipvlan2: entered allmulticast mode [ 757.118674][T27420] gretap0: entered allmulticast mode [ 757.125114][T27420] team0: Device ipvlan2 failed to register rx_handler [ 758.976888][T27539] overlayfs: failed lookup in lower (newroot/125, name='file0', err=-40): overlapping layers [ 759.214201][T27550] netlink: 8 bytes leftover after parsing attributes in process `syz.7.9165'. [ 759.738271][T27576] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 760.270706][T27618] bridge0: port 1(bridge_slave_0) entered disabled state [ 760.333655][T27624] mtrr: base(0x61616161000) is not aligned on a size(0x61616161000) boundary [ 760.336468][T27627] netlink: 83 bytes leftover after parsing attributes in process `syz.9.9201'. [ 760.583934][T17342] Bluetooth: hci1: sending frame failed (-49) [ 760.587847][ T5766] Bluetooth: hci1: Opcode 0x1003 failed: -49 [ 760.662467][T27641] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 761.082350][T27675] bridge0: port 1(bridge_slave_0) entered blocking state [ 761.084779][T27675] bridge0: port 1(bridge_slave_0) entered listening state [ 761.121586][T25732] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.124159][T25732] bridge0: port 2(bridge_slave_1) entered listening state [ 761.262437][T27680] random: crng reseeded on system resumption [ 761.334257][T27682] syzkaller1: entered promiscuous mode [ 761.338612][T27682] syzkaller1: entered allmulticast mode [ 761.390602][T27688] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 761.404569][ T5909] net_ratelimit: 12 callbacks suppressed [ 761.404581][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.605115][ T42] audit: type=1326 audit(1785494605.311:2093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27699 comm="syz.9.9234" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 761.618764][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.704672][ T42] audit: type=1326 audit(1785494605.411:2094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27695 comm="syz.7.9233" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6fcefec code=0x7fc00000 [ 761.771159][T27711] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9237'. [ 762.013580][ T5766] Bluetooth: hci2: command 0x0c1a tx timeout [ 762.093028][ T42] audit: type=1326 audit(1785494605.791:2095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27716 comm="syz.8.9240" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fcefec code=0x0 [ 762.100742][ T220] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.101324][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.110777][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.153567][ T5430] usb 11-1: new high-speed USB device number 19 using dummy_hcd [ 762.304896][ T5430] usb 11-1: config index 0 descriptor too short (expected 45, got 36) [ 762.307623][ T5430] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 762.311250][ T5430] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 762.314554][ T5430] usb 11-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 762.318668][ T5430] usb 11-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 762.321674][ T5430] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.340894][ T42] audit: type=1326 audit(1785494606.041:2096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27695 comm="syz.7.9233" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf6fcf008 code=0x7fc00000 [ 762.432523][ T60] libceph: connect (1)[c::]:6789 error -101 [ 762.435134][ T60] libceph: mon0 (1)[c::]:6789 connect error [ 762.473600][T27720] ceph: No mds server is up or the cluster is laggy [ 762.556649][ T42] audit: type=1800 audit(1785494606.251:2097): pid=27727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.9243" name="dummy_udc" dev="gadgetfs" ino=10361 res=0 errno=0 [ 762.617963][T27731] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 763.039096][T27757] lo: entered promiscuous mode [ 763.048023][T27757] lo: entered allmulticast mode [ 763.064567][T27757] tunl0: entered promiscuous mode [ 763.066780][T27757] tunl0: entered allmulticast mode [ 763.069852][T27757] gre0: entered promiscuous mode [ 763.071807][T27757] gre0: entered allmulticast mode [ 763.077200][T27757] gretap0: entered promiscuous mode [ 763.080675][T27757] erspan0: entered promiscuous mode [ 763.082896][T27757] erspan0: entered allmulticast mode [ 763.090362][T27757] ip_vti0: entered promiscuous mode [ 763.092595][T27757] ip_vti0: entered allmulticast mode [ 763.096068][T27757] ip6_vti0: entered promiscuous mode [ 763.098282][T27757] ip6_vti0: entered allmulticast mode [ 763.101990][T27757] sit0: entered promiscuous mode [ 763.107127][T27757] sit0: entered allmulticast mode [ 763.111210][T27757] ip6tnl0: entered promiscuous mode [ 763.114382][T27757] ip6tnl0: entered allmulticast mode [ 763.117744][T27757] ip6gre0: entered promiscuous mode [ 763.119933][T27757] ip6gre0: entered allmulticast mode [ 763.122934][T27757] syz_tun: entered promiscuous mode [ 763.125543][T27757] syz_tun: entered allmulticast mode [ 763.128869][T27757] ip6gretap0: entered promiscuous mode [ 763.131088][T27757] ip6gretap0: entered allmulticast mode [ 763.135073][T27757] bridge0: entered promiscuous mode [ 763.136367][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.137349][T27757] bridge0: entered allmulticast mode [ 763.206079][T27771] input: syz1 as /devices/virtual/input/input61 [ 763.340920][T27779] loop4: detected capacity change from 0 to 7 [ 763.357981][T27779] Dev loop4: unable to read RDB block 7 [ 763.361644][T27779] loop4: unable to read partition table [ 763.364504][T27779] loop4: partition table beyond EOD, truncated [ 763.367276][T27779] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 763.479398][T27783] printk: legacy console [ttyGS0] disabled [ 763.531624][T27788] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 763.534008][T27788] IPv6: NLM_F_CREATE should be set when creating new route [ 763.623586][ T5766] Bluetooth: hci4: command 0x0c1a tx timeout [ 763.695398][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.173615][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.649953][T27775] Set syz1 is full, maxelem 65536 reached [ 764.932304][ T5910] usb 11-1: USB disconnect, device number 19 [ 765.572617][T27821] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9285'. [ 765.694265][T17342] Bluetooth: hci4: command 0x0c1a tx timeout [ 765.824179][T24478] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 766.573831][ T5910] net_ratelimit: 3 callbacks suppressed [ 766.573848][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.734061][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.293751][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.335452][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.374840][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.774937][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.077482][T27880] netlink: 16 bytes leftover after parsing attributes in process `syz.8.9298'. [ 770.414077][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.611846][T27915] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 771.263525][T23381] usb 14-1: new high-speed USB device number 4 using dummy_hcd [ 771.426624][T23381] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 771.430618][T23381] usb 14-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 771.437190][T23381] usb 14-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 771.444132][T23381] usb 14-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 771.448088][T23381] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 771.451666][T23381] usb 14-1: Product: syz [ 771.453618][T23381] usb 14-1: Manufacturer: syz [ 771.453918][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.455650][T23381] usb 14-1: SerialNumber: syz [ 772.151657][T27949] veth1_to_bond: entered allmulticast mode [ 772.156067][T27949] veth1_to_bond: left allmulticast mode [ 772.338924][ C2] bridge0: port 2(bridge_slave_1) entered forwarding state [ 772.342008][ C2] bridge0: topology change detected, propagating [ 772.345267][ C2] bridge0: port 1(bridge_slave_0) entered forwarding state [ 772.348474][ C2] bridge0: topology change detected, propagating [ 772.488023][T27962] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 772.492096][T27962] CPU: 1 UID: 0 PID: 27962 Comm: syz.8.9335 Tainted: G L syzkaller #0 PREEMPT(full) [ 772.492125][T27962] Tainted: [L]=SOFTLOCKUP [ 772.492132][T27962] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 772.492143][T27962] Call Trace: [ 772.492150][T27962] [ 772.492158][T27962] dump_stack_lvl+0x100/0x190 [ 772.492190][T27962] sysfs_warn_dup.cold+0x1c/0x28 [ 772.492237][T27962] sysfs_create_dir_ns+0x24b/0x2b0 [ 772.492268][T27962] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 772.492292][T27962] ? find_held_lock+0x2b/0x80 [ 772.492316][T27962] ? kobject_add_internal+0x25f/0x930 [ 772.492349][T27962] ? kobject_add_internal+0x25f/0x930 [ 772.492378][T27962] ? class_dir_child_ns_type+0xd/0x60 [ 772.492426][T27962] kobject_add_internal+0x2c8/0x930 [ 772.492461][T27962] kobject_add+0x16a/0x1e0 [ 772.492490][T27962] ? __pfx_kobject_add+0x10/0x10 [ 772.492520][T27962] ? get_device_parent+0x1b3/0x4c0 [ 772.492556][T27962] ? kobject_put+0xb9/0x640 [ 772.492592][T27962] device_add+0x294/0x1970 [ 772.492622][T27962] ? lockdep_init_map_type+0x5c/0x250 [ 772.492643][T27962] ? __pfx_device_add+0x10/0x10 [ 772.492671][T27962] ? lockdep_init_map_type+0x5c/0x250 [ 772.492690][T27962] ? __init_waitqueue_head+0xca/0x150 [ 772.492717][T27962] tty_register_device_attr+0x388/0x7f0 [ 772.492746][T27962] ? lockdep_init_map_type+0x5c/0x250 [ 772.492765][T27962] ? __pfx_tty_register_device_attr+0x10/0x10 [ 772.492797][T27962] ? tty_port_init+0x156/0x1c0 [ 772.492826][T27962] gsm_activate_mux+0x155/0x2a0 [ 772.492854][T27962] gsmld_ioctl+0xbbc/0x15c0 [ 772.492878][T27962] ? __pfx_gsmld_ioctl+0x10/0x10 [ 772.493104][T27962] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 772.493144][T27962] ? __pfx_gsmld_ioctl+0x10/0x10 [ 772.493164][T27962] tty_compat_ioctl+0x396/0x420 [ 772.493190][T27962] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 772.493240][T27962] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 772.493276][T27962] __do_fast_syscall_32+0xe7/0x970 [ 772.493306][T27962] do_fast_syscall_32+0x32/0x70 [ 772.493331][T27962] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 772.493355][T27962] RIP: 0023:0xf6fcefec [ 772.493393][T27962] Code: Unable to access opcode bytes at 0xf6fcefc2. [ 772.493403][T27962] RSP: 002b:00000000f539c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 772.493421][T27962] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000404c4701 [ 772.493433][T27962] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 772.493445][T27962] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 772.493455][T27962] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 772.493467][T27962] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 772.493493][T27962] [ 772.504850][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.509291][T27962] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 772.827160][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.196198][ T42] audit: type=1800 audit(1785494616.901:2098): pid=27979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.9344" name="control" dev="configfs" ino=121715 res=0 errno=0 [ 773.543701][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.564817][T27995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.574670][T27995] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.581906][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.590761][T27997] loop5: detected capacity change from 0 to 7 [ 773.598697][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.602694][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.607271][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.611482][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.615803][ C3] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.619512][ C3] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.625493][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.629507][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.635717][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.640099][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.644306][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.648637][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.658440][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.664160][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.668341][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.672432][T27997] ldm_validate_partition_table(): Disk read failed. [ 773.677047][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.682661][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.700877][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 773.704395][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.707412][ C0] Buffer I/O error on dev loop5, logical block 0, async page read [ 773.710787][T27997] Dev loop5: unable to read RDB block 0 [ 773.714351][T27997] loop5: unable to read partition table [ 773.716637][T27997] loop5: partition table beyond EOD, truncated [ 773.719003][T27997] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 773.773816][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.782981][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.011205][ T5909] usb 14-1: USB disconnect, device number 4 [ 774.055360][T23381] usb 13-1: new high-speed USB device number 11 using dummy_hcd [ 774.120461][T28017] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 774.206374][T23381] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 774.218745][T23381] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 774.224746][T23381] usb 13-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 774.240794][T23381] usb 13-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 774.246649][T23381] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.382906][T28026] netlink: 762 bytes leftover after parsing attributes in process `syz.6.9366'. [ 774.586460][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.624355][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.809998][T24478] usb 13-1: USB disconnect, device number 11 [ 777.693762][T24478] net_ratelimit: 3 callbacks suppressed [ 777.693774][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.735298][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.893762][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.989959][ T5766] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 778.994537][ T5766] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 778.998488][ T5766] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 779.002359][ T5766] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 779.011433][ T5766] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 779.360539][ T5834] netdevsim netdevsim7 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.364240][ T5834] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.499408][ T5834] netdevsim netdevsim7 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.502643][ T5834] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.717001][ T5834] netdevsim netdevsim7 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.721270][ T5834] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.783819][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.798396][T28030] bridge0: port 1(bridge_slave_0) entered blocking state [ 779.801576][T28030] bridge0: port 1(bridge_slave_0) entered disabled state [ 779.806321][T28030] bridge_slave_0: entered allmulticast mode [ 779.809349][T28030] bridge_slave_0: entered promiscuous mode [ 779.813848][T28030] bridge0: port 2(bridge_slave_1) entered blocking state [ 779.816190][T28030] bridge0: port 2(bridge_slave_1) entered disabled state [ 779.818700][T28030] bridge_slave_1: entered allmulticast mode [ 779.821517][T28030] bridge_slave_1: entered promiscuous mode [ 779.854774][ T5834] netdevsim netdevsim7 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 779.864674][ T5834] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 779.941154][T28030] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 779.949408][T28030] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 779.970516][T28030] team0: Port device team_slave_0 added [ 779.974087][T28030] team0: Port device team_slave_1 added [ 779.988986][T28076] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 779.995774][T28030] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 779.998239][T28030] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 780.006561][T28030] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 780.013152][T28030] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 780.016905][T28030] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 780.028789][T28030] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 780.145448][T28030] hsr_slave_0: entered promiscuous mode [ 780.147972][T28030] hsr_slave_1: entered promiscuous mode [ 780.150618][T28030] debugfs: 'hsr0' already exists in 'hsr' [ 780.152544][T28030] Cannot create hsr debugfs directory [ 780.227003][T28081] syzkaller1: entered promiscuous mode [ 780.229546][T28081] syzkaller1: entered allmulticast mode [ 780.326734][ T5834] bridge_slave_1: left allmulticast mode [ 780.329126][ T5834] bridge_slave_1: left promiscuous mode [ 780.331600][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state [ 780.345262][ T5834] bridge_slave_0: left allmulticast mode [ 780.347157][ T5834] bridge_slave_0: left promiscuous mode [ 780.349036][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state [ 780.356954][ T5834] dvmrp8: left allmulticast mode [ 780.490237][ T5834] gretap0 (unregistering): left allmulticast mode [ 780.545508][ T5834] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 780.550454][ T5834] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 780.558134][ T5834] bond0 (unregistering): Released all slaves [ 780.567963][ T5454] 8021q: adding VLAN 0 to HW filter on device eth1 [ 780.782406][ T5834] tipc: Disabling bearer [ 780.788370][ T5834] tipc: Left network mode [ 780.814482][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.826760][ T5454] 8021q: adding VLAN 0 to HW filter on device eth10 [ 781.054111][ T5454] 8021q: adding VLAN 0 to HW filter on device eth11 [ 781.135522][T17342] Bluetooth: hci1: command tx timeout [ 781.181284][ T5834] hsr_slave_0: left promiscuous mode [ 781.184481][ T5834] hsr_slave_1: left promiscuous mode [ 781.186515][ T5834] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 781.188919][ T5834] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 781.191837][ T5834] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 781.194366][ T5834] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 781.209497][ T5834] veth1_macvtap: left promiscuous mode [ 781.215023][ T5834] veth1_vlan: left promiscuous mode [ 781.216833][ T5834] veth0_vlan: left promiscuous mode [ 781.401942][ T5834] team0 (unregistering): Port device team_slave_1 removed [ 781.430678][ T5834] team0 (unregistering): Port device team_slave_0 removed [ 781.521079][ T5454] 8021q: adding VLAN 0 to HW filter on device eth12 [ 781.862776][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.935106][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.977067][T28030] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 781.981363][T28030] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 781.984771][T28030] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 781.989196][T28030] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 781.992045][T28030] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 781.997834][T28030] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 782.000670][T28030] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 782.013893][T28030] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 782.069748][T28030] 8021q: adding VLAN 0 to HW filter on device bond0 [ 782.083301][T28030] 8021q: adding VLAN 0 to HW filter on device team0 [ 782.090194][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 782.092941][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 782.100242][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 782.102855][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 782.354834][T28030] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 782.394856][T28030] veth0_vlan: entered promiscuous mode [ 782.408528][T28030] veth1_vlan: entered promiscuous mode [ 782.430584][T28030] veth0_macvtap: entered promiscuous mode [ 782.437630][T28030] veth1_macvtap: entered promiscuous mode [ 782.450622][T28030] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 782.466256][T28030] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 782.485593][ T5834] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.507405][ T5834] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.518440][ T5834] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.555558][ T7979] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.595621][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 782.609667][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 782.646534][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 782.649090][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 782.883297][T28184] lo: entered promiscuous mode [ 782.885591][T28184] lo: entered allmulticast mode [ 782.888181][T28184] tunl0: entered promiscuous mode [ 782.889847][T28184] tunl0: entered allmulticast mode [ 782.891972][T28184] gre0: entered promiscuous mode [ 782.894118][T28184] gre0: entered allmulticast mode [ 782.896454][T28184] gretap0: entered promiscuous mode [ 782.898124][T28184] gretap0: entered allmulticast mode [ 782.900367][T28184] erspan0: entered promiscuous mode [ 782.902514][T28184] erspan0: entered allmulticast mode [ 782.904475][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.908510][T28184] ip_vti0: entered promiscuous mode [ 782.910256][T28184] ip_vti0: entered allmulticast mode [ 782.912414][T28184] ip6_vti0: entered promiscuous mode [ 782.915964][T28184] ip6_vti0: entered allmulticast mode [ 782.918258][T28184] sit0: entered promiscuous mode [ 782.919875][T28184] sit0: entered allmulticast mode [ 782.921930][T28184] ip6tnl0: entered promiscuous mode [ 782.926210][T28184] ip6tnl0: entered allmulticast mode [ 782.929439][T28184] ip6gre0: entered promiscuous mode [ 782.931163][T28184] ip6gre0: entered allmulticast mode [ 782.933270][T28184] syz_tun: entered promiscuous mode [ 782.935174][T28184] syz_tun: entered allmulticast mode [ 782.938264][T28184] ip6gretap0: entered promiscuous mode [ 782.940042][T28184] ip6gretap0: entered allmulticast mode [ 782.942546][T28184] bridge0: entered promiscuous mode [ 782.944620][T28184] bridge0: entered allmulticast mode [ 783.213790][ T5903] usb 14-1: new high-speed USB device number 5 using dummy_hcd [ 783.224116][T17342] Bluetooth: hci1: command tx timeout [ 783.367384][ T5903] usb 14-1: config 0 has no interfaces? [ 783.372445][ T5903] usb 14-1: New USB device found, idVendor=0425, idProduct=a4a1, bcdDevice= 0.40 [ 783.375903][ T5903] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 783.378845][ T5903] usb 14-1: SerialNumber: syz [ 783.934288][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.334058][T24478] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 784.364319][T28234] 9pnet_virtio: no channels available for device 127.0.0.1 [ 784.437557][T28242] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 784.535997][T28251] netlink: 'syz.0.9408': attribute type 10 has an invalid length. [ 784.539293][T28251] syz_tun: left allmulticast mode [ 784.547624][T28251] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 784.983804][ T5430] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.989022][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.293760][T17342] Bluetooth: hci1: command tx timeout [ 785.775141][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.934692][ T5909] usb 14-1: USB disconnect, device number 5 [ 786.016083][ T5864] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.064896][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.374133][T17342] Bluetooth: hci1: command tx timeout [ 788.015139][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.093905][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.639813][T28285] IPv6: A: Disabled Multicast RS [ 788.956716][T28305] batadv_slave_1: entered promiscuous mode [ 788.960001][T28304] batadv_slave_1: left promiscuous mode [ 788.986223][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.133827][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.262243][T28312] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 789.297817][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.774163][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.139915][T28342] syzkaller1: entered promiscuous mode [ 790.147973][ T42] audit: type=1326 audit(1785494633.851:2099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.148406][T28342] syzkaller1: entered allmulticast mode [ 790.162485][ T42] audit: type=1326 audit(1785494633.851:2100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.170112][ T42] audit: type=1326 audit(1785494633.861:2101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=430 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.180909][ T42] audit: type=1326 audit(1785494633.861:2102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.188041][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.200053][ T42] audit: type=1326 audit(1785494633.861:2103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=431 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.213524][ T42] audit: type=1326 audit(1785494633.861:2104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.230912][ T42] audit: type=1326 audit(1785494633.861:2105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.243124][ T42] audit: type=1326 audit(1785494633.871:2106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=432 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.256600][ T42] audit: type=1326 audit(1785494633.871:2107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.266020][ T42] audit: type=1326 audit(1785494633.871:2108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28344 comm="syz.0.9436" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f02fec code=0x7ffc0000 [ 790.801268][T28378] syzkaller1: entered promiscuous mode [ 790.814230][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 790.818038][T28378] syzkaller1: entered allmulticast mode [ 791.055597][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.075898][T28383] netlink: 16 bytes leftover after parsing attributes in process `syz.6.9454'. [ 791.213945][T24478] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.517217][T28414] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9468'. [ 791.523591][T28414] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9468'. [ 791.526399][T28414] netlink: 8 bytes leftover after parsing attributes in process `syz.6.9468'. [ 791.533476][ C2] bridge0: port 1(bridge_slave_0) entered learning state [ 791.543510][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 791.546558][T28416] binder: 28415:28416 ioctl 4018620d 0 returned -22 [ 791.612593][T28419] fuse: Bad value for 'fd' [ 793.303730][ T5844] net_ratelimit: 11 callbacks suppressed [ 793.303743][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.613497][T28410] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 793.623468][ T5766] Bluetooth: hci2: command 0x0c1a tx timeout [ 793.934290][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.104281][T25732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.107484][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.115027][ T5910] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.343777][ T5844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.455924][T28410] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 794.458011][T28410] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 794.460077][T28410] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 794.462085][T28410] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 794.469633][T28410] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 794.790895][T17342] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 794.800343][T17342] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 794.806102][T17342] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 794.814271][T17342] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 794.822058][T17342] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 794.975789][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.308676][T28453] bridge0: port 1(bridge_slave_0) entered blocking state [ 795.311086][T28453] bridge0: port 1(bridge_slave_0) entered disabled state [ 795.313977][T28453] bridge_slave_0: entered allmulticast mode [ 795.316680][T28453] bridge_slave_0: entered promiscuous mode [ 795.320756][T28453] bridge0: port 2(bridge_slave_1) entered blocking state [ 795.323181][T28453] bridge0: port 2(bridge_slave_1) entered disabled state [ 795.326382][T28453] bridge_slave_1: entered allmulticast mode [ 795.329269][T28453] bridge_slave_1: entered promiscuous mode [ 795.353248][T28453] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 795.362107][T28453] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 795.383122][T28453] team0: Port device team_slave_0 added [ 795.385567][ T5909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.386581][T25732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.392269][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.404760][T28453] team0: Port device team_slave_1 added [ 795.424627][T28453] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 795.427742][T28453] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.438574][T28453] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 795.446118][T28453] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 795.449204][T28453] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 795.459797][T28453] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 795.486886][T28453] hsr_slave_0: entered promiscuous mode [ 795.489375][T28453] hsr_slave_1: entered promiscuous mode [ 795.491675][T28453] debugfs: 'hsr0' already exists in 'hsr' [ 795.493663][T28453] Cannot create hsr debugfs directory [ 795.698189][T28510] netlink: 58 bytes leftover after parsing attributes in process `syz.9.9500'. [ 795.701076][T28510] netlink: 12 bytes leftover after parsing attributes in process `syz.9.9500'. [ 795.802017][T28510] netlink: 58 bytes leftover after parsing attributes in process `syz.9.9500'. [ 795.836060][T28521] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 795.839872][T28521] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 795.842581][T28521] CPU: 0 UID: 0 PID: 28521 Comm: syz.0.9501 Tainted: G L syzkaller #0 PREEMPT(full) [ 795.845972][T28521] Tainted: [L]=SOFTLOCKUP [ 795.847357][T28521] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 795.850645][T28521] RIP: 0010:dummy_udc_start+0x91/0x1d0 [ 795.852455][T28521] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 [ 795.858640][T28521] RSP: 0018:ffffc90008a37b28 EFLAGS: 00010246 [ 795.860607][T28521] RAX: dffffc0000000000 RBX: ffff8880254b0c00 RCX: ffffc9000c400000 [ 795.863138][T28521] RDX: 0000000000000000 RSI: ffffffff87ce6aa7 RDI: ffff8880254b1290 [ 795.866084][T28521] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000005 [ 795.868574][T28521] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88806c132050 [ 795.871062][T28521] R13: 0000000000000000 R14: ffff888029e044f1 R15: ffff888029e04008 [ 795.873536][T28521] FS: 0000000000000000(0000) GS:ffff888096be1000(0063) knlGS:00000000f53c6b40 [ 795.876340][T28521] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 795.878410][T28521] CR2: 00000000f53c3edc CR3: 0000000060e4d000 CR4: 0000000000352ef0 [ 795.880896][T28521] Call Trace: [ 795.881962][T28521] [ 795.882914][T28521] gadget_bind_driver+0x4ac/0xbf0 [ 795.884523][T28521] ? __pfx_gadget_bind_driver+0x10/0x10 [ 795.886258][T28521] really_probe+0x241/0xa60 [ 795.887720][T28521] __driver_probe_device+0x20e/0x450 [ 795.889401][T28521] driver_probe_device+0x4a/0x140 [ 795.891008][T28521] __driver_attach+0x21f/0x5b0 [ 795.892541][T28521] ? __pfx___driver_attach+0x10/0x10 [ 795.894373][T28521] bus_for_each_dev+0x13e/0x1d0 [ 795.895937][T28521] ? __pfx_bus_for_each_dev+0x10/0x10 [ 795.897630][T28521] ? bus_add_driver+0x2b5/0x5b0 [ 795.899181][T28521] bus_add_driver+0x305/0x5b0 [ 795.900677][T28521] driver_register+0x1e2/0x360 [ 795.902200][T28521] ? rcu_is_watching+0x12/0xc0 [ 795.903757][T28521] usb_gadget_register_driver_owner+0x132/0x210 [ 795.905731][T28521] raw_ioctl+0x1a85/0x2b80 [ 795.907184][T28521] ? __pfx_raw_ioctl+0x10/0x10 [ 795.908711][T28521] ? __pfx_raw_ioctl+0x10/0x10 [ 795.910229][T28521] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 795.911978][T28521] __do_fast_syscall_32+0xe7/0x970 [ 795.913600][T28521] do_fast_syscall_32+0x32/0x70 [ 795.915168][T28521] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 795.917168][T28521] RIP: 0023:0xf7f02fec [ 795.918464][T28521] Code: Unable to access opcode bytes at 0xf7f02fc2. [ 795.920544][T28521] RSP: 002b:00000000f53c4424 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 795.923148][T28521] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005501 [ 795.925625][T28521] RDX: 0000000000000000 RSI: 00000000f7397ff4 RDI: 00000000f53c54c0 [ 795.928095][T28521] RBP: 00000000f7397ff4 R08: 0000000000000000 R09: 0000000000000000 [ 795.930564][T28521] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 795.933040][T28521] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 795.935522][T28521] [ 795.936509][T28521] Modules linked in: [ 795.938545][T28521] ---[ end trace 0000000000000000 ]--- [ 795.943282][T28521] RIP: 0010:dummy_udc_start+0x91/0x1d0 [ 795.946317][T28521] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 [ 795.952681][T28521] RSP: 0018:ffffc90008a37b28 EFLAGS: 00010246 [ 795.955121][T28521] RAX: dffffc0000000000 RBX: ffff8880254b0c00 RCX: ffffc9000c400000 [ 795.957965][T28521] RDX: 0000000000000000 RSI: ffffffff87ce6aa7 RDI: ffff8880254b1290 [ 795.962935][T28521] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000005 [ 795.967947][T28521] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88806c132050 [ 795.976545][T28521] R13: 0000000000000000 R14: ffff888029e044f1 R15: ffff888029e04008 [ 795.979205][T28521] FS: 0000000000000000(0000) GS:ffff888096be1000(0063) knlGS:00000000f53c6b40 [ 795.982226][T28521] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 795.985063][T28521] CR2: 00000000f7f03000 CR3: 0000000060e4d000 CR4: 0000000000352ef0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 795.993673][T28521] Kernel panic - not syncing: Fatal exception [ 795.996238][T28521] Kernel Offset: disabled [ 795.997607][T28521] Rebooting in 86400 seconds..