last executing test programs: 6.46514384s ago: executing program 3 (id=156): kexec_load(0x3, 0x0, &(0x7f00000005c0), 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) listen(r1, 0x4) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', 0x0, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB='max=00000000000000000000004,max=00000000000000000000007,subj_role=xfrm0\x00,obj_user=$,$}+%\\!,obj_user=,fowner>', @ANYRESDEC=0x0, @ANYBLOB="cdd821ba961235ac06cf3ddd81026dd4ddc9ce28c88d95334d8cd649c0892ab90d42cb9e0b6e5434e2daca8b0f734b2f4e99a5d9e8e41086819ea9351f85f417e7f539ad8519a50289fee20dba34532e2c76eb7560d721e763bbcc1655f3901b9ec8131846de313ec01c09d9f9279d6d12ed38e42a5f4bab97f9fd4c7c1db50ba54357c0ff6c68251aa8da12f23fa24c354d2897c65cdc883f8e1b5768ff59648e35ae6c66e3d28b1bd42e7734c2de9cb8b4b24b5c63e060603cc473adf622e527427b1c47a755"]) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x24048044) socket(0x10, 0x803, 0x4) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_FLOW={0x8, 0xb, 0x7}]}, 0x24}}, 0x0) 5.794493487s ago: executing program 3 (id=159): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40040e0}, 0x0) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 5.501530254s ago: executing program 3 (id=161): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x814) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'sit0\x00'}) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xfff, 0x999, 0x7, 0x800, 0xfff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240408a4}, 0x4890) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000002380)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) 4.914679339s ago: executing program 0 (id=164): syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000"], 0x0) unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000000140)=ANY=[], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040)={0x2000000}, 0x10}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000840)={r2}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x2f00020b, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xae5b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) 4.657903385s ago: executing program 3 (id=166): r0 = syz_usb_connect(0x0, 0x8a, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x34, r1, 0x917, 0xa7, 0x1000000, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}]}, 0x34}}, 0x408c0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r2, 0x10040) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x7fffffffffffffff]}, 0x8, 0x80000) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x4, 0x800, 0x0, 0x3}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x6, 0x3, 0x0, 0x20001, 0x7, 0xffffffffffffffff}, 0x0, 0x0) ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000040)=0x10004) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 4.378519152s ago: executing program 1 (id=169): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f00000005c0)={0x7, 0x0, [{0x4b564d02, 0x0, 0x5}, {0xa3e, 0x0, 0x85c9}, {0x97b, 0x0, 0x7}, {0x8be, 0x0, 0x9}, {0x225, 0x0, 0x7fffffffffffffff}, {0x8b4, 0x0, 0x10000}, {0xb31, 0x0, 0x7}]}) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0xa, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x6, 0x8, 0x8, 0x42}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000200), &(0x7f0000000040), 0xce, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) clock_adjtime(0x0, &(0x7f00000002c0)={0x53d, 0x40, 0x0, 0x3, 0x48c, 0x800, 0xd, 0x424, 0x2, 0x2, 0xf423f, 0xfffffffffffffff9, 0x8, 0x2, 0x1000000081, 0x5, 0x0, 0x5, 0x0, 0x9220000000000000, 0xd91, 0x0, 0x80000001, 0x0, 0x5, 0x40000000007}) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f00000001c0)={0x1, 0x0, [{0xc0010141}]}) socket$kcm(0x10, 0x400000002, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'lo\x00'}) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r6, 0x8008f512, &(0x7f0000000200)) clock_adjtime(0x1, &(0x7f0000000480)={0x5, 0xfffffffffffffff2, 0x9, 0xe359, 0x1, 0x8000000000000001, 0xff, 0x4d5d37f2, 0x3, 0x3, 0xa1, 0xc56, 0xfffffffffffff180, 0x8, 0x8, 0x8, 0xa, 0x6, 0x5, 0x6, 0x1ff, 0x1ff, 0x4ad1, 0x2, 0x3, 0x7}) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x280440e, &(0x7f0000000800)={[{@debug}, {@nojournal_checksum}, {@discard}, {@delalloc}, {@noinit_itable}, {@norecovery}, {@minixdf}, {@nodioread_nolock}, {@errors_remount}, {@jqfmt_vfsv0}, {@usrquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4}}, {@oldalloc}]}, 0xfe, 0xbe8, &(0x7f0000002080)="$eJzs3MtrXNcZAPDvXo0etuWOXEqpu7FKKTaUjmUXmdoUaheXbrooJNuAhTwyQuMHkoIjWZBR8g+EJP9ANlkkJsGLeO1NAtlmkzjbmCwCJihWAiEkCncelizNSLI10pWl3w+O5jzu3PN9uqO554BmAti3BrMfacTRiLiURBQb/WlE9NRqfRHV+nGLC3OjPyzMjSaxtPTCt0kkEfFoYW60ea6k8Xio0eiLiM/+ncRvX18779TM7MRIpVKebLRPTl+9cXJqZvZv41dHrpSvlK+dOvOP4dPDZ4bODncs1x+/On/3+z/99+vqT+/9fPu7t95N4nz0N8ZW5tHIessGY/Dx72SlQkSMdOD8u0FXI5+VeSaF9Z6R1F9cAADkIl2xhvt9FKMrlhdvxfj481yDAwAAADpiqStiCQAAANjjEvt/AAAA2OOa/wfwaGFutFny/Y+EnfXwQkQM1PNfbJT6SCGqtce+6I6Ig4+SWPmx1qT+tC0bjIgHX579MCvR4nPI2606HxF/aHX9k1r+A41PQq/OP42IoQ7MP7iq/Tzlf74D8+edPwD7070L9RvZ2vtf+nj9Ey3uf4UW965nkff9r7n+W1yz/lvOv6vN+u//m5zjViFuthvL8v/n3f980CzZ/Nlj9G4prU17OB/xx0Kr/Gvrn6VmGK3yv7TBuZOo/wqLv9wstzumbf47ZOmdiOPROv+mZP3vJzo5Nl4pD9V/tpxj/tPh99vNn3f+2fU/2Cb/5us/WXv9+7K+G0+cqf2X+rx08eKdNZ2NwzfOP/2mJ3mxVutp9LwyMj09eSqiJ/nf2v7T6+fbPKZ5jiz/E39e/++/Rf6194Rq47WRpTLfeMzar62a81+3b33ULp7m/i/P63/56a9/re+NTc7xl0/ePLG6r/n9Wiv3v1nJ5n+Q1PfCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCURkR/JGkpIpJaPU1LpYhDEfG7OJhWrk9N/3Xs+svXLmdjEQPRnY6NV8pDEVGst5OsfapWX26fXtX+e0QciYi3iwdq7dLo9crlvJMHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgsUMR0R9JWoqINCIWi2laKuUdFQAAANBxA3kHAAAAAGw7+38AAADY++z/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2GZHjt27n0RE9dyBWsn0NMa6c40M2G5p3gEAuenKOwAgN4W8AwBy85R7fMsF2IOSDcb7WvZm7x692xIPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALvT8aP37icRUT13oFYyPY2x7pbPOLaD0QHbKc07ACA3XesNFnYuDmDnPfOf+OHOxgHsvNZ7fGA/STYY71s+pvrkSO+2xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA7tNfK0laioi0Vk/TUinicEQMRHcyNl4pD0XEbyLii2J3b9buzTtoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOm5qZnZipFIpTz5LJdna05+XStfuCGNfVV7dHWHsbCWpVfryDqNeyfudCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAPEzNzE6MVCrlyam8IwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyNjUzOzFSqZQnN1G58zQHr6jknSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPn5NQAA///JxAzd") 3.725927848s ago: executing program 4 (id=170): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) listen(r1, 0x4) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', 0x0, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB='max=00000000000000000000004,max=00000000000000000000007,subj_role=xfrm0\x00,obj_user=$,$}+%\\!,obj_user=,fowner>', @ANYRESDEC=0x0, @ANYBLOB="cdd821ba961235ac06cf3ddd81026dd4ddc9ce28c88d95334d8cd649c0892ab90d42cb9e0b6e5434e2daca8b0f734b2f4e99a5d9e8e41086819ea9351f85f417e7f539ad8519a50289fee20dba34532e2c76eb7560d721e763bbcc1655f3901b9ec8131846de313ec01c09d9f9279d6d12ed38e42a5f4bab97f9fd4c7c1db50ba54357c0ff6c68251aa8da12f23fa24c354d2897c65cdc883f8e1b5768ff59648e35ae6c66e3d28b1bd42e7734c2de9cb8b4b24b5c63e060603cc473adf622e527427b1c47a755"]) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x24048044) socket(0x10, 0x803, 0x4) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_FLOW={0x8, 0xb, 0x7}]}, 0x24}}, 0x0) 3.457347345s ago: executing program 1 (id=171): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40040e0}, 0x0) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 3.350423747s ago: executing program 0 (id=172): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f00000002c0)=[{0x99, 0x2000, 0x0, 0x0}], 0x1}) 3.166931782s ago: executing program 1 (id=174): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200)) 3.045800115s ago: executing program 1 (id=175): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001ddf8208c00712152230000000010902"], 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x0) 2.690891644s ago: executing program 4 (id=177): openat$procfs(0xffffffffffffff9c, &(0x7f0000004280)='/proc/partitions\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x5, 0xa, 0x10002}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x5, 0x3, 0x8, 0x6, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x10000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x27, 0xd5, 0x2}, {0x4000, 0x80a0000, 0x9, 0x9, 0x8f, 0x4, 0x83, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1000, 0xf, 0x0, 0x3, 0x0, 0x4b, 0x9, 0x3, 0x0, 0x4, 0x30}, {0x1000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0x9000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0xd, 0x7, 0x3, 0x80, 0x87}, {0x6000, 0x8000}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x0, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xa}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x2, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0x1, 0x3, 0x26}, {0xcf, 0xfa, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0x7, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$netlink(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000001a00)={0x10, 0x25, 0x4, 0x70bd26, 0x25dfdbff}, 0x10}], 0x1, 0x0, 0x0, 0x20000801}, 0x40010) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r1) recvmmsg(r1, &(0x7f00000086c0)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/154, 0x9a}, {&(0x7f0000000880)=""/4111, 0x100f}], 0x2}, 0xa}], 0x1, 0x8042, 0x0) write$char_usb(r0, &(0x7f0000000040)="e2", 0x12d8) 2.535770868s ago: executing program 4 (id=178): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x442, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x8ca02, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e2306010001000000440002000000000000000000b556a705251e6182149a08c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c1504bb918689d9193e9bd1c1b", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40044) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r3, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r3, 0x89ed, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0xaad80) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x48850) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00'}) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@o_path={&(0x7f0000000140)='./cgroup.cpu/cgroup.procs/file0\x00', r0, 0x4000, r4}, 0x18) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, 0x0, 0x20040000) bind$inet6(r5, 0x0, 0x0) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) ioctl$SNDCTL_TMR_SELECT(r1, 0x40045408) 2.368910242s ago: executing program 4 (id=179): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240408a0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 2.232865625s ago: executing program 4 (id=180): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0xc, 0x0, 0x0, 0x80}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(&(0x7f0000000180)='configfs\x00', 0x1) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) timer_create(0x0, &(0x7f00000000c0)={0x0, 0xe, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0e0000"], 0xc) 2.057879319s ago: executing program 2 (id=181): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$igmp(0x2, 0x3, 0x2) openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000500)='ohci-pl', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/platform/drivers/ohci-platform/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='QEMU0001:00', 0xb) 1.64599418s ago: executing program 3 (id=182): syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000"], 0x0) unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000000140)=ANY=[], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040)={0x2000000}, 0x10}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000840)={r2}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x2f00020b, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xae5b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "bd88818314ff7d84", "0b3ea924c47b25d7624cd362581725c7", "000400", "d5a1d50399459b68"}, 0x28) 1.605454211s ago: executing program 4 (id=183): r0 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x42, 0xb2) ftruncate(r0, 0x200000) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r2, &(0x7f0000000300)={&(0x7f0000000000)={0xa, 0x4e23, 0x2, @empty, 0x4}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)='P', 0x1}], 0x1}, 0x400c814) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r4, &(0x7f0000000480)=""/74, 0x49) write$char_usb(r4, 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0x494, &(0x7f0000002340)=ANY=[]) 1.470918684s ago: executing program 0 (id=184): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f00000005c0)={0x7, 0x0, [{0x4b564d02, 0x0, 0x5}, {0xa3e, 0x0, 0x85c9}, {0x97b, 0x0, 0x7}, {0x8be, 0x0, 0x9}, {0x225, 0x0, 0x7fffffffffffffff}, {0x8b4, 0x0, 0x10000}, {0xb31, 0x0, 0x7}]}) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0xa, 0x4, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x2}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x9, 0x6, 0x8, 0x8, 0x42}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000200), &(0x7f0000000040), 0xce, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) clock_adjtime(0x0, &(0x7f00000002c0)={0x53d, 0x40, 0x0, 0x3, 0x48c, 0x800, 0xd, 0x424, 0x2, 0x2, 0xf423f, 0xfffffffffffffff9, 0x8, 0x2, 0x1000000081, 0x5, 0x0, 0x5, 0x0, 0x9220000000000000, 0xd91, 0x0, 0x80000001, 0x0, 0x5, 0x40000000007}) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r6, 0xc008ae88, &(0x7f00000001c0)={0x1, 0x0, [{0xc0010141}]}) socket$kcm(0x10, 0x400000002, 0x0) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'lo\x00'}) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r6, 0x8008f512, &(0x7f0000000200)) clock_adjtime(0x1, &(0x7f0000000480)={0x5, 0xfffffffffffffff2, 0x9, 0xe359, 0x1, 0x8000000000000001, 0xff, 0x4d5d37f2, 0x3, 0x3, 0xa1, 0xc56, 0xfffffffffffff180, 0x8, 0x8, 0x8, 0xa, 0x6, 0x5, 0x6, 0x1ff, 0x1ff, 0x4ad1, 0x2, 0x3, 0x7}) sendto$inet(r3, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x280440e, &(0x7f0000000800)={[{@debug}, {@nojournal_checksum}, {@discard}, {@delalloc}, {@noinit_itable}, {@norecovery}, {@minixdf}, {@nodioread_nolock}, {@errors_remount}, {@jqfmt_vfsv0}, {@usrquota}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x4}}, {@oldalloc}]}, 0xfe, 0xbe8, &(0x7f0000002080)="$eJzs3MtrXNcZAPDvXo0etuWOXEqpu7FKKTaUjmUXmdoUaheXbrooJNuAhTwyQuMHkoIjWZBR8g+EJP9ANlkkJsGLeO1NAtlmkzjbmCwCJihWAiEkCncelizNSLI10pWl3w+O5jzu3PN9uqO554BmAti3BrMfacTRiLiURBQb/WlE9NRqfRHV+nGLC3OjPyzMjSaxtPTCt0kkEfFoYW60ea6k8Xio0eiLiM/+ncRvX18779TM7MRIpVKebLRPTl+9cXJqZvZv41dHrpSvlK+dOvOP4dPDZ4bODncs1x+/On/3+z/99+vqT+/9fPu7t95N4nz0N8ZW5tHIessGY/Dx72SlQkSMdOD8u0FXI5+VeSaF9Z6R1F9cAADkIl2xhvt9FKMrlhdvxfj481yDAwAAADpiqStiCQAAANjjEvt/AAAA2OOa/wfwaGFutFny/Y+EnfXwQkQM1PNfbJT6SCGqtce+6I6Ig4+SWPmx1qT+tC0bjIgHX579MCvR4nPI2606HxF/aHX9k1r+A41PQq/OP42IoQ7MP7iq/Tzlf74D8+edPwD7070L9RvZ2vtf+nj9Ey3uf4UW965nkff9r7n+W1yz/lvOv6vN+u//m5zjViFuthvL8v/n3f980CzZ/Nlj9G4prU17OB/xx0Kr/Gvrn6VmGK3yv7TBuZOo/wqLv9wstzumbf47ZOmdiOPROv+mZP3vJzo5Nl4pD9V/tpxj/tPh99vNn3f+2fU/2Cb/5us/WXv9+7K+G0+cqf2X+rx08eKdNZ2NwzfOP/2mJ3mxVutp9LwyMj09eSqiJ/nf2v7T6+fbPKZ5jiz/E39e/++/Rf6194Rq47WRpTLfeMzar62a81+3b33ULp7m/i/P63/56a9/re+NTc7xl0/ePLG6r/n9Wiv3v1nJ5n+Q1PfCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCURkR/JGkpIpJaPU1LpYhDEfG7OJhWrk9N/3Xs+svXLmdjEQPRnY6NV8pDEVGst5OsfapWX26fXtX+e0QciYi3iwdq7dLo9crlvJMHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgsUMR0R9JWoqINCIWi2laKuUdFQAAANBxA3kHAAAAAGw7+38AAADY++z/AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2GZHjt27n0RE9dyBWsn0NMa6c40M2G5p3gEAuenKOwAgN4W8AwBy85R7fMsF2IOSDcb7WvZm7x692xIPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALvT8aP37icRUT13oFYyPY2x7pbPOLaD0QHbKc07ACA3XesNFnYuDmDnPfOf+OHOxgHsvNZ7fGA/STYY71s+pvrkSO+2xQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA7tNfK0laioi0Vk/TUinicEQMRHcyNl4pD0XEbyLii2J3b9buzTtoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOm5qZnZipFIpTz5LJdna05+XStfuCGNfVV7dHWHsbCWpVfryDqNeyfudCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAPEzNzE6MVCrlyam8IwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyNjUzOzFSqZQnN1G58zQHr6jknSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPn5NQAA///JxAzd") 982.988166ms ago: executing program 2 (id=185): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x40040e0}, 0x0) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 771.623491ms ago: executing program 2 (id=186): r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000100)) r1 = openat$audio(0xffffffffffffff9c, 0x0, 0x88602, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r2, 0x4112, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x800c5012, &(0x7f0000000200)) 721.856442ms ago: executing program 1 (id=187): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xc, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff5656d, 0x70bd29, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0x1, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x8, 0x8, 0xfbee}, 0x1, 0x0, 0x3, 0x5, 0xe, 0x8, 0xd, 0x18, 0x5, 0x4, {0x6, 0xc, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x44890) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 649.917254ms ago: executing program 2 (id=188): openat$procfs(0xffffffffffffff9c, &(0x7f0000004280)='/proc/partitions\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x5, 0xa, 0x10002}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000140)={{0xffff1000, 0xeeee8000, 0x4, 0xf6, 0x2, 0xf3, 0xd7, 0x8, 0x7, 0x1, 0x9, 0x5}, {0x50000, 0xc0a0c0f0f5000ded, 0xd, 0x5, 0x3, 0x8, 0x6, 0x0, 0x80, 0xfc, 0xfc, 0x4}, {0x200000, 0x10000, 0xb, 0x6, 0xff, 0x3, 0x0, 0x5, 0xef, 0x27, 0xd5, 0x2}, {0x4000, 0x80a0000, 0x9, 0x9, 0x8f, 0x4, 0x83, 0xfc, 0xb, 0x1, 0x9, 0x3}, {0xffffffff, 0x0, 0x3, 0x2, 0x6, 0x1, 0x9, 0x2, 0x3, 0x3, 0x0, 0xe4}, {0x200000, 0xffff1000, 0xf, 0x0, 0x3, 0x0, 0x4b, 0x9, 0x3, 0x0, 0x4, 0x30}, {0x1000, 0x9000, 0xc, 0x1, 0x8, 0x3, 0x2, 0x6, 0x91, 0x8, 0x9, 0x88}, {0x8000000, 0x9000, 0x10, 0x6, 0xc2, 0x8, 0x6, 0xd, 0x7, 0x3, 0x80, 0x87}, {0x6000, 0x8000}, {0xe9eb89d253be8b8b, 0x9}, 0x50000, 0x0, 0x0, 0x400408, 0x6, 0x0, 0xeeef0000, [0x6, 0x5, 0x5, 0xe]}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f00000000c0)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0x0, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x8000000, 0x9, 0x10001, 0xfffffffd, 0x0, [{0x2, 0x2, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xa}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x2, 0xf5, '\x00', 0xf}, {0x9, 0x89, 0xc, '\x00', 0xfb}, {0x0, 0x2, 0x54, '\x00', 0xff}, {0x71, 0xd5, 0xf1, '\x00', 0x7f}, {0x3, 0x4, 0x1, '\x00', 0x8}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xd, 0x8, '\x00', 0xa}, {0x0, 0x28, 0x7, '\x00', 0xdc}, {0x40, 0x1, 0x5, '\x00', 0x2}, {0x1, 0x3, 0x26}, {0xcf, 0xfa, 0xb, '\x00', 0x5}, {0xf, 0x6, 0x5, '\x00', 0x10}, {0x39, 0x2, 0x6, '\x00', 0x8}, {0x9, 0x6, 0x2, '\x00', 0x8}, {0x5, 0x7, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7}, {0x0, 0x80, 0x1, '\x00', 0x81}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x3, 0x3, '\x00', 0x10}, {0x1, 0x23, 0x7, '\x00', 0x4}, {0x7, 0x6, 0x4, '\x00', 0x8}]}}) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$netlink(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000001a00)={0x10, 0x25, 0x4, 0x70bd26, 0x25dfdbff}, 0x10}], 0x1, 0x0, 0x0, 0x20000801}, 0x40010) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r1) recvmmsg(r1, &(0x7f00000086c0)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/154, 0x9a}, {&(0x7f0000000880)=""/4111, 0x100f}], 0x2}, 0xa}], 0x1, 0x8042, 0x0) write$char_usb(r0, &(0x7f0000000040)="e2", 0x12d8) 620.484155ms ago: executing program 2 (id=189): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x82, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) listen(r1, 0x4) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs2\x00', 0x0, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB='max=00000000000000000000004,max=00000000000000000000007,subj_role=xfrm0\x00,obj_user=$,$}+%\\!,obj_user=,fowner>', @ANYRESDEC=0x0, @ANYBLOB="cdd821ba961235ac06cf3ddd81026dd4ddc9ce28c88d95334d8cd649c0892ab90d42cb9e0b6e5434e2daca8b0f734b2f4e99a5d9e8e41086819ea9351f85f417e7f539ad8519a50289fee20dba34532e2c76eb7560d721e763bbcc1655f3901b9ec8131846de313ec01c09d9f9279d6d12ed38e42a5f4bab97f9fd4c7c1db50ba54357c0ff6c68251aa8da12f23fa24c354d2897c65cdc883f8e1b5768ff59648e35ae6c66e3d28b1bd42e7734c2de9cb8b4b24b5c63e060603cc473adf622e527427b1c47a755"]) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, 0x0, 0x0) r4 = socket(0x10, 0x803, 0x8) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x40000) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x24048044) socket(0x10, 0x803, 0x4) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_FLOW={0x8, 0xb, 0x7}]}, 0x24}}, 0x0) 544.250927ms ago: executing program 0 (id=190): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240408a0}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 461.822239ms ago: executing program 1 (id=191): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81}, 0x814) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'sit0\x00'}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xfff, 0x999, 0x7, 0x800, 0xfff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240408a4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000002380)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 312.373563ms ago: executing program 0 (id=192): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x442, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8ca02, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e2306010001000000440002000000000000000000b556a705251e6182149a08c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c1504bb918689d9193e9bd1c1b", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40044) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r3, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r3, 0x89ed, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, 0x0, 0xaad80) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x48850) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wpan3\x00'}) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@o_path={&(0x7f0000000140)='./cgroup.cpu/cgroup.procs/file0\x00', r0, 0x4000, r4}, 0x18) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, 0x0, 0x20040000) bind$inet6(r5, 0x0, 0x0) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r6, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) ioctl$SNDCTL_TMR_SELECT(r1, 0x40045408) 131.426397ms ago: executing program 0 (id=193): bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x3, 0xc, 0x0, 0x0, 0x80}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(&(0x7f0000000180)='configfs\x00', 0x1) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) timer_create(0x0, &(0x7f00000000c0)={0x0, 0xe, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) write$UHID_SET_REPORT_REPLY(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0e000000"], 0xc) 29.1296ms ago: executing program 2 (id=194): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={&(0x7f00000002c0)=[{0x99, 0x2000, 0x0, 0x0}], 0x1}) 0s ago: executing program 3 (id=195): r0 = syz_usb_connect(0x0, 0x8a, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2}, &(0x7f0000000b80)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x34, r1, 0x917, 0xa7, 0x1000000, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}]}, 0x34}}, 0x408c0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r2, 0x10040) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000001c0), 0x82002, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x7fffffffffffffff]}, 0x8, 0x80000) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x4, 0x800, 0x0, 0x3}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x6, 0x3, 0x0, 0x20001, 0x7, 0xffffffffffffffff}, 0x0, 0x0) ioctl$SNDCTL_DSP_SYNC(r3, 0x5001, 0x0) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000040)=0x10004) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.12' (ED25519) to the list of known hosts. [ 51.028666][ T4174] cgroup: Unknown subsys name 'net' [ 51.164050][ T4174] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 52.363366][ T4174] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 53.633974][ T4188] chnl_net:caif_netlink_parms(): no params data found [ 53.726687][ T4188] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.734062][ T4188] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.742123][ T4188] device bridge_slave_0 entered promiscuous mode [ 53.754812][ T4188] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.761925][ T4188] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.769891][ T4188] device bridge_slave_1 entered promiscuous mode [ 53.819633][ T4188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.833387][ T4188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 53.872393][ T4198] chnl_net:caif_netlink_parms(): no params data found [ 53.889249][ T4188] team0: Port device team_slave_0 added [ 53.914192][ T4200] chnl_net:caif_netlink_parms(): no params data found [ 53.933247][ T4188] team0: Port device team_slave_1 added [ 53.946237][ T4193] chnl_net:caif_netlink_parms(): no params data found [ 53.974518][ T4187] chnl_net:caif_netlink_parms(): no params data found [ 54.024697][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.031720][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.057849][ T4188] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.090662][ T4188] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.097613][ T4188] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.123619][ T4188] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.166256][ T4198] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.173792][ T4198] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.181583][ T4198] device bridge_slave_0 entered promiscuous mode [ 54.195584][ T4198] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.202746][ T4198] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.210920][ T4198] device bridge_slave_1 entered promiscuous mode [ 54.233297][ T4193] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.240510][ T4193] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.248076][ T4193] device bridge_slave_0 entered promiscuous mode [ 54.262072][ T4200] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.269274][ T4200] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.277083][ T4200] device bridge_slave_0 entered promiscuous mode [ 54.294053][ T4193] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.301417][ T4193] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.309346][ T4193] device bridge_slave_1 entered promiscuous mode [ 54.322968][ T4200] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.330063][ T4200] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.337576][ T4200] device bridge_slave_1 entered promiscuous mode [ 54.360680][ T4188] device hsr_slave_0 entered promiscuous mode [ 54.367237][ T4188] device hsr_slave_1 entered promiscuous mode [ 54.380974][ T4198] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.409460][ T4187] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.416589][ T4187] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.424733][ T4187] device bridge_slave_0 entered promiscuous mode [ 54.433282][ T4198] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.443960][ T4193] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.467048][ T4200] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.476263][ T4187] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.484820][ T4187] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.492943][ T4187] device bridge_slave_1 entered promiscuous mode [ 54.513480][ T4200] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.523975][ T4193] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.573833][ T4198] team0: Port device team_slave_0 added [ 54.581873][ T4193] team0: Port device team_slave_0 added [ 54.588980][ T4198] team0: Port device team_slave_1 added [ 54.600446][ T4187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.618017][ T4187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.633158][ T4193] team0: Port device team_slave_1 added [ 54.649976][ T4200] team0: Port device team_slave_0 added [ 54.682891][ T4200] team0: Port device team_slave_1 added [ 54.691009][ T4187] team0: Port device team_slave_0 added [ 54.701466][ T4187] team0: Port device team_slave_1 added [ 54.713697][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.721172][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.747171][ T4198] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.777635][ T4200] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.784608][ T4200] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.810622][ T4200] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.824809][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 54.831850][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.858461][ T4193] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 54.870401][ T4198] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.877340][ T4198] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.903706][ T4198] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.928704][ T4200] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.935700][ T4200] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 54.961685][ T4200] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 54.973358][ T4193] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 54.980655][ T4193] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.006560][ T4193] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.029531][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.036491][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.062598][ T4187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.074517][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.081567][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.107526][ T4187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.173763][ T4193] device hsr_slave_0 entered promiscuous mode [ 55.180882][ T4193] device hsr_slave_1 entered promiscuous mode [ 55.187348][ T4193] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.195147][ T4193] Cannot create hsr debugfs directory [ 55.213138][ T4200] device hsr_slave_0 entered promiscuous mode [ 55.225470][ T4200] device hsr_slave_1 entered promiscuous mode [ 55.234565][ T4200] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.242383][ T4200] Cannot create hsr debugfs directory [ 55.265827][ T4198] device hsr_slave_0 entered promiscuous mode [ 55.272412][ T4198] device hsr_slave_1 entered promiscuous mode [ 55.279222][ T4198] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.286769][ T4198] Cannot create hsr debugfs directory [ 55.319609][ T4187] device hsr_slave_0 entered promiscuous mode [ 55.326202][ T4187] device hsr_slave_1 entered promiscuous mode [ 55.333128][ T4187] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 55.340849][ T4187] Cannot create hsr debugfs directory [ 55.439694][ T1324] Bluetooth: hci2: command 0x0409 tx timeout [ 55.439694][ T4191] Bluetooth: hci4: command 0x0409 tx timeout [ 55.440181][ T4191] Bluetooth: hci3: command 0x0409 tx timeout [ 55.463763][ T4191] Bluetooth: hci1: command 0x0409 tx timeout [ 55.470037][ T4191] Bluetooth: hci0: command 0x0409 tx timeout [ 55.523738][ T4188] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 55.552169][ T4188] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 55.586260][ T4188] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 55.615007][ T4188] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 55.650752][ T4193] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 55.660802][ T4193] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 55.676896][ T4193] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 55.688696][ T4193] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 55.758370][ T4200] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 55.774927][ T4200] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 55.794632][ T4188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.806675][ T4200] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 55.825619][ T4200] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 55.840007][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.850017][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.860978][ T4188] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.895022][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.904381][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.914949][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.922219][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 55.931182][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.940455][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.948686][ T1173] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.955730][ T1173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 55.966005][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 55.975386][ T4198] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 55.995019][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.003639][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.016212][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.025183][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.034875][ T4198] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.044527][ T4198] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.054221][ T4198] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.071178][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.091563][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.100591][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.131309][ T4187] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 56.142464][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.152872][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.162598][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.171138][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.186028][ T4193] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.193712][ T4187] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 56.204726][ T4188] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.228294][ T4193] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.236668][ T4187] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 56.245706][ T4187] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 56.262110][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.270550][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.291962][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.302873][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.312193][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.319282][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.329120][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.337787][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.348791][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.355843][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.363791][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.390948][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.403441][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.427969][ T4200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.442386][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.457531][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.475519][ T4198] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.485148][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.494572][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.503400][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.516315][ T4200] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.544099][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.552591][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.562755][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.570869][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.578417][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 56.587120][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 56.595600][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 56.604175][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 56.614364][ T4198] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.624023][ T4193] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 56.636951][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 56.645007][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 56.652934][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.662238][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.672137][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.679222][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.687001][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.705309][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.714461][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.724412][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.731546][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.754250][ T4188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 56.771256][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.784829][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.794725][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.806303][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.813396][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.821669][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.830455][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.839047][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.847299][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.854357][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.862885][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.874268][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.899892][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.914974][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.925449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 56.937396][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.956082][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.968481][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 56.986772][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 56.995813][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.029712][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.038578][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.048276][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.056743][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.066073][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.073609][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.081306][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.090123][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.098406][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.106830][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.117033][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.125315][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.133828][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.146862][ T4198] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.160177][ T4198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.177631][ T4187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.190199][ T4200] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.200318][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.209429][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.221316][ T4193] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.246722][ T4187] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.254377][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.262966][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.272011][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.280063][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.287625][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.295801][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.308234][ T4188] device veth0_vlan entered promiscuous mode [ 57.355308][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.367430][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.390242][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.397310][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.405819][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.414574][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.423319][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.430391][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.438037][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.447398][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.456292][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.465454][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.487891][ T4188] device veth1_vlan entered promiscuous mode [ 57.512810][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.520760][ T4232] Bluetooth: hci0: command 0x041b tx timeout [ 57.525546][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.527981][ T4232] Bluetooth: hci1: command 0x041b tx timeout [ 57.541402][ T4232] Bluetooth: hci3: command 0x041b tx timeout [ 57.547467][ T4232] Bluetooth: hci2: command 0x041b tx timeout [ 57.549732][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.554044][ T4232] Bluetooth: hci4: command 0x041b tx timeout [ 57.571924][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.580639][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.589318][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.597607][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.617275][ T4198] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.640183][ T4187] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.650893][ T4187] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.664859][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 57.673193][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.682773][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.690910][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.699779][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.708039][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.716579][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.725090][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 57.732888][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 57.740552][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.754595][ T4193] device veth0_vlan entered promiscuous mode [ 57.766617][ T4200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.781527][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 57.792648][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 57.808108][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 57.817609][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 57.832807][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 57.852124][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 57.872305][ T4188] device veth0_macvtap entered promiscuous mode [ 57.894632][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.904980][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 57.921261][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 57.938132][ T4193] device veth1_vlan entered promiscuous mode [ 57.947572][ T4188] device veth1_macvtap entered promiscuous mode [ 57.984019][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 57.998155][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 58.026033][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 58.034740][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 58.048340][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 58.057030][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 58.065084][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 58.088642][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 58.097113][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 58.123016][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 58.134425][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 58.143140][ T4198] device veth0_vlan entered promiscuous mode [ 58.153363][ T4193] device veth0_macvtap entered promiscuous mode [ 58.166063][ T4193] device veth1_macvtap entered promiscuous mode [ 58.174835][ T4187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.186344][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.204572][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 58.213076][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 58.221212][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 58.230272][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.238743][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 58.250063][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 58.267691][ T4188] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.278457][ T4198] device veth1_vlan entered promiscuous mode [ 58.290664][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.301986][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.313376][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.323615][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 58.331765][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 58.340420][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.349894][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 58.358434][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 58.366763][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 58.375915][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 58.384553][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 58.392318][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 58.408035][ T4188] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.417261][ T4188] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.426983][ T4188] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.435932][ T4188] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.453099][ T4193] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.466461][ T4193] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.477867][ T4193] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.485858][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 58.495514][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 58.504198][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 58.512898][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 58.521333][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.536388][ T4200] device veth0_vlan entered promiscuous mode [ 58.551072][ T4193] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.562250][ T4193] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.571940][ T4193] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.581202][ T4193] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.614533][ T4200] device veth1_vlan entered promiscuous mode [ 58.631000][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 58.639915][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 58.648197][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 58.656607][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 58.665000][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 58.674322][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 58.682371][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 58.692892][ T4198] device veth0_macvtap entered promiscuous mode [ 58.712860][ T4187] device veth0_vlan entered promiscuous mode [ 58.748712][ T4198] device veth1_macvtap entered promiscuous mode [ 58.762966][ T4187] device veth1_vlan entered promiscuous mode [ 58.813826][ T4200] device veth0_macvtap entered promiscuous mode [ 58.820812][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 58.829551][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 58.838216][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 58.867629][ T4200] device veth1_macvtap entered promiscuous mode [ 58.889654][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.891333][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.897595][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.910986][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.926447][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 58.937165][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.948018][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 58.958394][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.969181][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 58.981522][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 58.991991][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.002871][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.016620][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 59.026983][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.035219][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 59.044576][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 59.053510][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 59.062038][ T1173] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.079075][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.086891][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.097922][ T4187] device veth0_macvtap entered promiscuous mode [ 59.107678][ T4198] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.117364][ T4198] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.126438][ T4198] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.135181][ T4198] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.164019][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.175231][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.186597][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.197854][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.209233][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.219718][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.230508][ T4200] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 59.237815][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.246869][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 59.255949][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 59.264730][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 59.273806][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 59.282697][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 59.299500][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.310514][ T3097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.314976][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.318315][ T3097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.330376][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.346716][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.357140][ T4200] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.368564][ T4200] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.380830][ T4200] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.391855][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.400409][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.409795][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.417419][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 59.426036][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 59.435474][ T3097] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.444127][ T4187] device veth1_macvtap entered promiscuous mode [ 59.459912][ T4200] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.468628][ T4200] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.478506][ T4200] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.487420][ T4200] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.593043][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.604902][ T4234] Bluetooth: hci4: command 0x040f tx timeout [ 59.624259][ T4234] Bluetooth: hci2: command 0x040f tx timeout [ 59.626863][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.639706][ T4234] Bluetooth: hci3: command 0x040f tx timeout [ 59.646235][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.646412][ T4234] Bluetooth: hci1: command 0x040f tx timeout [ 59.657772][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.669187][ T4234] Bluetooth: hci0: command 0x040f tx timeout [ 59.674657][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.692550][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.702868][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 59.713709][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.725251][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 59.736141][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.777792][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.798268][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.809927][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.837389][ T4271] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 59.838945][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.875089][ T4274] Zero length message leads to an empty skb [ 59.897170][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.914257][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 59.926360][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 59.942832][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 59.989740][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 60.009671][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 60.029765][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 60.043804][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 60.053981][ T4279] loop2: detected capacity change from 0 to 4096 [ 60.055785][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 60.072796][ T4267] device syzkaller0 entered promiscuous mode [ 60.081889][ T4279] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 60.095318][ T4187] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.104713][ T4279] EXT4-fs (loop2): Ignoring removed oldalloc option [ 60.111581][ T4187] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.121320][ T4187] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.132492][ T4187] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 60.153439][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.166764][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.172151][ T4279] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 60.190723][ T4279] System zones: 0-5 [ 60.202374][ T4279] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 60.234005][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.350691][ T4269] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.360759][ T4269] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.373085][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.373602][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.404524][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.418237][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.430880][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.448577][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.457099][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 60.524412][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.532662][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.550476][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.557881][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.575618][ T4269] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.587428][ T4269] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.692824][ T4285] loop0: detected capacity change from 0 to 4096 [ 60.733864][ T4290] ======================================================= [ 60.733864][ T4290] WARNING: The mand mount option has been deprecated and [ 60.733864][ T4290] and is ignored by this kernel. Remove the mand [ 60.733864][ T4290] option from the mount to silence this warning. [ 60.733864][ T4290] ======================================================= [ 60.796675][ T4290] jffs2: notice: (4290) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 60.863211][ T4285] ntfs: (device loop0): ntfs_read_locked_inode(): $DATA attribute is missing. [ 60.894232][ T4285] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -2. Marking corrupt inode 0xa as bad. Run chkdsk. [ 60.947023][ T4285] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 61.099073][ T4299] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6'. [ 61.182646][ T4285] ntfs: volume version 3.1. [ 61.701330][ T4191] Bluetooth: hci1: command 0x0419 tx timeout [ 61.846665][ T4191] Bluetooth: hci3: command 0x0419 tx timeout [ 61.890495][ T4299] loop2: detected capacity change from 0 to 512 [ 61.955814][ T4300] loop4: detected capacity change from 0 to 32768 [ 61.973150][ T4300] XFS (loop4): Invalid device [./bus], error=-15 [ 61.989172][ T4191] Bluetooth: hci2: command 0x0419 tx timeout [ 62.123822][ T4191] Bluetooth: hci4: command 0x0419 tx timeout [ 62.168515][ T4299] EXT4-fs (loop2): Ignoring removed nobh option [ 62.337483][ T21] Bluetooth: hci0: command 0x0419 tx timeout [ 62.463086][ T4299] EXT4-fs (loop2): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback. [ 62.491064][ T4299] ext4 filesystem being mounted at /1/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 62.650595][ T4198] ntfs: (device loop0): ntfs_put_super(): Volume has errors. Leaving volume marked dirty. Run chkdsk. [ 62.701209][ T4316] loop1: detected capacity change from 0 to 4096 [ 62.779234][ T4316] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 62.800693][ T4316] EXT4-fs (loop1): Ignoring removed oldalloc option [ 62.806756][ T1324] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 63.363125][ T4316] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 63.425355][ T4328] jffs2: notice: (4328) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 63.686139][ T4316] System zones: 0-5 [ 64.093157][ T4316] EXT4-fs (loop1): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 64.355327][ T4334] FAULT_INJECTION: forcing a failure. [ 64.355327][ T4334] name failslab, interval 1, probability 0, space 0, times 1 [ 64.389034][ T4334] CPU: 0 PID: 4334 Comm: syz.2.14 Not tainted syzkaller #0 [ 64.396253][ T4334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 64.406319][ T4334] Call Trace: [ 64.409596][ T4334] [ 64.412527][ T4334] dump_stack_lvl+0x188/0x250 [ 64.417218][ T4334] ? show_regs_print_info+0x20/0x20 [ 64.422427][ T4334] ? load_image+0x410/0x410 [ 64.426943][ T4334] ? __might_sleep+0xf0/0xf0 [ 64.431540][ T4334] ? __lock_acquire+0x7b50/0x7b50 [ 64.436575][ T4334] should_fail+0x383/0x4b0 [ 64.441006][ T4334] should_failslab+0x5/0x20 [ 64.445516][ T4334] slab_pre_alloc_hook+0x51/0xc0 [ 64.450462][ T4334] kmem_cache_alloc_node+0x47/0x2c0 [ 64.455662][ T4334] ? __alloc_skb+0xf4/0x750 [ 64.459285][ T4337] process 'syz.0.16' launched '/dev/fd/4/./file0' with NULL argv: empty string added [ 64.460172][ T4334] __alloc_skb+0xf4/0x750 [ 64.473950][ T4334] netlink_ack+0x35c/0xb10 [ 64.478384][ T4334] ? netlink_dump+0xdd0/0xdd0 [ 64.483069][ T4334] ? __mutex_lock_common+0x435/0x2400 [ 64.488460][ T4334] netlink_rcv_skb+0x267/0x430 [ 64.493230][ T4334] ? xfrm_netlink_rcv+0x66/0x90 [ 64.498089][ T4334] ? xfrm_netlink_rcv+0x90/0x90 [ 64.502942][ T4334] ? netlink_ack+0xb10/0xb10 [ 64.507529][ T4334] ? __lock_acquire+0x7b50/0x7b50 [ 64.512558][ T4334] xfrm_netlink_rcv+0x75/0x90 [ 64.517233][ T4334] netlink_unicast+0x78f/0x940 [ 64.521995][ T4334] netlink_sendmsg+0x8ba/0xbe0 [ 64.526758][ T4334] ? netlink_getsockopt+0x570/0x570 [ 64.531942][ T4334] ? aa_sock_msg_perm+0x94/0x150 [ 64.536869][ T4334] ? apparmor_socket_sendmsg+0x88/0x230 [ 64.542402][ T4334] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 64.547693][ T4334] ? security_socket_sendmsg+0x7c/0xa0 [ 64.553138][ T4334] ? netlink_getsockopt+0x570/0x570 [ 64.558327][ T4334] ____sys_sendmsg+0x5be/0x8f0 [ 64.563083][ T4334] ? __sys_sendmsg_sock+0x30/0x30 [ 64.568100][ T4334] ? import_iovec+0x6f/0xa0 [ 64.572593][ T4334] ___sys_sendmsg+0x236/0x2e0 [ 64.577262][ T4334] ? __sys_sendmsg+0x290/0x290 [ 64.582040][ T4334] __se_sys_sendmsg+0x1b7/0x2a0 [ 64.586880][ T4334] ? __x64_sys_sendmsg+0x80/0x80 [ 64.591800][ T4334] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 64.597781][ T4334] ? lockdep_hardirqs_on+0x94/0x140 [ 64.602979][ T4334] do_syscall_64+0x4c/0xa0 [ 64.607380][ T4334] ? clear_bhb_loop+0x30/0x80 [ 64.612050][ T4334] ? clear_bhb_loop+0x30/0x80 [ 64.616720][ T4334] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 64.622613][ T4334] RIP: 0033:0x7f862eaa70d9 [ 64.627013][ T4334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 64.646601][ T4334] RSP: 002b:00007f862ccff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 64.654998][ T4334] RAX: ffffffffffffffda RBX: 00007f862ed2efa0 RCX: 00007f862eaa70d9 [ 64.662954][ T4334] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000003 [ 64.670910][ T4334] RBP: 00007f862ccff090 R08: 0000000000000000 R09: 0000000000000000 [ 64.678863][ T4334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 64.686815][ T4334] R13: 00007f862ed2f038 R14: 00007f862ed2efa0 R15: 00007ffc9fdc4e58 [ 64.694784][ T4334] [ 64.773981][ T4342] jffs2: notice: (4342) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 64.871866][ T4345] FAULT_INJECTION: forcing a failure. [ 64.871866][ T4345] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 64.871957][ T4339] loop3: detected capacity change from 0 to 4096 [ 64.916574][ T4345] CPU: 0 PID: 4345 Comm: syz.2.20 Not tainted syzkaller #0 [ 64.923800][ T4345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 64.933855][ T4345] Call Trace: [ 64.937122][ T4345] [ 64.940033][ T4345] dump_stack_lvl+0x188/0x250 [ 64.944710][ T4345] ? show_regs_print_info+0x20/0x20 [ 64.949894][ T4345] ? load_image+0x410/0x410 [ 64.954388][ T4345] ? __lock_acquire+0x7b50/0x7b50 [ 64.959415][ T4345] should_fail+0x383/0x4b0 [ 64.963838][ T4345] copy_page_from_iter+0x33a/0x760 [ 64.968952][ T4345] tun_get_user+0x199c/0x3b60 [ 64.973651][ T4345] ? tun_ring_recv+0xc90/0xc90 [ 64.978427][ T4345] ? rcu_lock_release+0x5/0x20 [ 64.983184][ T4345] ? __lock_acquire+0x7b50/0x7b50 [ 64.988204][ T4345] tun_chr_write_iter+0x112/0x1e0 [ 64.993216][ T4345] vfs_write+0x748/0xd70 [ 64.997463][ T4345] ? file_end_write+0x250/0x250 [ 65.002300][ T4345] ? __fget_files+0x402/0x470 [ 65.006981][ T4345] ? __fdget_pos+0x1e2/0x370 [ 65.011550][ T4345] ? ksys_write+0x70/0x260 [ 65.015951][ T4345] ksys_write+0x153/0x260 [ 65.020279][ T4345] ? __ia32_sys_read+0x80/0x80 [ 65.025042][ T4345] ? lockdep_hardirqs_on+0x94/0x140 [ 65.030231][ T4345] do_syscall_64+0x4c/0xa0 [ 65.034646][ T4345] ? clear_bhb_loop+0x30/0x80 [ 65.039313][ T4345] ? clear_bhb_loop+0x30/0x80 [ 65.043991][ T4345] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 65.049865][ T4345] RIP: 0033:0x7f862ea6790e [ 65.054269][ T4345] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 65.073873][ T4345] RSP: 002b:00007f862ccfefb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 65.082276][ T4345] RAX: ffffffffffffffda RBX: 00007f862ccff6c0 RCX: 00007f862ea6790e [ 65.090251][ T4345] RDX: 000000000000007a RSI: 0000200000000140 RDI: 00000000000000c8 [ 65.098224][ T4345] RBP: 00007f862eb3e024 R08: 0000000000000000 R09: 0000000000000000 [ 65.106176][ T4345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 65.114127][ T4345] R13: 00007f862ed2f038 R14: 00007f862ed2efa0 R15: 00007ffc9fdc4e58 [ 65.122089][ T4345] [ 65.171835][ T4339] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 65.196311][ T4339] EXT4-fs (loop3): Ignoring removed oldalloc option [ 65.218728][ T4339] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 65.227685][ T4339] System zones: 0-5 [ 65.237622][ T4339] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 65.283796][ T1324] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 65.294740][ T1324] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 65.304024][ T1324] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 65.313261][ T1324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.326876][ T1324] usb 5-1: config 0 descriptor?? [ 65.368997][ T4231] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 65.461010][ T4263] usb 5-1: USB disconnect, device number 2 [ 65.478880][ T4234] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 65.535182][ T4360] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 65.577895][ T4360] netlink: 20 bytes leftover after parsing attributes in process `syz.4.24'. [ 65.587203][ T4360] netlink: 20 bytes leftover after parsing attributes in process `syz.4.24'. [ 65.728862][ T4234] usb 3-1: Using ep0 maxpacket: 8 [ 65.769254][ T4231] usb 1-1: config 0 has an invalid interface number: 33 but max is 0 [ 65.778168][ T4231] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 65.778868][ T26] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 65.792467][ T4231] usb 1-1: config 0 has no interface number 0 [ 65.869296][ T4234] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 65.880510][ T4234] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 65.889619][ T4234] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.899799][ T4234] usb 3-1: config 0 descriptor?? [ 66.001245][ T4231] usb 1-1: New USB device found, idVendor=2040, idProduct=4901, bcdDevice=68.64 [ 66.010591][ T4231] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.018581][ T4231] usb 1-1: Product: syz [ 66.023179][ T4231] usb 1-1: Manufacturer: syz [ 66.027772][ T4231] usb 1-1: SerialNumber: syz [ 66.033970][ T4231] usb 1-1: config 0 descriptor?? [ 66.048970][ T26] usb 4-1: Using ep0 maxpacket: 32 [ 66.082873][ T4231] hdpvr 1-1:0.33: Could not find bulk-in endpoint [ 66.089611][ T4231] hdpvr: probe of 1-1:0.33 failed with error -12 [ 66.165994][ T4234] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 66.176498][ T26] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 66.189128][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.204242][ T26] usb 4-1: config 0 descriptor?? [ 66.241681][ T4368] loop4: detected capacity change from 0 to 128 [ 66.309230][ T4368] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 66.321452][ T4368] hpfs: filesystem error: improperly stopped [ 66.327448][ T4368] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 66.335220][ T4368] hpfs: You really don't want any checks? You are crazy... [ 66.342469][ T4368] hpfs: Code page index out of array [ 66.347757][ T4368] hpfs: code page support is disabled [ 66.353572][ T4368] hpfs: hpfs_map_4sectors(): unaligned read [ 66.359846][ T4368] hpfs: hpfs_map_4sectors(): unaligned read [ 66.365745][ T4368] hpfs: filesystem error: unable to find root dir [ 66.390405][ T4368] hpfs: hpfs_map_4sectors(): unaligned read [ 66.414936][ T4231] usb 1-1: USB disconnect, device number 2 [ 66.479305][ T26] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 66.501872][ T26] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 66.529441][ T26] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 66.537538][ T26] usb 4-1: media controller created [ 66.551073][ T26] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 66.689041][ T26] az6027: usb out operation failed. (-71) [ 66.710056][ T26] az6027: usb out operation failed. (-71) [ 66.715801][ T26] stb0899_attach: Driver disabled by Kconfig [ 66.721978][ T26] az6027: no front-end attached [ 66.721978][ T26] [ 66.748899][ T26] az6027: usb out operation failed. (-71) [ 66.754710][ T26] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 66.765945][ T26] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input5 [ 66.783030][ T26] dvb-usb: schedule remote query interval to 400 msecs. [ 66.790255][ T26] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 66.802809][ T26] usb 4-1: USB disconnect, device number 2 [ 66.849394][ T26] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 67.134299][ T4231] usb 3-1: USB disconnect, device number 2 [ 67.298180][ T4378] syz.0.39 uses obsolete (PF_INET,SOCK_PACKET) [ 67.448801][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #108!!! [ 67.458811][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #108!!! [ 67.468792][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #10a!!! [ 67.478788][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.488786][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.498787][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.508792][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.518790][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.528789][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.538790][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 67.603833][ T4378] loop0: detected capacity change from 0 to 32768 [ 67.751325][ T4378] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 67.759703][ T4378] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 67.863768][ T4378] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 67.950295][ T26] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 68.079838][ T26] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 68.313987][ T26] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 234ms [ 68.328024][ T4321] rpcbind: server 127.0.0.1 not responding, timed out [ 68.360715][ T26] gfs2: fsid=syz:syz.0: jid=0: Done [ 68.367388][ T4378] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 68.477024][ T4378] gfs2: fsid=syz:syz.0: found 1 quota changes [ 68.543119][ T4389] gfs2: fsid=syz:syz.0: fatal: filesystem consistency error [ 68.543119][ T4389] inode = 11 2339 [ 68.543119][ T4389] function = gfs2_dinode_in, file = fs/gfs2/glops.c, line = 414 [ 68.564057][ T4389] gfs2: fsid=syz:syz.0: about to withdraw this file system [ 68.612559][ T4389] gfs2: fsid=syz:syz.0: The quotad daemon is withdrawing. [ 68.628624][ T4389] gfs2: fsid=syz:syz.0: warning: assertion "!qd->qd_change" failed at function = gfs2_quota_cleanup, file = fs/gfs2/quota.c, line = 1485 [ 68.820992][ T4389] CPU: 0 PID: 4389 Comm: gfs2_quotad Not tainted syzkaller #0 [ 68.828495][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 68.838549][ T4389] Call Trace: [ 68.841845][ T4389] [ 68.844777][ T4389] dump_stack_lvl+0x188/0x250 [ 68.849464][ T4389] ? show_regs_print_info+0x20/0x20 [ 68.854661][ T4389] ? load_image+0x410/0x410 [ 68.859171][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 68.864374][ T4389] gfs2_assert_warn_i+0x187/0x2c0 [ 68.869402][ T4389] gfs2_quota_cleanup+0x48c/0x670 [ 68.874439][ T4389] gfs2_make_fs_ro+0x440/0x620 [ 68.879205][ T4389] ? __might_sleep+0xf0/0xf0 [ 68.883800][ T4389] ? gfs2_dinode_out+0xb00/0xb00 [ 68.888738][ T4389] ? _raw_spin_unlock+0x24/0x40 [ 68.893590][ T4389] ? gfs2_glock_nq+0xcaa/0x1510 [ 68.898458][ T4389] gfs2_withdraw+0x660/0x14e0 [ 68.903139][ T4389] ? gfs2_meta_new+0x160/0x160 [ 68.907904][ T4389] ? gfs2_lm+0x240/0x240 [ 68.912146][ T4389] ? gfs2_freeze_lock+0x52/0xc0 [ 68.916998][ T4389] ? gfs2_consist_inode_i+0xc0/0xe0 [ 68.922294][ T4389] gfs2_inode_refresh+0xb2d/0x11a0 [ 68.927418][ T4389] ? gfs2_inode_metasync+0xf0/0xf0 [ 68.932539][ T4389] inode_go_lock+0x127/0x450 [ 68.937137][ T4389] do_promote+0x75b/0xb20 [ 68.941478][ T4389] finish_xmote+0x4c2/0xaf0 [ 68.945991][ T4389] do_xmote+0x752/0x10a0 [ 68.950248][ T4389] gfs2_glock_nq+0xc6b/0x1510 [ 68.954939][ T4389] do_sync+0x49c/0xba0 [ 68.959050][ T4389] ? slot_put+0x1e0/0x1e0 [ 68.963382][ T4389] ? __lock_acquire+0x7b50/0x7b50 [ 68.968408][ T4389] ? do_raw_spin_lock+0x128/0x2f0 [ 68.973431][ T4389] ? do_sync+0x494/0xba0 [ 68.977681][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 68.982889][ T4389] gfs2_quota_sync+0x355/0x780 [ 68.987669][ T4389] gfs2_quotad+0x40f/0x890 [ 68.992101][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 68.997210][ T4389] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 69.003104][ T4389] ? init_wait_entry+0xd0/0xd0 [ 69.007876][ T4389] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 69.013772][ T4389] ? __kthread_parkme+0x14e/0x1b0 [ 69.018799][ T4389] kthread+0x42e/0x520 [ 69.022868][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 69.027978][ T4389] ? kthread_blkcg+0xd0/0xd0 [ 69.032572][ T4389] ret_from_fork+0x1f/0x30 [ 69.037005][ T4389] [ 69.179718][ T4389] gfs2: fsid=syz:syz.0: Journal recovery skipped for jid 0 until next mount. [ 69.188842][ T4389] gfs2: fsid=syz:syz.0: Glock dequeues delayed: 0 [ 69.197863][ T4389] gfs2: fsid=syz:syz.0: File system withdrawn [ 69.207121][ T4389] CPU: 1 PID: 4389 Comm: gfs2_quotad Not tainted syzkaller #0 [ 69.214589][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 69.224644][ T4389] Call Trace: [ 69.227922][ T4389] [ 69.230853][ T4389] dump_stack_lvl+0x188/0x250 [ 69.235548][ T4389] ? show_regs_print_info+0x20/0x20 [ 69.240756][ T4389] ? load_image+0x410/0x410 [ 69.245275][ T4389] ? lockref_put_or_lock+0x6e/0xb0 [ 69.250399][ T4389] gfs2_withdraw+0xb9a/0x14e0 [ 69.255087][ T4389] ? gfs2_meta_new+0x160/0x160 [ 69.259861][ T4389] ? gfs2_lm+0x240/0x240 [ 69.264116][ T4389] ? gfs2_consist_inode_i+0xc0/0xe0 [ 69.269321][ T4389] gfs2_inode_refresh+0xb2d/0x11a0 [ 69.274448][ T4389] ? gfs2_inode_metasync+0xf0/0xf0 [ 69.279580][ T4389] inode_go_lock+0x127/0x450 [ 69.284180][ T4389] do_promote+0x75b/0xb20 [ 69.288527][ T4389] finish_xmote+0x4c2/0xaf0 [ 69.293042][ T4389] do_xmote+0x752/0x10a0 [ 69.297304][ T4389] gfs2_glock_nq+0xc6b/0x1510 [ 69.301996][ T4389] do_sync+0x49c/0xba0 [ 69.306081][ T4389] ? slot_put+0x1e0/0x1e0 [ 69.310418][ T4389] ? __lock_acquire+0x7b50/0x7b50 [ 69.315446][ T4389] ? do_raw_spin_lock+0x128/0x2f0 [ 69.320482][ T4389] ? do_sync+0x494/0xba0 [ 69.324736][ T4389] ? do_raw_spin_unlock+0x11d/0x230 [ 69.329945][ T4389] gfs2_quota_sync+0x355/0x780 [ 69.334723][ T4389] gfs2_quotad+0x40f/0x890 [ 69.339163][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 69.344274][ T4389] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 69.350177][ T4389] ? init_wait_entry+0xd0/0xd0 [ 69.354948][ T4389] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 69.360851][ T4389] ? __kthread_parkme+0x14e/0x1b0 [ 69.365884][ T4389] kthread+0x42e/0x520 [ 69.369951][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 69.375063][ T4389] ? kthread_blkcg+0xd0/0xd0 [ 69.379660][ T4389] ret_from_fork+0x1f/0x30 [ 69.384101][ T4389] [ 69.407115][ T4395] loop2: detected capacity change from 0 to 4096 [ 69.485387][ T4395] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 69.549033][ T4395] EXT4-fs (loop2): Ignoring removed oldalloc option [ 69.670522][ T4395] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 69.678694][ T4395] System zones: 0-5 [ 69.708841][ T26] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 69.743939][ T4395] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 69.886388][ T4406] loop4: detected capacity change from 0 to 4096 [ 69.976950][ T4406] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 69.987780][ T4406] EXT4-fs (loop4): Ignoring removed oldalloc option [ 70.014486][ T4234] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 70.023642][ T4406] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 70.042635][ T4406] System zones: 0-5 [ 70.049908][ T4406] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 70.179199][ T26] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 70.218799][ T26] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 70.274885][ T26] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 70.300153][ T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.324032][ T26] usb 2-1: config 0 descriptor?? [ 70.449254][ T4234] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 70.463801][ T4234] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 4 [ 70.485877][ T4234] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 70.504946][ T4234] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 70.514663][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 70.529532][ T4234] usb 1-1: config 0 descriptor?? [ 70.668938][ T4176] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 70.772354][ T4405] jffs2: notice: (4405) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 70.823136][ T26] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 70.830843][ T4234] ath6kl: Failed to submit usb control message: -71 [ 70.837469][ T4234] ath6kl: unable to send the bmi data to the device: -71 [ 70.848937][ T26] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 70.856796][ T26] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 70.869711][ T4234] ath6kl: Unable to send get target info: -71 [ 70.876730][ T26] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 70.888622][ T26] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 70.906857][ T26] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 71.060503][ T4176] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 71.075701][ T4176] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 71.086264][ T26] playstation 0003:054C:0DF2.0001: Failed to retrieve feature with reportID 32: -32 [ 71.101274][ T4176] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 71.113820][ T26] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense firmware info: -32 [ 71.126647][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.141234][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.149976][ T4176] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.158699][ T26] playstation 0003:054C:0DF2.0001: Failed to get firmware info from DualSense [ 71.177303][ T4176] usb 3-1: config 0 descriptor?? [ 71.182435][ T26] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 71.195815][ T26] playstation: probe of 0003:054C:0DF2.0001 failed with error -32 [ 71.218954][ T4309] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 71.241132][ T13] usb 2-1: USB disconnect, device number 2 [ 71.304131][ T4427] fido_id[4427]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 71.348941][ T4236] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 71.498853][ T4309] usb 5-1: Using ep0 maxpacket: 8 [ 71.629137][ T4309] usb 5-1: config 0 has no interfaces? [ 71.634715][ T4309] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 71.644037][ T4309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.654782][ T4309] usb 5-1: config 0 descriptor?? [ 71.679019][ T13] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 71.719760][ T4236] usb 4-1: config 0 has an invalid interface number: 33 but max is 0 [ 71.728091][ T4236] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 71.738371][ T4236] usb 4-1: config 0 has no interface number 0 [ 71.899640][ T4236] usb 4-1: New USB device found, idVendor=2040, idProduct=4901, bcdDevice=68.64 [ 71.908981][ T4236] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.917438][ T4236] usb 4-1: Product: syz [ 71.921892][ T13] usb 2-1: Using ep0 maxpacket: 32 [ 71.927103][ T4236] usb 4-1: Manufacturer: syz [ 71.931806][ T4236] usb 4-1: SerialNumber: syz [ 71.946454][ T4236] usb 4-1: config 0 descriptor?? [ 71.950373][ T26] usb 5-1: USB disconnect, device number 3 [ 71.992497][ T4236] hdpvr 4-1:0.33: Could not find bulk-in endpoint [ 71.999721][ T4236] hdpvr: probe of 4-1:0.33 failed with error -12 [ 72.014815][ T4309] usb 3-1: USB disconnect, device number 3 [ 72.043310][ T13] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 72.052960][ T13] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.062792][ T13] usb 2-1: config 0 descriptor?? [ 72.226531][ T4236] usb 4-1: USB disconnect, device number 3 [ 72.318999][ T13] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 72.327716][ T13] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 72.349182][ T13] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 72.356550][ T13] usb 2-1: media controller created [ 72.369659][ T13] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 72.409888][ T4309] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 72.538900][ T13] az6027: usb out operation failed. (-71) [ 72.558963][ T13] az6027: usb out operation failed. (-71) [ 72.565381][ T13] stb0899_attach: Driver disabled by Kconfig [ 72.576344][ T13] az6027: no front-end attached [ 72.576344][ T13] [ 72.809306][ T4309] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 72.874715][ T4309] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 72.976218][ T4309] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 73.069327][ T4309] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.189850][ T4309] usb 3-1: config 0 descriptor?? [ 73.205436][ T4445] device syzkaller0 entered promiscuous mode [ 73.250439][ T4445] tipc: Enabling of bearer rejected, failed to enable media [ 73.286258][ T4309] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 73.331258][ T4309] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 73.904366][ T13] az6027: usb out operation failed. (-71) [ 73.910485][ T13] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 73.918661][ T13] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input6 [ 73.939065][ T13] dvb-usb: schedule remote query interval to 400 msecs. [ 73.946020][ T13] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 73.961586][ T13] usb 2-1: USB disconnect, device number 3 [ 74.013298][ T4231] usb 3-1: USB disconnect, device number 4 [ 74.056192][ T13] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 74.103017][ T4462] netlink: 76 bytes leftover after parsing attributes in process `syz.3.51'. [ 74.332868][ T4309] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 74.428883][ T4231] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 74.598842][ T4309] usb 5-1: Using ep0 maxpacket: 32 [ 74.638936][ T13] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 74.673118][ T4231] usb 3-1: Using ep0 maxpacket: 8 [ 74.739101][ T4309] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 74.749564][ T4472] device syzkaller0 entered promiscuous mode [ 74.758375][ T4309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.776488][ T4309] usb 5-1: config 0 descriptor?? [ 74.798990][ T4231] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 74.819145][ T4231] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 74.828196][ T4231] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.879757][ T4231] usb 3-1: config 0 descriptor?? [ 74.888862][ T13] usb 2-1: Using ep0 maxpacket: 8 [ 74.931528][ T4476] netlink: 'syz.0.56': attribute type 2 has an invalid length. [ 75.009074][ T13] usb 2-1: config 0 has no interfaces? [ 75.014606][ T13] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 75.028934][ T4309] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 75.030445][ T13] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.048032][ T4309] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 75.053985][ T13] usb 2-1: config 0 descriptor?? [ 75.099251][ T4309] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 75.106410][ T4309] usb 5-1: media controller created [ 75.140170][ T4309] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 75.150646][ T4231] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 75.259106][ T4309] az6027: usb out operation failed. (-71) [ 75.289388][ T4309] az6027: usb out operation failed. (-71) [ 75.304517][ T4309] stb0899_attach: Driver disabled by Kconfig [ 75.441314][ T4309] az6027: no front-end attached [ 75.441314][ T4309] [ 75.702210][ T4309] az6027: usb out operation failed. (-71) [ 75.768084][ T4309] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 75.826385][ T4309] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input7 [ 75.913564][ T4176] usb 2-1: USB disconnect, device number 4 [ 75.921833][ T26] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 75.939536][ T4309] dvb-usb: schedule remote query interval to 400 msecs. [ 75.992711][ T26] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 76.011191][ T4309] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 76.085485][ T4309] usb 5-1: USB disconnect, device number 4 [ 76.253133][ T4309] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 76.372320][ T26] usb 3-1: USB disconnect, device number 5 [ 76.700519][ T4496] device syzkaller0 entered promiscuous mode [ 76.717410][ T4496] tipc: Enabling of bearer rejected, failed to enable media [ 76.892145][ T4501] netlink: 76 bytes leftover after parsing attributes in process `syz.1.63'. [ 77.046431][ T4503] loop2: detected capacity change from 0 to 4096 [ 77.099137][ T13] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 77.109246][ T4503] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 77.118682][ T4503] EXT4-fs (loop2): Ignoring removed oldalloc option [ 77.159816][ T4503] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 77.176544][ T4503] System zones: 0-5 [ 77.216235][ T4503] EXT4-fs (loop2): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 77.482766][ T13] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 77.516402][ T13] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 77.555902][ T13] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 77.569234][ T4517] device syzkaller0 entered promiscuous mode [ 77.576244][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.616123][ T13] usb 5-1: config 0 descriptor?? [ 77.704559][ T4519] netlink: 'syz.1.69': attribute type 2 has an invalid length. [ 77.727096][ T4521] netlink: 32 bytes leftover after parsing attributes in process `syz.0.70'. [ 77.743710][ T4521] loop0: detected capacity change from 0 to 512 [ 77.810066][ T4521] EXT4-fs (loop0): Ignoring removed nobh option [ 77.848658][ T4521] EXT4-fs (loop0): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback. [ 77.867813][ T4521] ext4 filesystem being mounted at /15/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 78.297533][ T4536] jffs2: notice: (4536) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 78.315150][ T13] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 78.409119][ T4263] usb 5-1: USB disconnect, device number 5 [ 78.689359][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.831440][ T13] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 78.890958][ T4534] loop1: detected capacity change from 0 to 32768 [ 78.932776][ T4534] XFS (loop1): Invalid device [./bus], error=-15 [ 79.027535][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.269108][ T13] usb 4-1: config 0 descriptor?? [ 79.530859][ T4546] jffs2: notice: (4546) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 79.563000][ T4541] device syzkaller0 entered promiscuous mode [ 79.602189][ T4544] FAULT_INJECTION: forcing a failure. [ 79.602189][ T4544] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 79.618978][ T4544] CPU: 0 PID: 4544 Comm: syz.4.77 Not tainted syzkaller #0 [ 79.626196][ T4544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.636254][ T4544] Call Trace: [ 79.639534][ T4544] [ 79.642462][ T4544] dump_stack_lvl+0x188/0x250 [ 79.647237][ T4544] ? show_regs_print_info+0x20/0x20 [ 79.652434][ T4544] ? load_image+0x410/0x410 [ 79.656948][ T4544] ? __lock_acquire+0x7b50/0x7b50 [ 79.661978][ T4544] should_fail+0x383/0x4b0 [ 79.666395][ T4544] prepare_alloc_pages+0x1e3/0x5b0 [ 79.671518][ T4544] __alloc_pages+0x11b/0x480 [ 79.676110][ T4544] ? zone_statistics+0x170/0x170 [ 79.681051][ T4544] ? rcu_lock_release+0x5/0x20 [ 79.685821][ T4544] ? alloc_pages+0x452/0x560 [ 79.690420][ T4544] pipe_write+0x5cd/0x1b40 [ 79.694842][ T4544] ? pipe_write+0x141/0x1b40 [ 79.699444][ T4544] ? pipe_read+0x12d0/0x12d0 [ 79.704035][ T4544] ? count_memcg_event_mm+0x324/0x370 [ 79.709405][ T4544] ? end_current_label_crit_section+0x14b/0x170 [ 79.715731][ T4544] ? memset+0x1e/0x40 [ 79.719712][ T4544] ? iov_iter_init+0xb4/0x170 [ 79.724389][ T4544] vfs_write+0x748/0xd70 [ 79.728635][ T4544] ? file_end_write+0x250/0x250 [ 79.733495][ T4544] ? __fget_files+0x402/0x470 [ 79.738175][ T4544] ? __fdget_pos+0x1e2/0x370 [ 79.742766][ T4544] ? ksys_write+0x70/0x260 [ 79.747198][ T4544] ksys_write+0x153/0x260 [ 79.751531][ T4544] ? __ia32_sys_read+0x80/0x80 [ 79.756294][ T4544] ? lockdep_hardirqs_on+0x94/0x140 [ 79.761495][ T4544] do_syscall_64+0x4c/0xa0 [ 79.765904][ T4544] ? clear_bhb_loop+0x30/0x80 [ 79.770578][ T4544] ? clear_bhb_loop+0x30/0x80 [ 79.775252][ T4544] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.781141][ T4544] RIP: 0033:0x7f6d5b5ea90e [ 79.785556][ T4544] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 79.805158][ T4544] RSP: 002b:00007f6d59881ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 79.813573][ T4544] RAX: ffffffffffffffda RBX: 00007f6d598826c0 RCX: 00007f6d5b5ea90e [ 79.821545][ T4544] RDX: 0000000000000029 RSI: 00007f6d59881e90 RDI: 0000000000000002 [ 79.829513][ T4544] RBP: 00007f6d59881e90 R08: 0000000000000000 R09: 0000000000000000 [ 79.837482][ T4544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000029 [ 79.845448][ T4544] R13: 00007f6d5b87e7a0 R14: 00007f6d5b8754a0 R15: 0000000000000001 [ 79.853429][ T4544] [ 79.910986][ T4231] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 79.928578][ T4231] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 79.958977][ T13] usbhid 4-1:0.0: can't add hid device: -71 [ 79.968281][ T13] usbhid: probe of 4-1:0.0 failed with error -71 [ 79.996207][ T13] usb 4-1: USB disconnect, device number 4 [ 80.216217][ T4562] device syzkaller0 entered promiscuous mode [ 80.231507][ T4562] tipc: Enabling of bearer rejected, failed to enable media [ 80.431317][ T4565] netlink: 76 bytes leftover after parsing attributes in process `syz.1.84'. [ 80.458876][ T13] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 80.615046][ T4569] device syzkaller0 entered promiscuous mode [ 80.709016][ T13] usb 4-1: Using ep0 maxpacket: 32 [ 80.828915][ T13] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.839892][ T13] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 80.850342][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.867397][ T13] usb 4-1: config 0 descriptor?? [ 80.910536][ T13] ldusb 4-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 80.920567][ T4263] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 80.940495][ T13] ldusb 4-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 81.103340][ T4309] usb 4-1: USB disconnect, device number 5 [ 81.140651][ T4309] ldusb 4-1:0.0: LD USB Device #0 now disconnected [ 81.158824][ T4263] usb 3-1: Using ep0 maxpacket: 8 [ 81.278957][ T4263] usb 3-1: config 0 has no interfaces? [ 81.284594][ T4263] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 81.294026][ T4263] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.306469][ T4263] usb 3-1: config 0 descriptor?? [ 81.373473][ T1107] cfg80211: failed to load regulatory.db [ 81.381098][ T4234] ath6kl: Failed to init ath6kl core: -71 [ 81.419131][ T4234] ath6kl_usb: probe of 1-1:0.0 failed with error -71 [ 81.429280][ T4234] usb 1-1: USB disconnect, device number 3 [ 81.559833][ T13] usb 3-1: USB disconnect, device number 6 [ 81.599101][ T4309] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 81.828903][ T4234] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 81.858927][ T4309] usb 4-1: Using ep0 maxpacket: 8 [ 82.009293][ T4309] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 82.028822][ T4309] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 82.037872][ T4309] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.065299][ T4309] usb 4-1: config 0 descriptor?? [ 82.128840][ T4234] usb 1-1: Using ep0 maxpacket: 32 [ 82.259060][ T4234] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 82.268222][ T4234] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.295276][ T4590] netlink: 'syz.4.92': attribute type 2 has an invalid length. [ 82.312080][ T4234] usb 1-1: config 0 descriptor?? [ 82.326976][ T4589] device syzkaller0 entered promiscuous mode [ 82.341679][ T4309] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 82.508206][ T4592] device syzkaller0 entered promiscuous mode [ 82.508277][ T4594] netlink: 76 bytes leftover after parsing attributes in process `syz.2.95'. [ 82.520444][ T4592] tipc: Enabling of bearer rejected, failed to enable media [ 82.599135][ T4234] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 82.616314][ T4309] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 82.627356][ T4234] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 82.640533][ T4309] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 82.689438][ T4234] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 82.703988][ T4234] usb 1-1: media controller created [ 82.719238][ T4601] device syzkaller0 entered promiscuous mode [ 82.723336][ T4234] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 82.829079][ T4234] az6027: usb out operation failed. (-71) [ 82.848973][ T4234] az6027: usb out operation failed. (-71) [ 82.854717][ T4234] stb0899_attach: Driver disabled by Kconfig [ 82.868872][ T4234] az6027: no front-end attached [ 82.868872][ T4234] [ 82.929141][ T4234] az6027: usb out operation failed. (-71) [ 82.934891][ T4234] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 82.962134][ T4234] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input8 [ 82.990862][ T4234] dvb-usb: schedule remote query interval to 400 msecs. [ 83.002221][ T4234] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 83.035194][ T4234] usb 1-1: USB disconnect, device number 4 [ 83.110274][ T4234] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 83.178936][ T1324] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 83.250058][ T4263] usb 4-1: USB disconnect, device number 6 [ 83.539079][ T1324] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.555072][ T1324] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 83.565579][ T1324] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 83.580824][ T1324] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.604832][ T1324] usb 5-1: config 0 descriptor?? [ 84.470429][ T4633] netlink: 76 bytes leftover after parsing attributes in process `syz.0.106'. [ 84.497511][ T4629] device syzkaller0 entered promiscuous mode [ 84.788934][ T4234] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 84.887866][ T21] usb 5-1: USB disconnect, device number 6 [ 84.949373][ T4640] netlink: 'syz.0.107': attribute type 2 has an invalid length. [ 85.038887][ T4234] usb 2-1: Using ep0 maxpacket: 8 [ 85.179885][ T4642] device syzkaller0 entered promiscuous mode [ 85.203788][ T4176] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 85.228913][ T4234] usb 2-1: config 0 has no interfaces? [ 85.239762][ T4234] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 85.251416][ T4176] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 85.274581][ T4234] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.301296][ T4234] usb 2-1: config 0 descriptor?? [ 85.574383][ T4651] device syzkaller0 entered promiscuous mode [ 85.601554][ T21] usb 2-1: USB disconnect, device number 5 [ 85.661264][ T1324] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 85.918863][ T1324] usb 1-1: Using ep0 maxpacket: 32 [ 86.039061][ T1324] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 86.048482][ T1324] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.048872][ T4176] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 86.063863][ T1324] usb 1-1: config 0 descriptor?? [ 86.309579][ T4176] usb 5-1: Using ep0 maxpacket: 8 [ 86.329010][ T1324] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 86.339824][ T1324] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 86.369146][ T1324] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 86.376429][ T1324] usb 1-1: media controller created [ 86.388368][ T1324] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 86.449041][ T4176] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.460669][ T4176] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 86.470066][ T4176] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.484386][ T4176] usb 5-1: config 0 descriptor?? [ 86.538920][ T1324] az6027: usb out operation failed. (-71) [ 86.558994][ T1324] az6027: usb out operation failed. (-71) [ 86.564731][ T1324] stb0899_attach: Driver disabled by Kconfig [ 86.571208][ T1324] az6027: no front-end attached [ 86.571208][ T1324] [ 86.588986][ T1324] az6027: usb out operation failed. (-71) [ 86.594734][ T1324] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 86.603407][ T1324] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input9 [ 86.615687][ T1324] dvb-usb: schedule remote query interval to 400 msecs. [ 86.622743][ T1324] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 86.634179][ T1324] usb 1-1: USB disconnect, device number 5 [ 86.674874][ T1324] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 86.753513][ T4176] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 86.784850][ T4673] netlink: 76 bytes leftover after parsing attributes in process `syz.2.117'. [ 87.189606][ T4176] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 87.498729][ T4682] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 87.544224][ T4682] device syzkaller0 entered promiscuous mode [ 87.578620][ T4686] device syzkaller0 entered promiscuous mode [ 87.659035][ T4176] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 87.683780][ T4176] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 87.710886][ T4176] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 87.735976][ T4176] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.795926][ T4176] usb 2-1: config 0 descriptor?? [ 88.092436][ T4176] usb 5-1: USB disconnect, device number 7 [ 88.113305][ T4690] device syzkaller0 entered promiscuous mode [ 88.126066][ T4688] netlink: 'syz.2.122': attribute type 2 has an invalid length. [ 88.306587][ T4263] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 88.334934][ T4263] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 88.716186][ T13] usb 2-1: USB disconnect, device number 6 [ 89.112946][ T4714] netlink: 76 bytes leftover after parsing attributes in process `syz.2.130'. [ 89.402105][ T4727] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 89.419923][ T4726] device syzkaller0 entered promiscuous mode [ 89.436241][ T4727] device syzkaller0 entered promiscuous mode [ 89.618944][ T4176] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 89.633384][ T4731] netlink: 'syz.2.135': attribute type 2 has an invalid length. [ 89.767623][ T4309] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 89.837394][ T4736] device syzkaller0 entered promiscuous mode [ 89.898892][ T4176] usb 1-1: Using ep0 maxpacket: 32 [ 90.041659][ T4176] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 90.054313][ T4309] usb 5-1: Using ep0 maxpacket: 8 [ 90.059868][ T4176] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.074332][ T4176] usb 1-1: config 0 descriptor?? [ 90.189094][ T4309] usb 5-1: config 0 has no interfaces? [ 90.194770][ T4309] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 90.204265][ T4309] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.218348][ T4309] usb 5-1: config 0 descriptor?? [ 90.239269][ T1107] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 90.339013][ T4176] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 90.350978][ T4176] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 90.389272][ T4176] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 90.402036][ T4176] usb 1-1: media controller created [ 90.438287][ T4176] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 90.474183][ T4309] usb 5-1: USB disconnect, device number 8 [ 90.498875][ T1107] usb 2-1: Using ep0 maxpacket: 8 [ 90.548946][ T4176] az6027: usb out operation failed. (-71) [ 90.569065][ T4176] az6027: usb out operation failed. (-71) [ 90.575029][ T4176] stb0899_attach: Driver disabled by Kconfig [ 90.581307][ T4176] az6027: no front-end attached [ 90.581307][ T4176] [ 90.629078][ T4176] az6027: usb out operation failed. (-71) [ 90.635370][ T4176] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 90.648065][ T4176] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input10 [ 90.648310][ T1324] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 90.660060][ T1107] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 90.683626][ T1107] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 90.693310][ T1324] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 90.694196][ T4176] dvb-usb: schedule remote query interval to 400 msecs. [ 90.713397][ T1107] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.723893][ T4176] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 90.735601][ T1107] usb 2-1: config 0 descriptor?? [ 90.746556][ T4176] usb 1-1: USB disconnect, device number 6 [ 90.805625][ T4176] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 91.013213][ T1107] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 91.298003][ T4754] netlink: 76 bytes leftover after parsing attributes in process `syz.4.142'. [ 91.537066][ T4760] device syzkaller0 entered promiscuous mode [ 91.729091][ T4263] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 91.784478][ T4763] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 91.796237][ T4763] device syzkaller0 entered promiscuous mode [ 91.879973][ T4176] usb 2-1: USB disconnect, device number 7 [ 92.099238][ T4263] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 92.111779][ T4263] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 92.126716][ T4263] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 92.146511][ T4263] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.178102][ T4263] usb 5-1: config 0 descriptor?? [ 92.444174][ T4778] device syzkaller0 entered promiscuous mode [ 92.603188][ T4780] netlink: 'syz.1.149': attribute type 2 has an invalid length. [ 92.928838][ T1107] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 92.965021][ T4176] usb 5-1: USB disconnect, device number 9 [ 93.027538][ T4788] netlink: 76 bytes leftover after parsing attributes in process `syz.4.153'. [ 93.110487][ T4263] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 93.128744][ T4263] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 93.183567][ T4794] device syzkaller0 entered promiscuous mode [ 93.219059][ T1107] usb 1-1: Using ep0 maxpacket: 32 [ 93.345839][ T1107] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 93.374288][ T1107] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.407585][ T1107] usb 1-1: config 0 descriptor?? [ 93.438987][ T4263] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 93.679128][ T4263] usb 2-1: Using ep0 maxpacket: 8 [ 93.698972][ T1107] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 93.729622][ T1107] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 93.745167][ T4806] device syzkaller0 entered promiscuous mode [ 93.779285][ T1107] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 93.795671][ T1107] usb 1-1: media controller created [ 93.799111][ T4263] usb 2-1: config 0 has no interfaces? [ 93.816255][ T1107] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 93.824659][ T4263] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 93.841329][ T4263] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.856187][ T4263] usb 2-1: config 0 descriptor?? [ 93.909070][ T1107] az6027: usb out operation failed. (-71) [ 93.932134][ T1107] az6027: usb out operation failed. (-71) [ 93.937878][ T1107] stb0899_attach: Driver disabled by Kconfig [ 93.956815][ T4809] device syzkaller0 entered promiscuous mode [ 93.969321][ T1107] az6027: no front-end attached [ 93.969321][ T1107] [ 94.009164][ T1107] az6027: usb out operation failed. (-71) [ 94.014940][ T1107] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 94.036443][ T1107] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input11 [ 94.051834][ T1107] dvb-usb: schedule remote query interval to 400 msecs. [ 94.058946][ T1107] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 94.089909][ T1107] usb 1-1: USB disconnect, device number 7 [ 94.126940][ T1324] usb 2-1: USB disconnect, device number 8 [ 94.132659][ T1107] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 94.253936][ T4263] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 94.508878][ T4263] usb 3-1: Using ep0 maxpacket: 8 [ 94.533235][ T4825] netlink: 'syz.0.163': attribute type 2 has an invalid length. [ 94.629253][ T4263] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 94.658880][ T4263] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 94.688829][ T4263] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.768090][ T4263] usb 3-1: config 0 descriptor?? [ 94.926936][ T4832] netlink: 76 bytes leftover after parsing attributes in process `syz.1.165'. [ 95.032406][ T4263] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 95.069126][ T13] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 95.171429][ T4839] device syzkaller0 entered promiscuous mode [ 95.231352][ T1107] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 95.249929][ T1107] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 95.439218][ T13] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 95.457188][ T13] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 95.481865][ T13] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 95.505703][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.535701][ T13] usb 1-1: config 0 descriptor?? [ 95.646437][ T4849] loop1: detected capacity change from 0 to 4096 [ 95.714092][ T4849] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 95.748208][ T4849] EXT4-fs (loop1): Ignoring removed oldalloc option [ 95.787387][ T4849] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 95.814570][ T4849] System zones: 0-5 [ 95.844127][ T4849] EXT4-fs (loop1): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 95.889911][ T13] usb 3-1: USB disconnect, device number 7 [ 96.305781][ T13] usb 1-1: USB disconnect, device number 8 [ 96.352726][ T4857] device syzkaller0 entered promiscuous mode [ 96.529747][ T4861] device syzkaller0 entered promiscuous mode [ 96.733588][ T13] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 96.989976][ T13] usb 1-1: Using ep0 maxpacket: 32 [ 97.115113][ T13] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 97.149533][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.176587][ T13] usb 1-1: config 0 descriptor?? [ 97.186693][ T4882] netlink: 'syz.4.178': attribute type 2 has an invalid length. [ 97.336579][ T4885] device syzkaller0 entered promiscuous mode [ 97.449643][ T13] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 97.460447][ T13] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 97.479762][ T4176] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 97.503962][ T4176] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 97.509181][ T13] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 97.526747][ T13] usb 1-1: media controller created [ 97.535135][ T4309] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 97.582657][ T13] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 97.669115][ T13] az6027: usb out operation failed. (-71) [ 97.699075][ T13] az6027: usb out operation failed. (-71) [ 97.704851][ T13] stb0899_attach: Driver disabled by Kconfig [ 97.723612][ T13] az6027: no front-end attached [ 97.723612][ T13] [ 97.759012][ T13] az6027: usb out operation failed. (-71) [ 97.767099][ T13] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 97.786480][ T13] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input12 [ 97.806167][ T13] dvb-usb: schedule remote query interval to 400 msecs. [ 97.813528][ T13] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 97.818849][ T4309] usb 2-1: Using ep0 maxpacket: 8 [ 97.856754][ T13] usb 1-1: USB disconnect, device number 9 [ 97.930812][ T13] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 97.970137][ T4309] usb 2-1: config 0 has no interfaces? [ 97.975788][ T4309] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 98.010317][ T4309] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.041842][ T4309] usb 2-1: config 0 descriptor?? [ 98.292578][ T4309] usb 2-1: USB disconnect, device number 9 [ 98.328920][ T4234] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 98.349282][ T1107] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 98.430492][ T4902] loop0: detected capacity change from 0 to 4096 [ 98.481719][ T4902] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 98.499268][ T4902] EXT4-fs (loop0): Ignoring removed oldalloc option [ 98.514516][ T4902] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=680ec1a8, mo2=0003] [ 98.523406][ T4902] System zones: 0-5 [ 98.563941][ T4902] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,nojournal_checksum,discard,delalloc,noinit_itable,norecovery,minixdf,nodioread_nolock,errors=remount-ro,jqfmt=vfsv0,usrquota,max_dir_size_kb=0x0000000000000004,oldalloc,. Quota mode: writeback. [ 98.618998][ T1107] usb 5-1: Using ep0 maxpacket: 8 [ 98.706645][ T4906] device syzkaller0 entered promiscuous mode [ 98.729245][ T4234] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 98.740335][ T4234] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 98.750500][ T1107] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 98.761663][ T4234] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 98.771065][ T1107] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 98.780670][ T4234] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.788735][ T1107] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.798857][ T4234] usb 4-1: config 0 descriptor?? [ 98.805559][ T1107] usb 5-1: config 0 descriptor?? [ 98.984843][ T4910] device syzkaller0 entered promiscuous mode [ 99.073859][ T1107] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 99.271899][ T4917] device syzkaller0 entered promiscuous mode [ 99.315211][ T4919] device syzkaller0 entered promiscuous mode [ 99.412284][ T4923] netlink: 'syz.0.192': attribute type 2 has an invalid length. [ 99.576604][ T1324] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 99.601605][ T1324] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 99.666084][ T4309] usb 4-1: USB disconnect, device number 7 [ 99.919128][ T4389] ================================================================== [ 99.927215][ T4389] BUG: KASAN: use-after-free in __lock_acquire+0x107/0x7b50 [ 99.934514][ T4389] Read of size 8 at addr ffff88807bb60bb0 by task gfs2_quotad/4389 [ 99.942400][ T4389] [ 99.944721][ T4389] CPU: 0 PID: 4389 Comm: gfs2_quotad Not tainted syzkaller #0 [ 99.952175][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.962224][ T4389] Call Trace: [ 99.965507][ T4389] [ 99.968433][ T4389] dump_stack_lvl+0x188/0x250 [ 99.973117][ T4389] ? show_regs_print_info+0x20/0x20 [ 99.977926][ T4934] device syzkaller0 entered promiscuous mode [ 99.978316][ T4389] ? load_image+0x410/0x410 [ 99.978340][ T4389] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 99.989325][ T4234] usb 5-1: USB disconnect, device number 10 [ 99.994214][ T4389] print_address_description+0x60/0x2d0 [ 100.005615][ T4389] ? __lock_acquire+0x107/0x7b50 [ 100.010553][ T4389] kasan_report+0xdf/0x130 [ 100.014972][ T4389] ? __lock_acquire+0x107/0x7b50 [ 100.019911][ T4389] __lock_acquire+0x107/0x7b50 [ 100.024679][ T4389] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 100.030665][ T4389] ? lock_chain_count+0x20/0x20 [ 100.035516][ T4389] ? __free_object+0x218/0xa60 [ 100.040285][ T4389] ? lockdep_hardirqs_on+0x94/0x140 [ 100.045485][ T4389] ? verify_lock_unused+0x140/0x140 [ 100.050687][ T4389] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 100.056669][ T4389] ? alloc_object+0x640/0x640 [ 100.061347][ T4389] ? lock_chain_count+0x20/0x20 [ 100.066197][ T4389] ? __rwlock_init+0x140/0x140 [ 100.070966][ T4389] lock_acquire+0x19e/0x400 [ 100.075465][ T4389] ? finish_wait+0xb8/0x1c0 [ 100.079968][ T4389] ? timer_delete_sync+0x20/0x20 [ 100.084902][ T4389] ? read_lock_is_recursive+0x10/0x10 [ 100.085453][ T1107] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 100.090294][ T4389] ? _raw_spin_lock_irqsave+0x8b/0x100 [ 100.090317][ T4389] ? lockdep_hardirqs_off+0x70/0x100 [ 100.090337][ T4389] _raw_spin_lock_irqsave+0xb0/0x100 [ 100.113741][ T4389] ? finish_wait+0xb8/0x1c0 [ 100.118243][ T4389] ? _raw_spin_lock+0x40/0x40 [ 100.122914][ T4389] ? update_process_times+0x200/0x200 [ 100.128288][ T4389] finish_wait+0xb8/0x1c0 [ 100.132617][ T4389] gfs2_quotad+0x713/0x890 [ 100.137041][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 100.142151][ T4389] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 100.148041][ T4389] ? init_wait_entry+0xd0/0xd0 [ 100.152804][ T4389] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 100.158695][ T4389] ? __kthread_parkme+0x14e/0x1b0 [ 100.163719][ T4389] kthread+0x42e/0x520 [ 100.167783][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 100.172887][ T4389] ? kthread_blkcg+0xd0/0xd0 [ 100.177473][ T4389] ret_from_fork+0x1f/0x30 [ 100.181896][ T4389] [ 100.184916][ T4389] [ 100.187238][ T4389] The buggy address belongs to the page: [ 100.192877][ T4389] page:ffffea0001eed800 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bb60 [ 100.203029][ T4389] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 100.210156][ T4389] raw: 00fff00000000000 ffffea00017af208 ffffea0001dd1e08 0000000000000000 [ 100.218737][ T4389] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 100.227307][ T4389] page dumped because: kasan: bad access detected [ 100.233734][ T4389] page_owner tracks the page as freed [ 100.239096][ T4389] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 4899, ts 98472960574, free_ts 98571716860 [ 100.259057][ T4389] get_page_from_freelist+0x24f6/0x2670 [ 100.264606][ T4389] __alloc_pages+0x1ee/0x480 [ 100.269195][ T4389] skb_page_frag_refill+0x225/0x4c0 [ 100.274394][ T4389] sk_page_frag_refill+0x4a/0x200 [ 100.279416][ T4389] tcp_sendmsg_locked+0xf44/0x3330 [ 100.284526][ T4389] tcp_sendmsg+0x2b/0x40 [ 100.288771][ T4389] __sys_sendto+0x46d/0x620 [ 100.293274][ T4389] __x64_sys_sendto+0xda/0xf0 [ 100.297948][ T4389] do_syscall_64+0x4c/0xa0 [ 100.302360][ T4389] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.308250][ T4389] page last free stack trace: [ 100.312915][ T4389] free_unref_page_prepare+0x637/0x6c0 [ 100.318373][ T4389] free_unref_page+0x8f/0x2a0 [ 100.323137][ T4389] skb_release_data+0x35c/0x830 [ 100.327987][ T4389] __kfree_skb+0x4c/0x60 [ 100.332225][ T4389] tcp_ack+0x1e17/0x6140 [ 100.336461][ T4389] tcp_rcv_established+0xeac/0x1d00 [ 100.341655][ T4389] tcp_v4_do_rcv+0x435/0x9b0 [ 100.346243][ T4389] __release_sock+0x1e6/0x460 [ 100.350914][ T4389] release_sock+0x5b/0x1b0 [ 100.355331][ T4389] sk_wait_data+0x203/0x470 [ 100.359831][ T4389] tcp_recvmsg_locked+0xe63/0x2690 [ 100.364943][ T4389] tcp_recvmsg+0x22a/0x760 [ 100.369356][ T4389] inet_recvmsg+0x146/0x200 [ 100.373856][ T4389] __sys_recvfrom+0x396/0x510 [ 100.378530][ T4389] __x64_sys_recvfrom+0xda/0xf0 [ 100.383382][ T4389] do_syscall_64+0x4c/0xa0 [ 100.387809][ T4389] [ 100.390123][ T4389] Memory state around the buggy address: [ 100.395747][ T4389] ffff88807bb60a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 100.403802][ T4389] ffff88807bb60b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 100.411858][ T4389] >ffff88807bb60b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 100.419908][ T4389] ^ [ 100.425528][ T4389] ffff88807bb60c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 100.433583][ T4389] ffff88807bb60c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 100.441631][ T4389] ================================================================== [ 100.449684][ T4389] Disabling lock debugging due to kernel taint [ 100.455839][ T4389] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 100.463023][ T4389] CPU: 0 PID: 4389 Comm: gfs2_quotad Tainted: G B syzkaller #0 [ 100.471863][ T4389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.481803][ T1107] usb 3-1: Using ep0 maxpacket: 32 [ 100.481909][ T4389] Call Trace: [ 100.481917][ T4389] [ 100.493174][ T4389] dump_stack_lvl+0x188/0x250 [ 100.497864][ T4389] ? show_regs_print_info+0x20/0x20 [ 100.503065][ T4389] ? load_image+0x410/0x410 [ 100.507572][ T4389] panic+0x2f8/0x850 [ 100.511469][ T4389] ? bpf_jit_dump+0xd0/0xd0 [ 100.515972][ T4389] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 100.521865][ T4389] ? _raw_spin_unlock+0x40/0x40 [ 100.526717][ T4389] ? __lock_acquire+0x107/0x7b50 [ 100.531657][ T4389] check_panic_on_warn+0x80/0xa0 [ 100.536594][ T4389] ? __lock_acquire+0x107/0x7b50 [ 100.541530][ T4389] end_report+0x6d/0xf0 [ 100.545683][ T4389] kasan_report+0x102/0x130 [ 100.550189][ T4389] ? __lock_acquire+0x107/0x7b50 [ 100.555130][ T4389] __lock_acquire+0x107/0x7b50 [ 100.559906][ T4389] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 100.565885][ T4389] ? lock_chain_count+0x20/0x20 [ 100.570738][ T4389] ? __free_object+0x218/0xa60 [ 100.575497][ T4389] ? lockdep_hardirqs_on+0x94/0x140 [ 100.580699][ T4389] ? verify_lock_unused+0x140/0x140 [ 100.585900][ T4389] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 100.591882][ T4389] ? alloc_object+0x640/0x640 [ 100.596558][ T4389] ? lock_chain_count+0x20/0x20 [ 100.601407][ T4389] ? __rwlock_init+0x140/0x140 [ 100.606174][ T4389] lock_acquire+0x19e/0x400 [ 100.610684][ T4389] ? finish_wait+0xb8/0x1c0 [ 100.615191][ T4389] ? timer_delete_sync+0x20/0x20 [ 100.620136][ T4389] ? read_lock_is_recursive+0x10/0x10 [ 100.625509][ T4389] ? _raw_spin_lock_irqsave+0x8b/0x100 [ 100.630968][ T4389] ? lockdep_hardirqs_off+0x70/0x100 [ 100.636251][ T4389] _raw_spin_lock_irqsave+0xb0/0x100 [ 100.641536][ T4389] ? finish_wait+0xb8/0x1c0 [ 100.646036][ T4389] ? _raw_spin_lock+0x40/0x40 [ 100.650710][ T4389] ? update_process_times+0x200/0x200 [ 100.656086][ T4389] finish_wait+0xb8/0x1c0 [ 100.660418][ T4389] gfs2_quotad+0x713/0x890 [ 100.664836][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 100.669939][ T4389] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 100.675915][ T4389] ? init_wait_entry+0xd0/0xd0 [ 100.680682][ T4389] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 100.686580][ T4389] ? __kthread_parkme+0x14e/0x1b0 [ 100.691605][ T4389] kthread+0x42e/0x520 [ 100.695672][ T4389] ? gfs2_wake_up_statfs+0xc0/0xc0 [ 100.700780][ T4389] ? kthread_blkcg+0xd0/0xd0 [ 100.705361][ T4389] ret_from_fork+0x1f/0x30 [ 100.709784][ T4389] [ 100.712994][ T4389] Kernel Offset: disabled [ 100.717310][ T4389] Rebooting in 86400 seconds..