last executing test programs: 10.302656313s ago: executing program 4 (id=2412): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) 10.122243761s ago: executing program 4 (id=2414): pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x42202) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000480)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000700)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4da158da988456d30026b433186f53cd306a10470d50f5cb1ece9ead3459bab1cf1538be10cfb7cdf4147653c5e892962c801d4675f7bd4d24af44050960f0ded4bd0bea6f83bc0b15360c541c93fde8a5", 0x71}], 0x1}], 0x1, 0x40084) recvmsg$can_bcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000680)=""/112, 0x70}], 0x1}, 0x10150) 9.085469048s ago: executing program 4 (id=2419): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x3, 0x1c, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a4}, 0x94) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x2002) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, &(0x7f0000001080)='\x00', 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c0007800800064000000040050005000200000005"], 0x54}}, 0x0) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='btrfs\x00', 0x418, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$sock(r2, 0x0, 0x0, 0x20000044) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000440)={{{@in=@empty, @in=@initdev}}, {{@in=@multicast1}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) 5.804632889s ago: executing program 1 (id=2437): r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00'}) sendmsg$nl_route_sched(r1, 0x0, 0x3000c81c) 5.575733801s ago: executing program 1 (id=2440): pipe(&(0x7f0000000340)={0xffffffffffffffff}) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2e40ab, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_DEV(r1, 0x0, 0x8800) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000400)) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180200000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7000001000000008500000006000000850000000500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.327397142s ago: executing program 1 (id=2443): openat(0xffffffffffffff9c, &(0x7f0000001400)='./file1\x00', 0x4c142, 0x0) unshare(0x20000400) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b2, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x11, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x3000, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x8, 0x1ffc, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x10000, 0x0, 0x30b}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x1000000, 0x2e4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4c2e, 0x80020, 0x0, 0x312}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) 4.327896488s ago: executing program 4 (id=2456): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0xcd}) socket$nl_generic(0x10, 0x3, 0x10) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = syz_io_uring_setup(0x66e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100, 0x1000000, 0x20000}, 0x0, &(0x7f0000000080), &(0x7f0000000280)) mprotect(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) pwritev2(r2, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000001700)="ab24e450990c2f5b129e7cd33b354b7df6b40a0d3e6244df35162ba930d04e7aee2117f8b76f03656ac95400168c7b3597a174a2f10168c4bf243d6dd3faffbfc06c22df7cf3915bbd66c92a3392f84472605d76c82b643ec8323d580f36de4a46ad4ccb82b18bc4fa6c6b72cdf49e68c9ad73b6803d38fe028c03aa78cf5f08705a44a4cd7f101b496b6cf98abfc6a161cd5983fe841b9e5df7d7669cdc314d160b2ea199cd3b29ffd9a80487867c300732f943633b12e40a1274ddc3d327849764712dd9d7acf25bf4dbf90132964a824555b53c3e295f7c469525756e90b0a3a700a336ecb99ba389e819481ac511e9644ca04e1f70d05f76a996a0ef992fe595be5ac7e8987a304fe60e41f81c9399c9bb13a3ff0fe655180bbc51f90c5552321ef8b31e47a9bab4d8406ef7d97c29b8b281c8d128bd6050404d4d0b8f41b319f1ab5ed6e183afde1c617e5b392fce3ac319e6928974bb7db7d96dbab6d797b2ce0e60e68a0e1246d7466612eb95e09225abd761526b71f5bf8ba3e4330bdc5f2255fc28a9a9366f62e7f5a5814d8a4c17844ab13265ce00b3f67762d30a5bf8f2a73dfc23573a79754c4004950de06078eddcdb0361b1ff1a796000b8b51034d9a7c9eba45ad5438bc96e788b38bf8830b63ce94c97b62d473b9b5f1969fb68f4c3c2e8b30e65d6cb9526944ebdd250c2398fafdb414501cc33f337314079dc90d5c4c50a2169ecdd063fae4465af241c6d717ec7e2686af593d6d08ce373a12e44db12118dbad04b02e0f1e847f827d7ca3943f1a4cfccd22a221006359d82d704ee61a04dbc2c52a54733d7f090851b21a652b2f2d136190ab65800e553b28b5d2516ed9b133851f20eb838ac8ca1bf0c70a5c6c0253ef00817b48ddab7f88bdd1bdbc6bc35c5f5d6181e19cbac5001135665ed68cd74dd36e2f46542baad2b9478db0cefcc982ae7886fa7466ab96ebad2a23bec8977d285831e4edcba2c2cfb9f689ffece1c72e76eff68826383ea59e401e9a7e6d9ee0498ce80fc92042cfe354d0596022327d1fa61017b3755ebf347dd8711063c3c687158e264c900f25b07cbd8db1aee0653ba6f673972731ff311d7aa1433ddc9a1da6632dbca2052f6451e7123d74463f7c66c1b0f29c8576b8305728dd34ff6c17170a28beef8cb0eb7f3df942eb7e61a45e821ef99ea2226245f31ffc466c2f295e163bd864edfe20a3ecde341b8445b03d3eb9aaf0fc62e5c34fc42b31ef4a3ec1a0e8bdeab99722bb84e8175fd7e5efff031b692697953ae4398270c751343e1a860cce59dfc5fea38e89d47ead55b911c23337c7dc611270150c86d837197a13e473ef839c8cfa15db04d3260be39986eb42f6ee0d8035cf1d310f48ea815cba20a44e185d8e6828eaa201649c1e4aa1a1c0b49aa8976b067b2d496b6199f34ce6b5d7329fc29f06b34c18a7c897c6c0765c2c441eece360a2c8adb346866537325786d4b1ae9dfb5318058bfa63719669ff264fad68ee092b627511f80fe57dfd517781d8c19533614d7649fe51c55bf2e74dcb0325abd93342496faebda5277289acc2abfe6eb2f809aeca16d02a0d94712e2a3bc5161d121364d374b1b2c8fb65f3bdd54a2416ec2b613ff21d595d46106b3b675d3b61c5c1e4e4828a16e0626ce396a6e67b54f9154535e1b5b77b998f15200bfa2b29c2abad360f58cb4910277e607dbeb28149c6400bf758050daead3e0b8463874681ed58b2369d5ed25496b27f9bdf3de23ad09d6ea64c033e56eb695e3992e4b70f77894f47fa4d90f5dd6b8743f0152bd577e6cc19da10edb14d617e1e4cecb2b57bd385d010c9bbbe31feff13d8e36d509fba64d1bd666bcf688fb57a5ffebc95c175946c43f069a6232f690f90cdbe528b84b79f17a60595a0d6c6311d4f7da471b14a00756743823f775ce0c3926966f4f139c4da54abab09b0eec1dd0bd9544b477b5424768d2b5113334990270d2f5f97bb02f1187479fdf289348d7a7b3fc960609c09346375f50ff7ec42dc795b18ad534636d8a90f5c0b95b9093c7e64f55ba1651b03dda761e4031e3c9e0807f6c7218bbf85fa02bb186ac36372024575083f562619a5f66c97e7a2b71f1c3e994d20a8169c61fdcdbd5a04d6c36774aba7eea2d466994b2535491428366340d3e63695010c0fc42d9537f866602a385c401de593fdf56190d10dfb1862c7c788a1ef796997b4fea5200c7f4997f0ae6fd894f62e7797001d80dd43e288d96e973601a2b6e5a22a5acdc8007aa748ebabf6f64182549ccb6ce36688d013f2c9bd2979d1d745ddafae839649d424452204b837b03a1196f321ee728d6fd86ef169c741eed5cad08c4190c09c3799426fa4718fbaf86f05d5e17fdb4ac9c0dbb8a6035eb26165374ac3c0031d982c1fcba4785c00fb5e5b32bc2ea78427cc347813bf62718f18a84ed58c1fd83449b02b6cda3bd33e88815ff678fda4e77a6e3db6a50a4caf735fc66197ff44de18e4ee238dcfbacf06feced1546430802bcc8cc9e189945a5ff018504541433f51f91efe09f59f604a2c37429e12e6baf7a9f078683775eaa1aca2af9c5561825ef4b5104ae88cd84bfc4bb124cbdbad3bd2c13bde7ee1096cde72796bba6028998840f7e68e0be047db7f85e211c815968cb0c26800d0527005da3cdaf1b37582d97e9d43099aab82f41faead976f2d4184d4ec7989f52695d0ff72e768c27c1c6e3066fe3385ef3f7103abba906169f5fbddf45c0097610df4b6aca7b0f88a47755d69e013c429b4e776c210a0d6bff18314bcde4d2665970964e39af0749001207fcf9f1396f81c43f96208d5bfff31690fb327dd3cebb2f27f527fbd8b2f62aa379e1741038102e954c6598442215763fd8b76c3f69368165aca770d7d7cfe90c1d86b4694a827f7520c53637dd14759ffd61f95b5155a4ce74fbd517668cd3d2f08a7be6d8f9098093a973f0c809e9d9df240e30f193a39ba090b2992af14b08e792a71534792b7f3a7b27fe2a69bea5c372e8b8f07f01c091", 0x86f}], 0x2, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_disconnect(0xffffffffffffffff) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4, 0x2}, 0x1) r3 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r4 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$6lowpan_enable(r4, &(0x7f00000001c0)='1', 0x1) write$6lowpan_control(r3, &(0x7f0000000280)='connect aa:aa:aa:aa:aa:10 2', 0x1b) 4.309324372s ago: executing program 1 (id=2457): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001780)={0x6, 0x4, 0x0, &(0x7f0000000200)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) 4.064455416s ago: executing program 1 (id=2459): openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61158800000000006113500000000000bfa000000000000007000000ee0016055e15010000000000160500000000000069163e0000000000bf07000000000000260507000fff07206706000020000000150600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) 3.851251886s ago: executing program 0 (id=2461): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\b\x00\b', 0x8, 0x3a, 0x0, @loopback, @loopback, {[], @echo_request={0x80, 0x0, 0x0, 0x3, 0x31}}}}}}, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x26}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) 3.458551481s ago: executing program 3 (id=2464): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021880000000c0a01030000000000000000070000090900020073797a31000000000900010073797a30000000005c000380580000800400018050000b80200001800a00010071756f746100"], 0x10c}}, 0x0) 3.304188287s ago: executing program 4 (id=2466): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x3, 0x1c, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2000000}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x85, 0x0, 0x0, 0x17}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a4}, 0x94) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x2002) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(&(0x7f0000001000)='dns_resolver\x00', &(0x7f0000001040)={'syz', 0x2}, &(0x7f0000001080)='\x00', 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="540000000206010200000000000000000500000005000100060000000d000300686173683a6e6574000000000900020073797a31000000000c0007800800064000000040050005000200000005"], 0x54}}, 0x0) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='btrfs\x00', 0x418, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$sock(r2, 0x0, 0x0, 0x20000044) getsockopt$inet6_IPV6_IPSEC_POLICY(r5, 0x29, 0x22, &(0x7f0000000440)={{{@in=@empty, @in=@initdev}}, {{@in=@multicast1}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) 2.732230066s ago: executing program 0 (id=2470): syz_usb_connect(0x3, 0x62, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d24060101030200010006"], 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[], 0x9) 2.670836094s ago: executing program 3 (id=2472): socket$nl_generic(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x7, &(0x7f0000006680)) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/icmp\x00') openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x111, 0x5}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r0, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.479429611s ago: executing program 3 (id=2474): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000ffb000/0x4000)=nil) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000940), 0x0, &(0x7f0000002f40)=""/229, 0xe5}, 0x0) close(r1) 2.164045149s ago: executing program 0 (id=2477): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x3, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x5}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) 1.974281072s ago: executing program 0 (id=2479): r0 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r0, 0x0, 0xe07e872424dfefca) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x258, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 1.698314561s ago: executing program 0 (id=2482): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021880000000c0a01030000000000000000070000090900020073797a31000000000900010073797a30000000005c000380580000800400018050000b80200001800a00010071756f7461000000100002800c00014000000000000000002c0001800a0001006c696d6974"], 0x10c}}, 0x0) 1.370085953s ago: executing program 0 (id=2484): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) r2 = epoll_create1(0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x1003ffffffc]}, 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000140)={0x30000018}) timer_create(0x3, &(0x7f0000000040)={0x0, 0x11, 0x4}, &(0x7f0000044000)) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000340)='scalable', 0xfffd) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000240)={0x14, 0x0, &(0x7f0000000200)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x2) ioctl$KDSETMODE(r0, 0x4b45, 0x1000000000004) 1.308798749s ago: executing program 3 (id=2485): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020001000900020073797a30000000000900010073797a3000000000140003800800014000000000080002400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000080c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}}, 0x0) 1.139634024s ago: executing program 1 (id=2487): syz_usb_connect(0x3, 0x62, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d24060101030200010006"], 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[], 0x9) 1.035323548s ago: executing program 3 (id=2489): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x3, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x5}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) 929.333918ms ago: executing program 2 (id=2491): pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x42202) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000480)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000700)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4da158da988456d30026b433186f53cd306a10470d50f5cb1ece9ead3459bab1cf1538be10cfb7cdf4147653c5e892962c801d4675f7bd4d24af44050960f0ded4bd0bea6f83bc0b15360c541c93fde8a5", 0x71}], 0x1}], 0x1, 0x40084) recvmsg$can_bcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000680)=""/112, 0x70}], 0x1}, 0x10150) 888.999015ms ago: executing program 3 (id=2492): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 744.343766ms ago: executing program 2 (id=2493): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="c8010000", @ANYRES16=r1, @ANYBLOB="01002dbd7000ffdbdf250100000008000100", @ANYRES32=r2, @ANYBLOB="ac01028038000100240001006e6f746966795f70656572735f636f756e7400100000000000000000000000000500"], 0x1c8}, 0x1, 0x400000000000000, 0x0, 0x10}, 0x0) 611.915548ms ago: executing program 2 (id=2494): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = mq_open(&(0x7f0000000300)='!\x7fM\x8e3\xd5\x00\f\x00RBn[A\x164\v6\x89}\x87\xc4\xfaP\x00\x01E!Vnux\x00\xa5\xf5\x1b\xa8\x12\x8a\x88\xad\x03\x16\x9arA\ap%s\a\xf3O\xc3\xd5._a\x04\xb7eQ7]N\xb5\xd1\xe5\x04%\xd4\xd0R\xbc\x84fNW3\r0A\x81E\xd8\x98\xe2\x05\x06\"\xb86I*h\xfc\xc8\xdb\x9f\xd7~\x90\xd0\xbc<\xdc\x89\xea?:\n\x9b\xf4xQ', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0xd, 0xa, 0x3}) mq_timedreceive(r0, 0x0, 0xfffffffffffffea1, 0x7fd, 0x0) mq_timedreceive(r0, &(0x7f0000000180)=""/196, 0xc4, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x66, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xa, &(0x7f0000000380)=ANY=[@ANYBLOB="000000000000000079000000000000001800000000000000000000000000000095000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_create1(0x80000) 357.671499ms ago: executing program 4 (id=2495): mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000000600)=ANY=[@ANYRESHEX, @ANYRESDEC=0x0]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c", 0x36}], 0x1, &(0x7f00000008c0)=ANY=[@ANYBLOB="b800000000d983fd49e32f4399000000a0000000bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886"], 0xb8, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a", 0x20}, {0x0}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fa", 0xca}], 0x3, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$loop(&(0x7f0000000500), 0x6, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x12, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x5}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, @jmp={0x5, 0x1, 0x4, 0x0, 0x9, 0xfffffffffffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x3}, 0x94) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 258.635411ms ago: executing program 2 (id=2496): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000240)='./file0\x00') mount$afs(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x90, 0x0) mount$afs(&(0x7f0000000180)=@cell={0x23, 'syz1:', 'syz1', '.backup'}, &(0x7f00000001c0)='.\x00', 0x0, 0x14800, 0x0) 91.965832ms ago: executing program 2 (id=2497): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f00000007c0)=0x9, 0x4) 0s ago: executing program 2 (id=2498): openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61158800000000006113500000000000bfa000000000000007000000ee0016055e15010000000000160500000000000069163e0000000000bf07000000000000260507000fff07206706000020000000150600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) kernel console output (not intermixed with test programs): T6748] RGB/YUV Input: Brightness: 128 [ 237.072549][ T6748] RGB/YUV Input: Contrast: 128 [ 237.073034][ T6748] RGB/YUV Input: Hue: 0 [ 237.073462][ T6748] RGB/YUV Input: Saturation: 128 [ 237.073966][ T6748] RGB/YUV Input: Pixel Rate: 160000000 [ 237.074375][ T6748] RGB/YUV Input: Horizontal Blanking: 800 [ 237.074834][ T6748] RGB/YUV Input: Vertical Blanking: 3223 [ 237.075381][ T6748] RGB/YUV Input: ================== END STATUS ================== [ 237.156429][ T6748] netlink: 48 bytes leftover after parsing attributes in process `syz.4.261'. [ 239.768640][ T6765] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 242.299998][ T6779] netlink: 8 bytes leftover after parsing attributes in process `syz.1.269'. [ 244.766723][ T6787] netlink: 'syz.2.272': attribute type 1 has an invalid length. [ 245.235970][ T6800] RGB/YUV Input: ================= START STATUS ================= [ 245.236016][ T6800] RGB/YUV Input: Test Pattern: 75% Colorbar [ 245.236127][ T6800] RGB/YUV Input: Show Information: All [ 245.236223][ T6800] RGB/YUV Input: Vertical Flip: false [ 245.236382][ T6800] RGB/YUV Input: Horizontal Flip: false [ 245.236490][ T6800] RGB/YUV Input: Brightness: 128 [ 245.236588][ T6800] RGB/YUV Input: Contrast: 128 [ 245.236683][ T6800] RGB/YUV Input: Hue: 0 [ 245.236785][ T6800] RGB/YUV Input: Saturation: 128 [ 245.236892][ T6800] RGB/YUV Input: Pixel Rate: 160000000 [ 245.236990][ T6800] RGB/YUV Input: Horizontal Blanking: 800 [ 245.237097][ T6800] RGB/YUV Input: Vertical Blanking: 3223 [ 245.237195][ T6800] RGB/YUV Input: ================== END STATUS ================== [ 245.257459][ T6800] netlink: 48 bytes leftover after parsing attributes in process `syz.4.274'. [ 246.238330][ T37] audit: type=1326 audit(1783405043.318:246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.238386][ T37] audit: type=1326 audit(1783405043.318:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.242514][ T37] audit: type=1326 audit(1783405043.318:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.242568][ T37] audit: type=1326 audit(1783405043.318:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.242890][ T37] audit: type=1326 audit(1783405043.318:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.517333][ T37] audit: type=1326 audit(1783405043.538:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x7ffc0000 [ 246.517392][ T37] audit: type=1326 audit(1783405043.538:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f846e6ddbc2 code=0x7ffc0000 [ 246.517439][ T37] audit: type=1326 audit(1783405043.538:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f846e6ddc57 code=0x7ffc0000 [ 246.517487][ T37] audit: type=1326 audit(1783405043.538:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f846e69ab51 code=0x7ffc0000 [ 246.517534][ T37] audit: type=1326 audit(1783405043.538:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6801 comm="syz.2.275" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f846e6dec49 code=0x7ffc0000 [ 248.303764][ T6804] netlink: 4 bytes leftover after parsing attributes in process `syz.2.275'. [ 251.149906][ T6827] fuse: Bad value for 'fd' [ 252.933627][ T6835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.283'. [ 255.192892][ T6847] Bluetooth: MGMT ver 1.23 [ 255.210264][ T6848] warning: `syz.4.285' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 255.816739][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.824029][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.718437][ T11] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 256.739242][ T6876] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 256.885161][ T11] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 256.917146][ T11] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 256.917179][ T11] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 256.917200][ T11] usb 2-1: Product: syz [ 256.917216][ T11] usb 2-1: Manufacturer: syz [ 256.917231][ T11] usb 2-1: SerialNumber: syz [ 257.483669][ T11] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 5 if 0 alt 0 proto 1 vid 0x04B8 pid 0x0202 [ 257.659967][ T6890] netlink: 'syz.2.298': attribute type 1 has an invalid length. [ 257.696558][ T5713] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 257.792748][ T6890] 8021q: adding VLAN 0 to HW filter on device bond1 [ 257.813319][ T6893] macvlan2: entered promiscuous mode [ 257.813351][ T6893] macvlan2: entered allmulticast mode [ 257.856516][ T5713] usb 1-1: Using ep0 maxpacket: 8 [ 257.858963][ T5713] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 257.859012][ T5713] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 257.859042][ T5713] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 257.859068][ T5713] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 257.859096][ T5713] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 257.859122][ T5713] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 257.859177][ T5713] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 257.859218][ T5713] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.861057][ T6893] bond1: entered promiscuous mode [ 258.002607][ T6893] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 258.120994][ T6893] bond1: left promiscuous mode [ 258.149854][ T5713] usb 1-1: GET_CAPABILITIES returned 0 [ 258.149888][ T5713] usbtmc 1-1:16.0: can't read capabilities [ 258.293631][ T4909] Bluetooth: hci4: unknown advertising packet type: 0x6e [ 258.293689][ T4909] Bluetooth: hci4: Malformed LE Event: 0x02 [ 258.380078][ T5747] usb 1-1: USB disconnect, device number 11 [ 258.835290][ T6906] syzkaller0: entered promiscuous mode [ 258.835318][ T6906] syzkaller0: entered allmulticast mode [ 259.512798][ T5747] usb 2-1: USB disconnect, device number 5 [ 259.599927][ T5747] usblp0: removed [ 260.106490][ T5747] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 260.281838][ T5747] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 260.281868][ T5747] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 260.281936][ T5747] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 260.281961][ T5747] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.326042][ T5747] usb 2-1: config 0 descriptor?? [ 260.357334][ T5747] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 260.393417][ T5747] dvb-usb: bulk message failed: -22 (3/0) [ 260.480527][ T5747] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 260.482950][ T5747] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 260.483013][ T5747] usb 2-1: media controller created [ 260.514066][ T5747] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 260.609735][ T5747] dvb-usb: bulk message failed: -22 (6/0) [ 260.625344][ T5747] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 260.640718][ T5747] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input6 [ 260.702548][ T5747] dvb-usb: schedule remote query interval to 150 msecs. [ 260.702575][ T5747] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 260.722800][ T5747] usb 2-1: USB disconnect, device number 6 [ 260.889332][ T4909] Bluetooth: hci3: unknown advertising packet type: 0x6e [ 260.889362][ T4909] Bluetooth: hci3: Malformed LE Event: 0x02 [ 261.022682][ T5747] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 271.562598][ T6978] netlink: 76 bytes leftover after parsing attributes in process `syz.2.321'. [ 271.980158][ T6996] binder_alloc: 6994: binder_alloc_buf, no vma [ 272.868962][ T36] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 273.025601][ T36] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 273.025637][ T36] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 273.025665][ T36] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 273.086752][ T36] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 273.086785][ T36] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.086807][ T36] usb 3-1: Product: syz [ 273.086822][ T36] usb 3-1: Manufacturer: syz [ 273.086837][ T36] usb 3-1: SerialNumber: syz [ 273.145067][ T36] usb 3-1: config 0 descriptor?? [ 273.146917][ T7018] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 273.375026][ T4909] Bluetooth: hci4: Unknown advertising packet type: 0x18 [ 273.486488][ T36] rc_core: IR keymap rc-streamzap not found [ 273.486509][ T36] Registered IR keymap rc-empty [ 273.544365][ T36] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 273.563861][ T36] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input7 [ 273.662451][ T36] usb 3-1: USB disconnect, device number 7 [ 274.313961][ T7055] netlink: 76 bytes leftover after parsing attributes in process `syz.2.340'. [ 274.351746][ T7054] mac80211_hwsim hwsim10 »»»»»»: renamed from wlan0 (while UP) [ 275.267859][ T4909] Bluetooth: hci2: Unknown advertising packet type: 0x11 [ 275.267889][ T4909] Bluetooth: hci2: Unknown advertising packet type: 0x17 [ 275.527942][ T7080] netlink: 'syz.0.352': attribute type 11 has an invalid length. [ 276.172174][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 276.206791][ T7102] netlink: 8 bytes leftover after parsing attributes in process `syz.3.357'. [ 276.292705][ T7090] netlink: 12 bytes leftover after parsing attributes in process `syz.4.355'. [ 276.490637][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 276.583278][ T7091] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 276.583303][ T7091] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 276.633789][ T7097] netlink: 76 bytes leftover after parsing attributes in process `syz.1.356'. [ 276.812854][ T4909] Bluetooth: hci2: Unknown advertising packet type: 0x11 [ 276.812876][ T4909] Bluetooth: hci2: Unknown advertising packet type: 0x17 [ 277.870185][ T7131] netlink: 12 bytes leftover after parsing attributes in process `syz.3.370'. [ 278.101090][ T4909] Bluetooth: hci1: Unknown advertising packet type: 0x11 [ 278.101112][ T4909] Bluetooth: hci1: Unknown advertising packet type: 0x17 [ 279.056612][ T7166] netlink: 12 bytes leftover after parsing attributes in process `syz.1.383'. [ 279.056889][ T7167] netlink: 76 bytes leftover after parsing attributes in process `syz.4.382'. [ 280.173038][ T7196] netlink: 12 bytes leftover after parsing attributes in process `syz.0.393'. [ 280.401696][ T7199] bridge1: port 1(erspan0) entered blocking state [ 280.401833][ T7199] bridge1: port 1(erspan0) entered disabled state [ 280.402025][ T7199] erspan0: entered allmulticast mode [ 280.435079][ T7199] erspan0: entered promiscuous mode [ 280.500537][ T7199] bridge1: port 1(erspan0) entered blocking state [ 280.545356][ T7199] bridge1: port 1(erspan0) entered forwarding state [ 282.081987][ T7253] team0 (unregistering): Port device team_slave_0 removed [ 282.132885][ T7253] team0 (unregistering): Port device team_slave_1 removed [ 282.964870][ T7266] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 283.409260][ T7306] netlink: 8 bytes leftover after parsing attributes in process `syz.0.433'. [ 283.819859][ T7321] netlink: 12 bytes leftover after parsing attributes in process `syz.3.440'. [ 284.725946][ T7327] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 284.945480][ T7340] netlink: 'syz.2.445': attribute type 11 has an invalid length. [ 285.014237][ T7342] binder_alloc: 7341: binder_alloc_buf, no vma [ 285.088193][ T7347] netlink: 8 bytes leftover after parsing attributes in process `syz.3.446'. [ 285.242986][ T7353] Bluetooth: hci0: invalid length 0, exp 2 for type 8 [ 285.525411][ T7359] netlink: 12 bytes leftover after parsing attributes in process `syz.0.452'. [ 285.980778][ T7375] binder_alloc: 7374: binder_alloc_buf, no vma [ 286.008070][ T7379] Bluetooth: hci0: unsupported parameter 255 [ 286.008093][ T7379] Bluetooth: hci0: unsupported parameter 255 [ 286.224491][ T7386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.464'. [ 288.210756][ T7398] bond2: option xmit_hash_policy: invalid value (6) [ 288.269637][ T7398] bond2 (unregistering): Released all slaves [ 288.453116][ T7409] netlink: 76 bytes leftover after parsing attributes in process `syz.4.470'. [ 288.505706][ T7413] binder: BINDER_SET_CONTEXT_MGR already set [ 288.505723][ T7413] binder: 7412:7413 ioctl 4018620d 200000004a80 returned -16 [ 288.758308][ T7419] netlink: 8 bytes leftover after parsing attributes in process `syz.2.476'. [ 290.404874][ T7446] netlink: 76 bytes leftover after parsing attributes in process `syz.0.488'. [ 290.453324][ T7448] netlink: 8 bytes leftover after parsing attributes in process `syz.3.489'. [ 290.629839][ T4909] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 290.805598][ T7464] netlink: 12 bytes leftover after parsing attributes in process `syz.4.495'. [ 291.121327][ T7476] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 292.265270][ T7512] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 293.039011][ T7542] netlink: 'syz.1.526': attribute type 12 has an invalid length. [ 293.459757][ T7553] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 294.360481][ T7572] netlink: 'syz.4.539': attribute type 12 has an invalid length. [ 296.026467][ T6450] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 296.160395][ T6450] usb 3-1: device descriptor read/64, error -71 [ 297.310186][ T6450] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 297.476925][ T6450] usb 3-1: device descriptor read/64, error -71 [ 297.586957][ T6450] usb usb3-port1: attempt power cycle [ 298.618212][ T6450] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 298.637819][ T6450] usb 3-1: device descriptor read/8, error -71 [ 298.878030][ T6450] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 298.906984][ T6450] usb 3-1: device descriptor read/8, error -71 [ 299.017024][ T6450] usb usb3-port1: unable to enumerate USB device [ 299.109779][ T7631] netlink: 208 bytes leftover after parsing attributes in process `syz.4.559'. [ 299.900978][ T7658] netlink: 24 bytes leftover after parsing attributes in process `syz.1.569'. [ 299.907064][ T5713] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 300.038071][ T5713] usb 3-1: device descriptor read/64, error -71 [ 300.129400][ T7664] netlink: 208 bytes leftover after parsing attributes in process `syz.0.572'. [ 300.276649][ T5713] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 300.389780][ T7669] netlink: 76 bytes leftover after parsing attributes in process `syz.0.574'. [ 300.418002][ T5713] usb 3-1: device descriptor read/64, error -71 [ 300.530723][ T5713] usb usb3-port1: attempt power cycle [ 300.899377][ T5713] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 300.918264][ T5713] usb 3-1: device descriptor read/8, error -71 [ 301.130843][ T7687] netlink: 64 bytes leftover after parsing attributes in process `syz.0.582'. [ 301.206559][ T5713] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 301.231586][ T5713] usb 3-1: device descriptor read/8, error -71 [ 301.291022][ T7690] netlink: 208 bytes leftover after parsing attributes in process `syz.3.583'. [ 301.339138][ T5713] usb usb3-port1: unable to enumerate USB device [ 301.637159][ T7701] netlink: 76 bytes leftover after parsing attributes in process `syz.1.586'. [ 303.358555][ T7720] netlink: 208 bytes leftover after parsing attributes in process `syz.3.594'. [ 303.423773][ T7725] netlink: 64 bytes leftover after parsing attributes in process `syz.1.595'. [ 304.351939][ T7747] netlink: 64 bytes leftover after parsing attributes in process `syz.2.607'. [ 304.494581][ T7754] netlink: 208 bytes leftover after parsing attributes in process `syz.1.606'. [ 304.621920][ T7758] netlink: 12 bytes leftover after parsing attributes in process `syz.1.609'. [ 305.300076][ T4909] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 305.300109][ T4909] CPU: 0 UID: 0 PID: 4909 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 305.300151][ T4909] Tainted: [L]=SOFTLOCKUP [ 305.300160][ T4909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 305.300174][ T4909] Workqueue: hci0 hci_rx_work [ 305.300217][ T4909] Call Trace: [ 305.300227][ T4909] [ 305.300238][ T4909] dump_stack_lvl+0xe8/0x150 [ 305.300277][ T4909] sysfs_create_dir_ns+0x271/0x2a0 [ 305.300318][ T4909] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 305.300364][ T4909] ? rt_spin_unlock+0x163/0x200 [ 305.300394][ T4909] kobject_add_internal+0x62c/0xce0 [ 305.300427][ T4909] kobject_add+0x163/0x240 [ 305.300448][ T4909] ? rt_spin_unlock+0x157/0x200 [ 305.300479][ T4909] ? __pfx_kobject_add+0x10/0x10 [ 305.300509][ T4909] ? get_device_parent+0x370/0x3a0 [ 305.300541][ T4909] device_add+0x3fa/0xb80 [ 305.300571][ T4909] hci_conn_add_sysfs+0xd5/0x210 [ 305.300606][ T4909] le_conn_complete_evt+0xfef/0x1580 [ 305.300642][ T4909] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 305.300667][ T4909] ? lockdep_hardirqs_on+0x7a/0x110 [ 305.300698][ T4909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 305.300739][ T4909] ? rt_mutex_slowunlock+0x219/0x460 [ 305.300766][ T4909] ? skb_pull_data+0xf0/0x200 [ 305.300798][ T4909] hci_le_conn_complete_evt+0x187/0x470 [ 305.300846][ T4909] hci_event_packet+0x67a/0xf10 [ 305.300885][ T4909] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 305.300920][ T4909] ? __pfx_hci_event_packet+0x10/0x10 [ 305.300954][ T4909] ? rt_spin_unlock+0x157/0x200 [ 305.300989][ T4909] ? hci_send_to_monitor+0xe2/0x590 [ 305.301020][ T4909] hci_rx_work+0x3ee/0x1020 [ 305.301062][ T4909] ? process_scheduled_works+0xa20/0x14e0 [ 305.301089][ T4909] process_scheduled_works+0xa8e/0x14e0 [ 305.301149][ T4909] ? __pfx_process_scheduled_works+0x10/0x10 [ 305.301185][ T4909] ? assign_work+0x3cf/0x5d0 [ 305.301218][ T4909] worker_thread+0xa47/0xfb0 [ 305.301262][ T4909] ? __kthread_parkme+0x71/0x1f0 [ 305.301303][ T4909] kthread+0x388/0x470 [ 305.301336][ T4909] ? __pfx_worker_thread+0x10/0x10 [ 305.301362][ T4909] ? __pfx_kthread+0x10/0x10 [ 305.301396][ T4909] ret_from_fork+0x514/0xb70 [ 305.301434][ T4909] ? __pfx_ret_from_fork+0x10/0x10 [ 305.301468][ T4909] ? __switch_to+0xc89/0x1420 [ 305.301500][ T4909] ? __pfx_kthread+0x10/0x10 [ 305.301536][ T4909] ret_from_fork_asm+0x1a/0x30 [ 305.301578][ T4909] [ 305.307323][ T4909] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 305.307451][ T4909] Bluetooth: hci0: failed to register connection device [ 305.873463][ T7785] netlink: 64 bytes leftover after parsing attributes in process `syz.0.618'. [ 305.914319][ T7787] netlink: 208 bytes leftover after parsing attributes in process `syz.1.619'. [ 306.002771][ T7790] netlink: 'syz.4.620': attribute type 11 has an invalid length. [ 306.168578][ T7796] netlink: 12 bytes leftover after parsing attributes in process `syz.0.621'. [ 306.319993][ T7803] netlink: 'syz.3.623': attribute type 11 has an invalid length. [ 307.036222][ T4909] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 307.036262][ T4909] CPU: 0 UID: 0 PID: 4909 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 307.036312][ T4909] Tainted: [L]=SOFTLOCKUP [ 307.036321][ T4909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 307.036336][ T4909] Workqueue: hci1 hci_rx_work [ 307.036373][ T4909] Call Trace: [ 307.036382][ T4909] [ 307.036393][ T4909] dump_stack_lvl+0xe8/0x150 [ 307.036434][ T4909] sysfs_create_dir_ns+0x271/0x2a0 [ 307.036477][ T4909] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 307.036518][ T4909] ? rt_spin_unlock+0x163/0x200 [ 307.036548][ T4909] kobject_add_internal+0x62c/0xce0 [ 307.036583][ T4909] kobject_add+0x163/0x240 [ 307.036611][ T4909] ? rt_spin_unlock+0x157/0x200 [ 307.036652][ T4909] ? __pfx_kobject_add+0x10/0x10 [ 307.036695][ T4909] ? get_device_parent+0x370/0x3a0 [ 307.036738][ T4909] device_add+0x3fa/0xb80 [ 307.036779][ T4909] hci_conn_add_sysfs+0xd5/0x210 [ 307.036823][ T4909] le_conn_complete_evt+0xfef/0x1580 [ 307.036872][ T4909] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 307.036906][ T4909] ? lockdep_hardirqs_on+0x7a/0x110 [ 307.036949][ T4909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 307.036991][ T4909] ? rt_mutex_slowunlock+0x219/0x460 [ 307.037038][ T4909] ? skb_pull_data+0xf0/0x200 [ 307.037083][ T4909] hci_le_conn_complete_evt+0x187/0x470 [ 307.037144][ T4909] hci_event_packet+0x67a/0xf10 [ 307.037197][ T4909] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 307.037243][ T4909] ? __pfx_hci_event_packet+0x10/0x10 [ 307.037286][ T4909] ? rt_spin_unlock+0x157/0x200 [ 307.037332][ T4909] ? hci_send_to_monitor+0xe2/0x590 [ 307.037373][ T4909] hci_rx_work+0x3ee/0x1020 [ 307.037428][ T4909] ? process_scheduled_works+0xa20/0x14e0 [ 307.037464][ T4909] process_scheduled_works+0xa8e/0x14e0 [ 307.037539][ T4909] ? __pfx_process_scheduled_works+0x10/0x10 [ 307.037582][ T4909] ? assign_work+0x3cf/0x5d0 [ 307.037627][ T4909] worker_thread+0xa47/0xfb0 [ 307.037683][ T4909] ? __kthread_parkme+0x71/0x1f0 [ 307.037734][ T4909] kthread+0x388/0x470 [ 307.037779][ T4909] ? __pfx_worker_thread+0x10/0x10 [ 307.037813][ T4909] ? __pfx_kthread+0x10/0x10 [ 307.037860][ T4909] ret_from_fork+0x514/0xb70 [ 307.037905][ T4909] ? __pfx_ret_from_fork+0x10/0x10 [ 307.037950][ T4909] ? __switch_to+0xc89/0x1420 [ 307.037993][ T4909] ? __pfx_kthread+0x10/0x10 [ 307.038038][ T4909] ret_from_fork_asm+0x1a/0x30 [ 307.038081][ T4909] [ 307.038655][ T4909] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 307.038781][ T4909] Bluetooth: hci1: failed to register connection device [ 307.397395][ T7801] erspan0: left allmulticast mode [ 307.397420][ T7801] erspan0: left promiscuous mode [ 307.397629][ T7801] bridge1: port 1(erspan0) entered disabled state [ 307.531057][ T7822] netlink: 64 bytes leftover after parsing attributes in process `syz.4.631'. [ 307.598813][ T7824] netlink: 164 bytes leftover after parsing attributes in process `syz.3.632'. [ 307.973668][ T7833] netlink: 'syz.1.637': attribute type 11 has an invalid length. [ 308.040132][ T7828] netlink: 24 bytes leftover after parsing attributes in process `syz.2.634'. [ 309.206588][ T7846] netlink: 'syz.2.641': attribute type 11 has an invalid length. [ 309.276922][ T4909] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 309.276954][ T4909] CPU: 0 UID: 0 PID: 4909 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 309.276987][ T4909] Tainted: [L]=SOFTLOCKUP [ 309.276995][ T4909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 309.277009][ T4909] Workqueue: hci4 hci_rx_work [ 309.277048][ T4909] Call Trace: [ 309.277056][ T4909] [ 309.277067][ T4909] dump_stack_lvl+0xe8/0x150 [ 309.277107][ T4909] sysfs_create_dir_ns+0x271/0x2a0 [ 309.277149][ T4909] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 309.277192][ T4909] ? rt_spin_unlock+0x163/0x200 [ 309.277222][ T4909] kobject_add_internal+0x62c/0xce0 [ 309.277254][ T4909] kobject_add+0x163/0x240 [ 309.277274][ T4909] ? rt_spin_unlock+0x157/0x200 [ 309.277306][ T4909] ? __pfx_kobject_add+0x10/0x10 [ 309.277336][ T4909] ? get_device_parent+0x370/0x3a0 [ 309.277367][ T4909] device_add+0x3fa/0xb80 [ 309.277396][ T4909] hci_conn_add_sysfs+0xd5/0x210 [ 309.277430][ T4909] le_conn_complete_evt+0xfef/0x1580 [ 309.277466][ T4909] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 309.277491][ T4909] ? lockdep_hardirqs_on+0x7a/0x110 [ 309.277522][ T4909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 309.277554][ T4909] ? rt_mutex_slowunlock+0x219/0x460 [ 309.277580][ T4909] ? skb_pull_data+0xf0/0x200 [ 309.277611][ T4909] hci_le_conn_complete_evt+0x187/0x470 [ 309.277656][ T4909] hci_event_packet+0x67a/0xf10 [ 309.277697][ T4909] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 309.277733][ T4909] ? __pfx_hci_event_packet+0x10/0x10 [ 309.277775][ T4909] ? rt_spin_unlock+0x157/0x200 [ 309.277811][ T4909] ? hci_send_to_monitor+0xe2/0x590 [ 309.277840][ T4909] hci_rx_work+0x3ee/0x1020 [ 309.277884][ T4909] ? process_scheduled_works+0xa20/0x14e0 [ 309.277912][ T4909] process_scheduled_works+0xa8e/0x14e0 [ 309.277975][ T4909] ? __pfx_process_scheduled_works+0x10/0x10 [ 309.278010][ T4909] ? assign_work+0x3cf/0x5d0 [ 309.278043][ T4909] worker_thread+0xa47/0xfb0 [ 309.278088][ T4909] ? __kthread_parkme+0x71/0x1f0 [ 309.278131][ T4909] kthread+0x388/0x470 [ 309.278166][ T4909] ? __pfx_worker_thread+0x10/0x10 [ 309.278191][ T4909] ? __pfx_kthread+0x10/0x10 [ 309.278227][ T4909] ret_from_fork+0x514/0xb70 [ 309.278263][ T4909] ? __pfx_ret_from_fork+0x10/0x10 [ 309.278299][ T4909] ? __switch_to+0xc89/0x1420 [ 309.278332][ T4909] ? __pfx_kthread+0x10/0x10 [ 309.278367][ T4909] ret_from_fork_asm+0x1a/0x30 [ 309.278406][ T4909] [ 309.278455][ T4909] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 309.278491][ T4909] Bluetooth: hci4: failed to register connection device [ 310.159331][ T7863] netlink: 64 bytes leftover after parsing attributes in process `syz.2.646'. [ 310.995387][ T7872] netlink: 'syz.4.649': attribute type 11 has an invalid length. [ 311.281244][ T7876] netlink: 24 bytes leftover after parsing attributes in process `syz.4.651'. [ 311.590439][ T4909] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 311.590471][ T4909] CPU: 0 UID: 0 PID: 4909 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 311.590504][ T4909] Tainted: [L]=SOFTLOCKUP [ 311.590513][ T4909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 311.590528][ T4909] Workqueue: hci2 hci_rx_work [ 311.590565][ T4909] Call Trace: [ 311.590574][ T4909] [ 311.590583][ T4909] dump_stack_lvl+0xe8/0x150 [ 311.590621][ T4909] sysfs_create_dir_ns+0x271/0x2a0 [ 311.590660][ T4909] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 311.590701][ T4909] ? rt_spin_unlock+0x163/0x200 [ 311.590729][ T4909] kobject_add_internal+0x62c/0xce0 [ 311.590761][ T4909] kobject_add+0x163/0x240 [ 311.590781][ T4909] ? rt_spin_unlock+0x157/0x200 [ 311.590830][ T4909] ? __pfx_kobject_add+0x10/0x10 [ 311.590861][ T4909] ? get_device_parent+0x370/0x3a0 [ 311.590892][ T4909] device_add+0x3fa/0xb80 [ 311.590920][ T4909] hci_conn_add_sysfs+0xd5/0x210 [ 311.590954][ T4909] le_conn_complete_evt+0xfef/0x1580 [ 311.590990][ T4909] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 311.591023][ T4909] ? lockdep_hardirqs_on+0x7a/0x110 [ 311.591055][ T4909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 311.591088][ T4909] ? rt_mutex_slowunlock+0x219/0x460 [ 311.591115][ T4909] ? skb_pull_data+0xf0/0x200 [ 311.591147][ T4909] hci_le_conn_complete_evt+0x187/0x470 [ 311.591194][ T4909] hci_event_packet+0x67a/0xf10 [ 311.591237][ T4909] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 311.591272][ T4909] ? __pfx_hci_event_packet+0x10/0x10 [ 311.591303][ T4909] ? rt_spin_unlock+0x157/0x200 [ 311.591337][ T4909] ? hci_send_to_monitor+0xe2/0x590 [ 311.591366][ T4909] hci_rx_work+0x3ee/0x1020 [ 311.591407][ T4909] ? process_scheduled_works+0xa20/0x14e0 [ 311.591434][ T4909] process_scheduled_works+0xa8e/0x14e0 [ 311.591493][ T4909] ? __pfx_process_scheduled_works+0x10/0x10 [ 311.591527][ T4909] ? assign_work+0x3cf/0x5d0 [ 311.591559][ T4909] worker_thread+0xa47/0xfb0 [ 311.591603][ T4909] ? __kthread_parkme+0x71/0x1f0 [ 311.591646][ T4909] kthread+0x388/0x470 [ 311.591680][ T4909] ? __pfx_worker_thread+0x10/0x10 [ 311.591706][ T4909] ? __pfx_kthread+0x10/0x10 [ 311.591742][ T4909] ret_from_fork+0x514/0xb70 [ 311.591780][ T4909] ? __pfx_ret_from_fork+0x10/0x10 [ 311.591815][ T4909] ? __switch_to+0xc89/0x1420 [ 311.591848][ T4909] ? __pfx_kthread+0x10/0x10 [ 311.591883][ T4909] ret_from_fork_asm+0x1a/0x30 [ 311.591926][ T4909] [ 311.591958][ T4909] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 311.592000][ T4909] Bluetooth: hci2: failed to register connection device [ 312.043145][ T7892] netlink: 'syz.4.656': attribute type 11 has an invalid length. [ 312.125077][ T7895] netlink: 52 bytes leftover after parsing attributes in process `syz.2.658'. [ 312.466528][ T7903] netlink: 'syz.1.661': attribute type 12 has an invalid length. [ 313.624947][ T4909] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 313.928666][ T7924] netlink: 52 bytes leftover after parsing attributes in process `syz.1.670'. [ 314.121930][ T7930] netlink: 'syz.1.672': attribute type 11 has an invalid length. [ 314.342071][ T7938] netlink: 'syz.3.676': attribute type 12 has an invalid length. [ 315.124335][ T7950] netlink: 52 bytes leftover after parsing attributes in process `syz.1.682'. [ 315.597860][ T7963] netlink: 'syz.3.688': attribute type 12 has an invalid length. [ 316.319917][ T7972] netlink: 24 bytes leftover after parsing attributes in process `syz.4.691'. [ 316.775069][ T7980] netlink: 44 bytes leftover after parsing attributes in process `syz.2.694'. [ 317.393999][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.418022][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.403976][ T8005] syzkaller0: entered promiscuous mode [ 318.404004][ T8005] syzkaller0: entered allmulticast mode [ 319.022087][ T8012] netlink: 12 bytes leftover after parsing attributes in process `syz.3.707'. [ 319.054071][ T8014] netlink: 'syz.1.708': attribute type 12 has an invalid length. [ 319.822018][ T8028] netlink: 40 bytes leftover after parsing attributes in process `syz.3.712'. [ 320.113534][ T8033] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 322.504583][ T8045] netlink: 44 bytes leftover after parsing attributes in process `syz.3.718'. [ 322.506616][ T36] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 322.706578][ T36] usb 2-1: Using ep0 maxpacket: 16 [ 322.715706][ T36] usb 2-1: config index 0 descriptor too short (expected 25874, got 18) [ 322.715735][ T36] usb 2-1: config 111 has too many interfaces: 116, using maximum allowed: 32 [ 322.715759][ T36] usb 2-1: config 111 has an invalid descriptor of length 47, skipping remainder of the config [ 322.715781][ T36] usb 2-1: config 111 has 0 interfaces, different from the descriptor's value: 116 [ 322.762297][ T36] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 322.762329][ T36] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 322.762351][ T36] usb 2-1: Product: syz [ 322.762367][ T36] usb 2-1: Manufacturer: syz [ 322.762382][ T36] usb 2-1: SerialNumber: syz [ 323.046713][ T36] usb 2-1: USB disconnect, device number 7 [ 324.907622][ T8066] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 325.077912][ T8074] netlink: 'syz.2.719': attribute type 12 has an invalid length. [ 325.633910][ T8095] binder: 8094:8095 ioctl c0306201 200000000080 returned -14 [ 325.662503][ T8095] binder: 8094:8095 ioctl c0306201 2000000003c0 returned -14 [ 327.336501][ T8117] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 329.992176][ T8180] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 332.064146][ T8221] binder_alloc: 8220: binder_alloc_buf, no vma [ 332.590570][ T8231] netlink: 12 bytes leftover after parsing attributes in process `syz.2.788'. [ 332.591214][ T8231] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 333.497847][ T5714] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 333.867703][ T5714] usb 3-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 333.867747][ T5714] usb 3-1: config 0 interface 0 has no altsetting 0 [ 333.871113][ T5714] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 333.871140][ T5714] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 333.871162][ T5714] usb 3-1: Product: syz [ 333.871176][ T5714] usb 3-1: Manufacturer: syz [ 333.871191][ T5714] usb 3-1: SerialNumber: syz [ 333.976114][ T5714] usb 3-1: config 0 descriptor?? [ 333.977337][ T8242] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 334.206095][ T5714] usb 3-1: selecting invalid altsetting 0 [ 336.331165][ T5714] usb 3-1: USB disconnect, device number 16 [ 337.106656][ T8279] binder: 8277:8279 ioctl c0306201 200000000080 returned -14 [ 338.585781][ T8296] netlink: 8 bytes leftover after parsing attributes in process `syz.1.809'. [ 339.390739][ T6450] libceph: connect (1)[c::]:6789 error -101 [ 339.638960][ T6450] libceph: mon0 (1)[c::]:6789 connect error [ 339.907797][ T6450] libceph: connect (1)[c::]:6789 error -101 [ 339.908000][ T6450] libceph: mon0 (1)[c::]:6789 connect error [ 340.039285][ T8306] ceph: No mds server is up or the cluster is laggy [ 340.240910][ T8323] fuse: Bad value for 'fd' [ 342.906511][ T6450] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 342.977714][ T11] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 343.996460][ T11] usb 5-1: Using ep0 maxpacket: 16 [ 343.998836][ T11] usb 5-1: unable to get BOS descriptor or descriptor too short [ 344.003505][ T6450] usb 4-1: config 128 has an invalid interface number: 148 but max is 0 [ 344.003530][ T6450] usb 4-1: config 128 has no interface number 0 [ 344.003585][ T6450] usb 4-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 344.003621][ T6450] usb 4-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 344.003648][ T6450] usb 4-1: config 128 interface 148 has no altsetting 0 [ 344.007231][ T11] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 344.007394][ T11] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 344.040675][ T6450] usb 4-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 344.040706][ T6450] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.040729][ T6450] usb 4-1: Product: syz [ 344.040744][ T6450] usb 4-1: Manufacturer: syz [ 344.040761][ T6450] usb 4-1: SerialNumber: syz [ 344.041531][ T11] usb 5-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 344.041560][ T11] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.041581][ T11] usb 5-1: Product: syz [ 344.041597][ T11] usb 5-1: Manufacturer: syz [ 344.041611][ T11] usb 5-1: SerialNumber: syz [ 344.422410][ T6450] usb 4-1: USB disconnect, device number 4 [ 344.624841][ T8370] netlink: 128 bytes leftover after parsing attributes in process `syz.4.838'. [ 344.656076][ T8370] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 344.823702][ T8370] netlink: 'syz.4.838': attribute type 21 has an invalid length. [ 344.823811][ T8370] netlink: 132 bytes leftover after parsing attributes in process `syz.4.838'. [ 344.844758][ T8370] random: crng reseeded on system resumption [ 344.986536][ T6450] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 345.167042][ T6450] usb 4-1: Using ep0 maxpacket: 8 [ 345.170043][ T6450] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 345.170355][ T6450] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 345.170380][ T6450] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 345.170404][ T6450] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 16 [ 345.170428][ T6450] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 345.170468][ T6450] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 345.170490][ T6450] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.360197][ T11] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 345.369133][ T11] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 345.427986][ T5815] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 345.647057][ T5815] usb 1-1: Using ep0 maxpacket: 32 [ 345.650345][ T5815] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.650370][ T5815] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.684824][ T5815] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 345.684912][ T5815] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 345.684974][ T5815] usb 1-1: Product: syz [ 345.685010][ T5815] usb 1-1: Manufacturer: syz [ 345.719576][ T8398] binder: BINDER_SET_CONTEXT_MGR already set [ 345.719592][ T8398] binder: 8397:8398 ioctl 4018620d 200000000040 returned -16 [ 345.816855][ T5815] hub 1-1:4.0: USB hub found [ 345.884680][ T11] usb 5-1: USB disconnect, device number 5 [ 346.038174][ T5815] hub 1-1:4.0: 2 ports detected [ 346.234807][ T8404] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 346.334457][ T5714] usb 4-1: USB disconnect, device number 5 [ 347.471669][ T8433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.858'. [ 347.489764][ T5815] hub 1-1:4.0: activate --> -90 [ 347.908498][ T5747] usb 1-1: USB disconnect, device number 12 [ 347.910056][ T5815] hub 1-1:4.0: hub_ext_port_status failed (err = -71) [ 347.910081][ T5815] hub_port_connect: 132 callbacks suppressed [ 347.910095][ T5815] usb 1-1-port2: connect-debounce failed [ 348.036538][ T8441] binder: BINDER_SET_CONTEXT_MGR already set [ 348.036553][ T8441] binder: 8440:8441 ioctl 4018620d 200000000040 returned -16 [ 348.698088][ T5714] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 348.718219][ T8464] netlink: 4 bytes leftover after parsing attributes in process `syz.1.870'. [ 348.882343][ T5714] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 348.882381][ T5714] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 349.037127][ T5714] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 349.037203][ T5714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.037266][ T5714] usb 4-1: Product: syz [ 349.037284][ T5714] usb 4-1: Manufacturer: syz [ 349.037346][ T5714] usb 4-1: SerialNumber: syz [ 350.089440][ T5714] usb 4-1: USB disconnect, device number 6 [ 350.703083][ T8487] fuse: Bad value for 'fd' [ 350.814900][ T8494] netlink: 40 bytes leftover after parsing attributes in process `syz.4.880'. [ 351.315641][ T8508] loop7: detected capacity change from 0 to 16384 [ 352.561344][ T8535] netlink: 40 bytes leftover after parsing attributes in process `syz.0.896'. [ 354.592084][ T8574] netlink: 40 bytes leftover after parsing attributes in process `syz.1.913'. [ 356.482427][ T8598] netlink: 12 bytes leftover after parsing attributes in process `syz.3.922'. [ 356.482470][ T8598] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 356.716408][ T198] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 356.878659][ T198] usb 4-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 356.878694][ T198] usb 4-1: config 0 interface 0 has no altsetting 0 [ 356.884887][ T198] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 356.884915][ T198] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 356.884952][ T198] usb 4-1: Product: syz [ 356.884966][ T198] usb 4-1: Manufacturer: syz [ 356.884981][ T198] usb 4-1: SerialNumber: syz [ 356.984454][ T198] usb 4-1: config 0 descriptor?? [ 356.985300][ T8598] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 357.033090][ T198] usb 4-1: selecting invalid altsetting 0 [ 357.090685][ T8612] netlink: 'syz.1.928': attribute type 11 has an invalid length. [ 357.812016][ T198] usb 4-1: USB disconnect, device number 7 [ 357.857854][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 357.858116][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 357.908304][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 357.912629][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 358.231194][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 358.400864][ T8616] ceph: No mds server is up or the cluster is laggy [ 358.473839][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 359.106986][ T7594] udevd[7594]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 359.123440][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 359.166554][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 360.039919][ T8657] netlink: 12 bytes leftover after parsing attributes in process `syz.2.946'. [ 360.039977][ T8657] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 360.305042][ T5700] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 360.918679][ T5700] usb 3-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 360.918753][ T5700] usb 3-1: config 0 interface 0 has no altsetting 0 [ 360.983126][ T5700] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 360.983244][ T5700] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 360.983317][ T5700] usb 3-1: Product: syz [ 360.983383][ T5700] usb 3-1: Manufacturer: syz [ 360.983434][ T5700] usb 3-1: SerialNumber: syz [ 361.271555][ T5700] usb 3-1: config 0 descriptor?? [ 361.439380][ T8657] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 361.810869][ T5700] usb 3-1: selecting invalid altsetting 0 [ 362.026993][ T8669] fuse: Bad value for 'fd' [ 362.154432][ T5700] usb 3-1: USB disconnect, device number 17 [ 362.243750][ T6450] kernel write not supported for file /uhid (pid: 6450 comm: kworker/1:8) [ 362.449790][ T7854] udevd[7854]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 363.154393][ T5700] libceph: connect (1)[c::]:6789 error -101 [ 363.154587][ T5700] libceph: mon0 (1)[c::]:6789 connect error [ 363.190979][ T5700] libceph: connect (1)[c::]:6789 error -101 [ 363.191138][ T5700] libceph: mon0 (1)[c::]:6789 connect error [ 363.255100][ T8709] netlink: 28 bytes leftover after parsing attributes in process `syz.1.966'. [ 363.308604][ T8711] netlink: 24 bytes leftover after parsing attributes in process `syz.3.967'. [ 363.468460][ T198] libceph: connect (1)[c::]:6789 error -101 [ 363.468611][ T198] libceph: mon0 (1)[c::]:6789 connect error [ 363.693233][ T8723] netlink: 12 bytes leftover after parsing attributes in process `syz.0.973'. [ 363.693289][ T8723] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 363.875811][ T8703] ceph: No mds server is up or the cluster is laggy [ 363.986476][ T5700] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 363.988209][ T198] libceph: connect (1)[c::]:6789 error -101 [ 363.988412][ T198] libceph: mon0 (1)[c::]:6789 connect error [ 364.139809][ T5700] usb 1-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 364.139857][ T5700] usb 1-1: config 0 interface 0 has no altsetting 0 [ 364.207212][ T5700] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 364.207246][ T5700] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 364.207268][ T5700] usb 1-1: Product: syz [ 364.207283][ T5700] usb 1-1: Manufacturer: syz [ 364.207304][ T5700] usb 1-1: SerialNumber: syz [ 365.007073][ T5700] usb 1-1: config 0 descriptor?? [ 365.013859][ T8723] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 365.136893][ T5700] usb 1-1: selecting invalid altsetting 0 [ 365.485038][ T5700] usb 1-1: USB disconnect, device number 13 [ 366.412754][ T198] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 366.556942][ T198] usb 4-1: Using ep0 maxpacket: 16 [ 366.561473][ T198] usb 4-1: unable to get BOS descriptor or descriptor too short [ 366.565929][ T198] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 255, changing to 7 [ 366.600459][ T198] usb 4-1: New USB device found, idVendor=1235, idProduct=000e, bcdDevice= 0.40 [ 366.600491][ T198] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.600512][ T198] usb 4-1: Product: syz [ 366.600545][ T198] usb 4-1: Manufacturer: syz [ 366.600561][ T198] usb 4-1: SerialNumber: syz [ 366.983472][ T198] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 366.984084][ T198] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 367.841304][ T198] usb 4-1: USB disconnect, device number 8 [ 369.000441][ T37] audit: type=1800 audit(1783405165.638:388): pid=8788 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.991" name="file0" dev="overlay" ino=988 res=0 errno=0 [ 369.039669][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 369.181408][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 369.181601][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 369.216186][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 369.216876][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 369.462229][ T8778] ceph: No mds server is up or the cluster is laggy [ 369.478925][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 369.479635][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 370.676261][ T5608] libceph: connect (1)[c::]:6789 error -101 [ 370.686405][ T5608] libceph: mon0 (1)[c::]:6789 connect error [ 371.329589][ T8804] netlink: 76 bytes leftover after parsing attributes in process `syz.1.999'. [ 373.040902][ T5610] Bluetooth: hci0: adv larger than maximum supported [ 373.040926][ T5610] Bluetooth: hci0: Malformed LE Event: 0x0d [ 375.135115][ T11] libceph: connect (1)[c::]:6789 error -101 [ 375.135330][ T11] libceph: mon0 (1)[c::]:6789 connect error [ 375.149456][ T11] libceph: connect (1)[c::]:6789 error -101 [ 375.162307][ T11] libceph: mon0 (1)[c::]:6789 connect error [ 375.225434][ T8832] ceph: No mds server is up or the cluster is laggy [ 375.437279][ T11] libceph: connect (1)[c::]:6789 error -101 [ 375.437488][ T11] libceph: mon0 (1)[c::]:6789 connect error [ 376.641693][ T8862] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1021'. [ 376.676623][ T8861] netlink: 'syz.1.1020': attribute type 11 has an invalid length. [ 376.787856][ T8864] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1022'. [ 376.787944][ T8864] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 377.184264][ T5747] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 377.429804][ T5747] usb 3-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 377.429840][ T5747] usb 3-1: config 0 interface 0 has no altsetting 0 [ 377.433155][ T5747] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 377.433187][ T5747] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 377.433209][ T5747] usb 3-1: Product: syz [ 377.433282][ T5747] usb 3-1: Manufacturer: syz [ 377.433298][ T5747] usb 3-1: SerialNumber: syz [ 377.506930][ T5747] usb 3-1: config 0 descriptor?? [ 377.507981][ T8864] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 377.559265][ T5747] usb 3-1: selecting invalid altsetting 0 [ 377.775178][ T8863] snd-usb-audio 3-1:0.0: Runtime PM usage count underflow! [ 377.787388][ T5747] usb 3-1: USB disconnect, device number 18 [ 378.020702][ T7021] udevd[7021]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 378.075163][ T8901] netlink: 'syz.3.1035': attribute type 11 has an invalid length. [ 378.731146][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.731231][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.003622][ T11] Process accounting resumed [ 381.213158][ T8931] fuse: fd is not a fuse device [ 381.526076][ T8939] netlink: 'syz.1.1048': attribute type 11 has an invalid length. [ 381.587599][ T8942] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1049'. [ 381.587655][ T8942] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 381.733078][ T8947] 9p: Bad value for 'wfdno' [ 381.826420][ T5747] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 382.109664][ T8958] fuse: fd is not a fuse device [ 382.467251][ T8964] fuse: Bad value for 'fd' [ 382.487318][ T5747] usb 1-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 382.487363][ T5747] usb 1-1: config 0 interface 0 has no altsetting 0 [ 382.490444][ T5747] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 382.490474][ T5747] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 382.490497][ T5747] usb 1-1: Product: syz [ 382.490512][ T5747] usb 1-1: Manufacturer: syz [ 382.490527][ T5747] usb 1-1: SerialNumber: syz [ 382.499979][ T5747] usb 1-1: config 0 descriptor?? [ 382.502403][ T8942] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 382.512986][ T5747] usb 1-1: selecting invalid altsetting 0 [ 382.957093][ T8975] netlink: 'syz.2.1063': attribute type 11 has an invalid length. [ 383.108746][ T5747] usb 1-1: USB disconnect, device number 14 [ 384.625437][ T7594] udevd[7594]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 385.436395][ T5747] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 385.589676][ T5747] usb 4-1: Using ep0 maxpacket: 8 [ 385.592347][ T5747] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 385.592406][ T5747] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 385.592430][ T5747] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 385.592469][ T5747] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 385.592493][ T5747] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 385.592516][ T5747] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 385.592560][ T5747] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 385.592584][ T5747] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 385.617436][ T9025] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1086'. [ 385.617570][ T9025] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 385.755603][ T9028] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 385.755639][ T9028] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 385.869481][ T5747] usbtmc 4-1:16.0: probe with driver usbtmc failed with error -22 [ 385.966482][ T11] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 386.043958][ T9034] Illegal XDP return value 2936870943 on prog (id 65) dev N/A, expect packet loss! [ 386.158290][ T11] usb 1-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 386.158327][ T11] usb 1-1: config 0 interface 0 has no altsetting 0 [ 386.174412][ T11] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 386.174495][ T11] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 386.174554][ T11] usb 1-1: Product: syz [ 386.174589][ T11] usb 1-1: Manufacturer: syz [ 386.174630][ T11] usb 1-1: SerialNumber: syz [ 386.223379][ T11] usb 1-1: config 0 descriptor?? [ 386.224162][ T9025] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 386.249582][ T11] usb 1-1: selecting invalid altsetting 0 [ 386.602159][ T11] usb 1-1: USB disconnect, device number 15 [ 387.449016][ T9049] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1095'. [ 387.894950][ T9059] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 387.894982][ T9059] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 388.086913][ T5714] usb 4-1: USB disconnect, device number 9 [ 388.798960][ T5904] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.601831][ T36] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 389.758570][ T36] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid maxpacket 9865, setting to 1024 [ 389.758607][ T36] usb 1-1: config 0 interface 0 has no altsetting 0 [ 389.758639][ T36] usb 1-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.00 [ 389.758663][ T36] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.944771][ T36] usb 1-1: config 0 descriptor?? [ 389.945686][ T9067] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 389.965742][ T4909] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 390.013825][ T4909] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 390.016121][ T4909] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 390.018680][ T4909] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 390.021365][ T4909] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 390.475824][ T36] hid_parser_main: 30 callbacks suppressed [ 390.475898][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.475952][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476011][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476039][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476066][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476093][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476121][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476149][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476176][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.476204][ T36] razer 0003:1532:010D.0010: unknown main item tag 0x0 [ 390.604577][ T36] razer 0003:1532:010D.0010: hidraw0: USB HID v7f.fd Device [HID 1532:010d] on usb-dummy_hcd.0-1/input0 [ 390.846488][ T5747] usb 1-1: USB disconnect, device number 16 [ 391.804760][ T9074] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.805105][ T9074] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.119277][ T5610] Bluetooth: hci4: command tx timeout [ 392.256555][ T11] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 392.325773][ T9074] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 392.334006][ T9074] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 392.416553][ T11] usb 3-1: Using ep0 maxpacket: 8 [ 392.450862][ T11] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 392.450959][ T11] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 392.450977][ T11] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 392.450995][ T11] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 392.451011][ T11] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 392.451028][ T11] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 392.451059][ T11] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 392.451076][ T11] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 392.585169][ T11] usbtmc 3-1:16.0: probe with driver usbtmc failed with error -22 [ 392.717021][ T9074] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 392.717055][ T9074] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 393.461918][ T990] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.462951][ T990] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.462997][ T990] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.463038][ T990] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 394.039844][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 394.143772][ T5904] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 394.197606][ T5610] Bluetooth: hci4: command tx timeout [ 394.924097][ T5714] usb 3-1: USB disconnect, device number 19 [ 395.161960][ T5904] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.276481][ T5610] Bluetooth: hci4: command tx timeout [ 396.351849][ T5904] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.356440][ T5610] Bluetooth: hci4: command tx timeout [ 398.558498][ T9218] Process accounting resumed [ 400.905053][ T9270] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1156'. [ 401.131624][ T9266] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1156'. [ 402.233715][ T9280] Process accounting resumed [ 404.397011][ T5904] bridge_slave_1: left allmulticast mode [ 404.397239][ T5904] bridge_slave_1: left promiscuous mode [ 404.403449][ T5904] bridge0: port 2(bridge_slave_1) entered disabled state [ 406.698251][ T5904] bridge_slave_0: left allmulticast mode [ 406.698288][ T5904] bridge_slave_0: left promiscuous mode [ 406.700546][ T5904] bridge0: port 1(bridge_slave_0) entered disabled state [ 406.760287][ T9334] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1175'. [ 407.173064][ T9343] Process accounting resumed [ 409.017202][ T5747] IPVS: starting estimator thread 0... [ 409.156990][ T9356] IPVS: using max 7 ests per chain, 16800 per kthread [ 410.227679][ T5904] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 410.318856][ T5904] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 410.398075][ T5904] bond0 (unregistering): Released all slaves [ 410.606310][ T9330] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1175'. [ 412.010339][ T9078] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.010564][ T9078] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.010780][ T9078] bridge_slave_0: entered allmulticast mode [ 412.040789][ T9078] bridge_slave_0: entered promiscuous mode [ 412.058138][ T9078] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.058344][ T9078] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.058519][ T9078] bridge_slave_1: entered allmulticast mode [ 412.065133][ T9078] bridge_slave_1: entered promiscuous mode [ 412.263520][ T9393] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1195'. [ 412.342700][ T9406] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1195'. [ 412.993790][ T5255] 8021q: adding VLAN 0 to HW filter on device eth1 [ 413.172659][ T9078] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 413.234778][ T9078] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 414.150311][ T9078] team0: Port device team_slave_0 added [ 414.332741][ T9078] team0: Port device team_slave_1 added [ 416.079923][ T9470] netlink: 'syz.1.1217': attribute type 10 has an invalid length. [ 416.079940][ T9470] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1217'. [ 416.632740][ T9470] bridge0: port 3(dummy0) entered blocking state [ 416.632836][ T9470] bridge0: port 3(dummy0) entered disabled state [ 416.632991][ T9470] dummy0: entered allmulticast mode [ 416.663897][ T9470] dummy0: entered promiscuous mode [ 416.746062][ T9470] bridge0: port 3(dummy0) entered blocking state [ 416.784398][ T9470] bridge0: port 3(dummy0) entered forwarding state [ 417.004278][ T9078] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 417.004297][ T9078] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.004327][ T9078] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 417.132442][ T5255] 8021q: adding VLAN 0 to HW filter on device eth2 [ 417.148401][ T9078] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 417.148417][ T9078] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 417.148448][ T9078] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 418.028129][ T5904] hsr_slave_0: left promiscuous mode [ 418.066393][ T5904] hsr_slave_1: left promiscuous mode [ 418.067395][ T5904] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 418.067540][ T5904] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 418.218403][ T5904] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 418.220195][ T5904] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.082984][ T5904] veth1_macvtap: left promiscuous mode [ 419.083227][ T5904] veth0_macvtap: left promiscuous mode [ 419.083445][ T5904] veth1_vlan: left promiscuous mode [ 419.083716][ T5904] veth0_vlan: left promiscuous mode [ 420.541764][ T37] audit: type=1326 audit(1783405217.618:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9515 comm="syz.3.1230" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f37bdc6de59 code=0x0 [ 421.124356][ T5904] team0 (unregistering): Port device team_slave_1 removed [ 421.165895][ T5747] hid_parser_main: 852 callbacks suppressed [ 421.165920][ T5747] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 421.205717][ T5904] team0 (unregistering): Port device team_slave_0 removed [ 421.967857][ T5747] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 422.351402][ T9078] hsr_slave_0: entered promiscuous mode [ 422.352767][ T9078] hsr_slave_1: entered promiscuous mode [ 422.353717][ T9078] debugfs: 'hsr0' already exists in 'hsr' [ 422.353744][ T9078] Cannot create hsr debugfs directory [ 423.694711][ T5608] Process accounting resumed [ 425.555414][ T9576] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1246'. [ 425.555727][ T9576] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 426.367228][ T5255] 8021q: adding VLAN 0 to HW filter on device eth3 [ 426.582705][ T9603] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1256'. [ 426.582761][ T9603] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 429.308444][ T9637] fuse: Bad value for 'fd' [ 429.632988][ T5747] Process accounting resumed [ 433.036409][ T11] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 433.177858][ T11] usb 1-1: device descriptor read/64, error -71 [ 433.230012][ T9688] overlayfs: failed to clone upperpath [ 433.289192][ T9690] fuse: Bad value for 'fd' [ 433.446475][ T11] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 433.595106][ T11] usb 1-1: device descriptor read/64, error -71 [ 434.134413][ T11] usb usb1-port1: attempt power cycle [ 434.476372][ T11] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 434.497220][ T11] usb 1-1: device descriptor read/8, error -71 [ 434.737704][ T11] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 434.757277][ T11] usb 1-1: device descriptor read/8, error -71 [ 434.866923][ T11] usb usb1-port1: unable to enumerate USB device [ 434.948946][ T36] Process accounting resumed [ 435.771931][ T9730] fuse: Bad value for 'fd' [ 436.646773][ T198] Process accounting resumed [ 437.202837][ T9754] netlink: 'syz.2.1296': attribute type 10 has an invalid length. [ 437.202861][ T9754] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1296'. [ 437.206061][ T9754] bridge0: port 3(dummy0) entered blocking state [ 437.232657][ T9754] bridge0: port 3(dummy0) entered disabled state [ 437.232878][ T9754] dummy0: entered allmulticast mode [ 437.272253][ T9754] dummy0: entered promiscuous mode [ 437.330013][ T9754] bridge0: port 3(dummy0) entered blocking state [ 437.330182][ T9754] bridge0: port 3(dummy0) entered forwarding state [ 437.500860][ T9078] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 437.958915][ T9078] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 438.143579][ T9078] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 438.790079][ T9078] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 438.811921][ T9078] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 438.883508][ T9078] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 438.898679][ T9078] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 438.983769][ T9078] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 439.133001][ T9790] fuse: Bad value for 'fd' [ 440.706411][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.706529][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.826190][ T9078] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.031995][ T9806] binder: 9805:9806 ioctl c0306201 200000000080 returned -14 [ 441.061521][ T9806] binder: 9805:9806 ioctl c0306201 0 returned -14 [ 441.115671][ T9078] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.151533][ T76] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.151637][ T76] bridge0: port 1(bridge_slave_0) entered forwarding state [ 441.220785][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.220887][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 441.468675][ T5815] Process accounting resumed [ 443.509197][ T9828] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1314'. [ 443.757943][ T9835] fuse: Bad value for 'fd' [ 444.559189][ T9855] binder: 9854:9855 ioctl c0306201 200000000080 returned -14 [ 444.588343][ T9855] binder: 9854:9855 ioctl c0306201 0 returned -14 [ 445.864754][ T9876] binder: BINDER_SET_CONTEXT_MGR already set [ 445.864769][ T9876] binder: 9875:9876 ioctl 4018620d 200000004a80 returned -16 [ 447.318116][ T9078] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 449.445442][ T9927] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1342'. [ 449.762918][ T5610] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 449.762961][ T5610] CPU: 0 UID: 0 PID: 5610 Comm: kworker/u9:5 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 449.762995][ T5610] Tainted: [L]=SOFTLOCKUP [ 449.763004][ T5610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 449.763019][ T5610] Workqueue: hci1 hci_rx_work [ 449.763220][ T5610] Call Trace: [ 449.763258][ T5610] [ 449.763331][ T5610] dump_stack_lvl+0xe8/0x150 [ 449.763459][ T5610] sysfs_create_dir_ns+0x271/0x2a0 [ 449.763580][ T5610] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 449.763628][ T5610] ? rt_spin_unlock+0x163/0x200 [ 449.763720][ T5610] kobject_add_internal+0x62c/0xce0 [ 449.763778][ T5610] kobject_add+0x163/0x240 [ 449.763798][ T5610] ? rt_spin_unlock+0x157/0x200 [ 449.763828][ T5610] ? __pfx_kobject_add+0x10/0x10 [ 449.763856][ T5610] ? get_device_parent+0x370/0x3a0 [ 449.763970][ T5610] device_add+0x3fa/0xb80 [ 449.764000][ T5610] hci_conn_add_sysfs+0xd5/0x210 [ 449.764062][ T5610] le_conn_complete_evt+0xfef/0x1580 [ 449.764126][ T5610] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 449.764152][ T5610] ? lockdep_hardirqs_on+0x7a/0x110 [ 449.764205][ T5610] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 449.764263][ T5610] ? rt_mutex_slowunlock+0x219/0x460 [ 449.764289][ T5610] ? skb_pull_data+0xf0/0x200 [ 449.764384][ T5610] hci_le_conn_complete_evt+0x187/0x470 [ 449.764453][ T5610] hci_event_packet+0x67a/0xf10 [ 449.764494][ T5610] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 449.764522][ T5610] ? __pfx_hci_event_packet+0x10/0x10 [ 449.764547][ T5610] ? rt_spin_unlock+0x157/0x200 [ 449.764575][ T5610] ? hci_send_to_monitor+0xe2/0x590 [ 449.764599][ T5610] hci_rx_work+0x3ee/0x1020 [ 449.764632][ T5610] ? process_scheduled_works+0xa20/0x14e0 [ 449.764711][ T5610] process_scheduled_works+0xa8e/0x14e0 [ 449.764756][ T5610] ? __pfx_process_scheduled_works+0x10/0x10 [ 449.764782][ T5610] ? assign_work+0x3cf/0x5d0 [ 449.764807][ T5610] worker_thread+0xa47/0xfb0 [ 449.764839][ T5610] ? __kthread_parkme+0x71/0x1f0 [ 449.764890][ T5610] kthread+0x388/0x470 [ 449.764915][ T5610] ? __pfx_worker_thread+0x10/0x10 [ 449.764935][ T5610] ? __pfx_kthread+0x10/0x10 [ 449.764961][ T5610] ret_from_fork+0x514/0xb70 [ 449.765046][ T5610] ? __pfx_ret_from_fork+0x10/0x10 [ 449.765073][ T5610] ? __switch_to+0xc89/0x1420 [ 449.765135][ T5610] ? __pfx_kthread+0x10/0x10 [ 449.765162][ T5610] ret_from_fork_asm+0x1a/0x30 [ 449.765193][ T5610] [ 449.765322][ T5610] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 449.765363][ T5610] Bluetooth: hci1: failed to register connection device [ 450.299482][ T9952] binder: 9950:9952 ioctl c0306201 200000000080 returned -14 [ 450.331030][ T9953] netlink: 'syz.1.1348': attribute type 10 has an invalid length. [ 450.331045][ T9953] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1348'. [ 450.463243][ T5610] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 450.534409][ T5610] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 450.556592][ T5610] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 450.563315][ T5610] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 450.564391][ T5610] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 451.491366][ T9979] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 451.928410][ T37] audit: type=1326 audit(1783405249.008:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9982 comm="syz.2.1357" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x0 [ 452.676418][ T4909] Bluetooth: hci5: command tx timeout [ 453.077348][ T4909] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 453.077379][ T4909] CPU: 0 UID: 0 PID: 4909 Comm: kworker/u9:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 453.077413][ T4909] Tainted: [L]=SOFTLOCKUP [ 453.077422][ T4909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 453.077441][ T4909] Workqueue: hci2 hci_rx_work [ 453.077478][ T4909] Call Trace: [ 453.077487][ T4909] [ 453.077497][ T4909] dump_stack_lvl+0xe8/0x150 [ 453.077539][ T4909] sysfs_create_dir_ns+0x271/0x2a0 [ 453.077578][ T4909] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 453.077619][ T4909] ? rt_spin_unlock+0x163/0x200 [ 453.077658][ T4909] kobject_add_internal+0x62c/0xce0 [ 453.077705][ T4909] kobject_add+0x163/0x240 [ 453.077726][ T4909] ? rt_spin_unlock+0x157/0x200 [ 453.077757][ T4909] ? __pfx_kobject_add+0x10/0x10 [ 453.077786][ T4909] ? get_device_parent+0x370/0x3a0 [ 453.077816][ T4909] device_add+0x3fa/0xb80 [ 453.077844][ T4909] hci_conn_add_sysfs+0xd5/0x210 [ 453.077877][ T4909] le_conn_complete_evt+0xfef/0x1580 [ 453.077913][ T4909] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 453.077938][ T4909] ? lockdep_hardirqs_on+0x7a/0x110 [ 453.077968][ T4909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 453.077999][ T4909] ? rt_mutex_slowunlock+0x219/0x460 [ 453.078023][ T4909] ? skb_pull_data+0xf0/0x200 [ 453.078054][ T4909] hci_le_conn_complete_evt+0x187/0x470 [ 453.078100][ T4909] hci_event_packet+0x67a/0xf10 [ 453.078137][ T4909] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 453.078170][ T4909] ? __pfx_hci_event_packet+0x10/0x10 [ 453.078200][ T4909] ? rt_spin_unlock+0x157/0x200 [ 453.078233][ T4909] ? hci_send_to_monitor+0xe2/0x590 [ 453.078261][ T4909] hci_rx_work+0x3ee/0x1020 [ 453.078301][ T4909] ? process_scheduled_works+0xa20/0x14e0 [ 453.078326][ T4909] process_scheduled_works+0xa8e/0x14e0 [ 453.078383][ T4909] ? __pfx_process_scheduled_works+0x10/0x10 [ 453.078418][ T4909] ? assign_work+0x3cf/0x5d0 [ 453.078449][ T4909] worker_thread+0xa47/0xfb0 [ 453.078493][ T4909] ? __kthread_parkme+0x71/0x1f0 [ 453.078532][ T4909] kthread+0x388/0x470 [ 453.078565][ T4909] ? __pfx_worker_thread+0x10/0x10 [ 453.078608][ T4909] ? __pfx_kthread+0x10/0x10 [ 453.078652][ T4909] ret_from_fork+0x514/0xb70 [ 453.078690][ T4909] ? __pfx_ret_from_fork+0x10/0x10 [ 453.078724][ T4909] ? __switch_to+0xc89/0x1420 [ 453.078757][ T4909] ? __pfx_kthread+0x10/0x10 [ 453.078791][ T4909] ret_from_fork_asm+0x1a/0x30 [ 453.078833][ T4909] [ 453.079687][ T4909] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 453.079732][ T4909] Bluetooth: hci2: failed to register connection device [ 453.540456][T10011] binder: 10008:10011 ioctl c0306201 200000000080 returned -14 [ 455.234172][ T5610] Bluetooth: hci5: command tx timeout [ 457.169168][ T36] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 457.336443][ T36] usb 4-1: Using ep0 maxpacket: 8 [ 457.369035][ T36] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 457.369073][ T36] usb 4-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 457.369103][ T36] usb 4-1: config 0 interface 0 has no altsetting 0 [ 457.369140][ T36] usb 4-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00 [ 457.369164][ T36] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.396385][ T5610] Bluetooth: hci5: command tx timeout [ 457.449132][ T36] usb 4-1: config 0 descriptor?? [ 457.899233][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899271][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899298][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899324][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899350][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899376][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899402][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899428][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899454][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 457.899481][ T36] kye 0003:0458:4018.0012: unknown main item tag 0x0 [ 458.011873][ T36] kye 0003:0458:4018.0012: hidraw0: USB HID v0.04 Device [HID 0458:4018] on usb-dummy_hcd.3-1/input0 [ 458.167182][ T5608] usb 4-1: USB disconnect, device number 10 [ 458.248030][T10064] fido_id[10064]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 458.342081][T10068] netlink: 'syz.1.1382': attribute type 10 has an invalid length. [ 458.342097][T10068] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1382'. [ 459.545248][ T5610] Bluetooth: hci5: command tx timeout [ 460.385546][T10101] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1389'. [ 460.519950][ T9951] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.520130][ T9951] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.520288][ T9951] bridge_slave_0: entered allmulticast mode [ 460.522324][ T9951] bridge_slave_0: entered promiscuous mode [ 460.526020][ T9951] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.526174][ T9951] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.567934][ T9951] bridge_slave_1: entered allmulticast mode [ 460.572522][ T9951] bridge_slave_1: entered promiscuous mode [ 460.623173][ T9951] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.636844][ T9951] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.744368][ T9951] team0: Port device team_slave_0 added [ 460.929854][ T9951] team0: Port device team_slave_1 added [ 461.175290][ T37] audit: type=1800 audit(1783405258.248:391): pid=10092 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.0.1387" name="/" dev="fuse" ino=1 res=0 errno=0 [ 461.500123][ T9951] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.500141][ T9951] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.500171][ T9951] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.559847][ T9951] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.559864][ T9951] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.559896][ T9951] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 461.715396][T10120] input: syz0 as /devices/virtual/input/input8 [ 462.185816][ T9951] hsr_slave_0: entered promiscuous mode [ 462.194052][ T9951] hsr_slave_1: entered promiscuous mode [ 462.195096][ T9951] debugfs: 'hsr0' already exists in 'hsr' [ 462.195120][ T9951] Cannot create hsr debugfs directory [ 462.319138][ T6455] bridge_slave_1: left allmulticast mode [ 462.319181][ T6455] bridge_slave_1: left promiscuous mode [ 462.319438][ T6455] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.382525][ T6455] bridge_slave_0: left allmulticast mode [ 463.382549][ T6455] bridge_slave_0: left promiscuous mode [ 463.382709][ T6455] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.528904][T10147] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1403'. [ 463.581156][T10148] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1404'. [ 464.327006][ T6455] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 464.387216][ T6455] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 464.408648][ T6455] bond0 (unregistering): Released all slaves [ 466.158670][T10165] input: syz0 as /devices/virtual/input/input9 [ 466.709270][ T6455] hsr_slave_0: left promiscuous mode [ 466.748285][ T6455] hsr_slave_1: left promiscuous mode [ 466.750979][ T6455] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.803124][ T6455] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 467.395276][T10202] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1417'. [ 469.487335][ T6455] team0 (unregistering): Port device team_slave_1 removed [ 469.627119][ T6455] team0 (unregistering): Port device team_slave_0 removed [ 469.735146][T10224] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1423'. [ 470.156839][T10228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1424'. [ 470.187269][ T5255] 8021q: adding VLAN 0 to HW filter on device eth1 [ 470.434102][T10234] input: syz0 as /devices/virtual/input/input10 [ 473.087823][T10270] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1436'. [ 473.512748][ T37] audit: type=1326 audit(1783405270.588:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10276 comm="syz.2.1438" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f846e6dde59 code=0x0 [ 473.715514][ T5255] 8021q: adding VLAN 0 to HW filter on device eth2 [ 475.300994][T10308] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 475.660819][T10322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1449'. [ 477.563586][T10344] input: syz0 as /devices/virtual/input/input11 [ 478.777897][T10377] 9p: Bad value for 'rfdno' [ 479.322155][ T9951] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 479.388823][T10386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1461'. [ 479.517447][ T9951] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 479.535455][ T9951] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 479.631667][ T9951] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 479.643658][ T9951] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 479.736027][ T9951] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 479.745063][ T9951] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 479.930699][ T9951] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 480.111063][T10414] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1468'. [ 480.532950][ T9951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.777361][ T9951] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.825036][ T1045] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.825235][ T1045] bridge0: port 1(bridge_slave_0) entered forwarding state [ 480.947639][ T1045] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.949281][ T1045] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.372395][T10435] input: syz0 as /devices/virtual/input/input12 [ 481.713422][T10445] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1476'. [ 482.009417][T10452] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1478'. [ 482.009473][T10452] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 482.068005][T10458] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1479'. [ 482.299103][ T6450] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 482.516780][ T6450] usb 1-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 482.516819][ T6450] usb 1-1: config 0 interface 0 has no altsetting 0 [ 482.527974][ T6450] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 482.528080][ T6450] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 482.528146][ T6450] usb 1-1: Product: syz [ 482.528188][ T6450] usb 1-1: Manufacturer: syz [ 482.528222][ T6450] usb 1-1: SerialNumber: syz [ 482.657433][ T6450] usb 1-1: config 0 descriptor?? [ 482.665457][T10452] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 482.713220][ T6450] usb 1-1: selecting invalid altsetting 0 [ 483.267490][ T6450] usb 1-1: USB disconnect, device number 21 [ 484.311695][ T9951] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 485.674756][T10521] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1493'. [ 485.843345][T10530] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1497'. [ 485.843402][T10530] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 486.163582][ T5700] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 486.255067][ T9951] veth0_vlan: entered promiscuous mode [ 486.274931][ T9951] veth1_vlan: entered promiscuous mode [ 486.349262][ T9951] veth0_macvtap: entered promiscuous mode [ 486.364109][ T9951] veth1_macvtap: entered promiscuous mode [ 486.393062][ T9951] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 486.420713][ T9951] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 486.461776][ T1045] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.469248][ T1045] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.470869][ T1045] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.471924][ T1045] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.714503][ T5700] usb 1-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 486.714540][ T5700] usb 1-1: config 0 interface 0 has no altsetting 0 [ 486.740700][ T5700] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 486.740730][ T5700] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 486.740750][ T5700] usb 1-1: Product: syz [ 486.740764][ T5700] usb 1-1: Manufacturer: syz [ 486.740795][ T5700] usb 1-1: SerialNumber: syz [ 486.970200][ T5700] usb 1-1: config 0 descriptor?? [ 486.971191][T10530] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 487.089326][ T5700] usb 1-1: selecting invalid altsetting 0 [ 488.877834][ T1311] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 488.877855][ T1311] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 489.115520][ T5815] usb 1-1: USB disconnect, device number 22 [ 489.253287][ T9368] udevd[9368]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 489.445513][ T1045] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 489.445584][ T1045] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.302364][T10554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 491.058467][T10565] bridge0: port 3(batadv1) entered blocking state [ 491.058720][T10565] bridge0: port 3(batadv1) entered disabled state [ 491.058909][T10565] batadv1: entered allmulticast mode [ 491.061843][T10565] batadv1: entered promiscuous mode [ 492.713149][ T5904] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 492.713172][ T5904] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 492.881525][T10570] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 493.690068][ T6450] Process accounting resumed [ 496.719188][ T5714] Process accounting resumed [ 500.431898][ T5815] Process accounting resumed [ 500.595574][T10686] netlink: 'syz.1.1548': attribute type 10 has an invalid length. [ 500.595597][T10686] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1548'. [ 501.671362][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.671437][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.689145][T10699] fuse: Bad value for 'rootmode' [ 502.115691][T10712] input: syz0 as /devices/virtual/input/input13 [ 502.678622][ T5747] Process accounting resumed [ 503.663168][T10739] netlink: 'syz.0.1562': attribute type 10 has an invalid length. [ 503.663185][T10739] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1562'. [ 503.664208][T10739] bridge0: port 3(dummy0) entered blocking state [ 503.664429][T10739] bridge0: port 3(dummy0) entered disabled state [ 503.664624][T10739] dummy0: entered allmulticast mode [ 503.692725][T10739] dummy0: entered promiscuous mode [ 503.701914][T10739] bridge0: port 3(dummy0) entered blocking state [ 503.741123][T10739] bridge0: port 3(dummy0) entered forwarding state [ 504.011685][T10745] fuse: Unknown parameter 'grou00000000000000000000' [ 506.095470][ T5608] Process accounting resumed [ 506.865714][T10784] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 509.629971][T10833] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 509.629971][T10833] program syz.4.1589 not setting count and/or reply_len properly [ 510.033562][T10839] fuse: fd is not a fuse device [ 510.604002][T10853] fuse: Unknown parameter 'group_i00000000000000000000' [ 510.949737][T10862] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 510.949765][T10862] overlayfs: missing 'lowerdir' [ 511.263833][T10870] fuse: fd is not a fuse device [ 511.356360][ T5608] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 511.774277][T10884] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1609'. [ 511.774320][T10884] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 512.096395][ T5700] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 512.161826][T10894] netlink: 'syz.1.1614': attribute type 10 has an invalid length. [ 512.161850][T10894] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1614'. [ 512.270168][ T5700] usb 5-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 512.270203][ T5700] usb 5-1: config 0 interface 0 has no altsetting 0 [ 512.278857][ T5700] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 512.278887][ T5700] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 512.278909][ T5700] usb 5-1: Product: syz [ 512.278924][ T5700] usb 5-1: Manufacturer: syz [ 512.278940][ T5700] usb 5-1: SerialNumber: syz [ 512.306200][ T5700] usb 5-1: config 0 descriptor?? [ 512.309377][T10884] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 512.428510][ T5700] usb 5-1: selecting invalid altsetting 0 [ 512.775605][ T5700] usb 5-1: USB disconnect, device number 6 [ 512.897657][ T9368] udevd[9368]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 514.231182][T10933] netlink: 'syz.1.1626': attribute type 10 has an invalid length. [ 514.231203][T10933] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1626'. [ 514.265319][T10937] fuse: Unknown parameter 'group_id00000000000000000000' [ 514.812875][T10943] fuse: fd is not a fuse device [ 515.755414][T10955] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1634'. [ 516.544450][T10973] fuse: fd is not a fuse device [ 519.286761][T11017] fuse: Unknown parameter 'group_id00000000000000000000' [ 520.488848][T11042] fuse: fd is not a fuse device [ 521.349328][T11048] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1667'. [ 521.398394][T11050] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1668'. [ 521.398420][T11050] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1668'. [ 521.806795][ T6450] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 521.932374][T11069] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 521.978724][ T6450] usb 1-1: config 128 has an invalid interface number: 148 but max is 0 [ 521.978754][ T6450] usb 1-1: config 128 has no interface number 0 [ 521.978798][ T6450] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 521.978823][ T6450] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 521.978849][ T6450] usb 1-1: config 128 interface 148 altsetting 9 endpoint 0x5 has invalid wMaxPacketSize 0 [ 521.978871][ T6450] usb 1-1: config 128 interface 148 has no altsetting 0 [ 521.984559][ T6450] usb 1-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 521.984590][ T6450] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.984613][ T6450] usb 1-1: Product: syz [ 521.984629][ T6450] usb 1-1: Manufacturer: syz [ 521.984645][ T6450] usb 1-1: SerialNumber: syz [ 522.186112][T11076] fuse: Bad value for 'user_id' [ 522.186127][T11076] fuse: Bad value for 'user_id' [ 522.388465][ T6450] usb 1-1: USB disconnect, device number 24 [ 523.877847][ T6450] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 523.906080][T11094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1685'. [ 524.026346][ T6450] usb 1-1: Using ep0 maxpacket: 8 [ 524.029359][ T6450] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 524.029429][ T6450] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 524.029456][ T6450] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 524.029484][ T6450] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 524.029508][ T6450] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 524.029532][ T6450] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 524.029575][ T6450] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 524.029599][ T6450] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.142162][ T6450] usbtmc 1-1:16.0: probe with driver usbtmc failed with error -22 [ 524.317951][T11106] fuse: Bad value for 'user_id' [ 524.317971][T11106] fuse: Bad value for 'user_id' [ 524.349554][T11107] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 524.563685][T11109] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1692'. [ 524.569661][T11109] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1692'. [ 526.213923][ T5714] usb 1-1: USB disconnect, device number 25 [ 526.804913][T11130] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 526.804913][T11130] program syz.4.1695 not setting count and/or reply_len properly [ 526.837278][ T6450] libceph: connect (1)[c::]:6789 error -101 [ 526.837493][ T6450] libceph: mon0 (1)[c::]:6789 connect error [ 527.096828][ T6450] libceph: connect (1)[c::]:6789 error -101 [ 527.124246][ T6450] libceph: mon0 (1)[c::]:6789 connect error [ 527.544119][T11127] ceph: No mds server is up or the cluster is laggy [ 527.661213][T11144] fuse: Bad value for 'fd' [ 527.778255][T11148] input: syz0 as /devices/virtual/input/input14 [ 527.808236][T11150] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 528.682976][T11170] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1708'. [ 529.901523][T11184] fuse: Bad value for 'fd' [ 531.155126][T11196] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 532.094952][T11213] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 532.095103][T11213] overlayfs: missing 'lowerdir' [ 533.889387][T11232] fuse: Unknown parameter 'fd0x0000000000000006' [ 534.360736][T11248] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1740'. [ 534.417720][T11248] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1740'. [ 535.817189][T11270] fuse: Unknown parameter 'fd0x0000000000000005' [ 536.236705][T11281] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1754'. [ 536.299861][T11286] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1754'. [ 540.754237][T11360] input: syz0 as /devices/virtual/input/input15 [ 543.315677][T11393] input: syz0 as /devices/virtual/input/input16 [ 545.759504][T11425] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1809'. [ 545.844818][T11426] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1809'. [ 548.811079][T11460] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1822'. [ 548.863368][T11462] fuse: fd is not a fuse device [ 548.876770][T11463] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1822'. [ 549.135427][T11470] input: syz0 as /devices/virtual/input/input17 [ 549.388967][T11475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1827'. [ 549.389024][T11475] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 549.686315][ T5714] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 549.848936][ T5714] usb 5-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 549.848972][ T5714] usb 5-1: config 0 interface 0 has no altsetting 0 [ 549.852073][ T5714] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 549.852104][ T5714] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 549.852128][ T5714] usb 5-1: Product: syz [ 549.852143][ T5714] usb 5-1: Manufacturer: syz [ 549.852159][ T5714] usb 5-1: SerialNumber: syz [ 549.925430][ T5714] usb 5-1: config 0 descriptor?? [ 549.937414][T11475] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 549.998251][ T5714] usb 5-1: selecting invalid altsetting 0 [ 550.318634][ T5714] usb 5-1: USB disconnect, device number 7 [ 550.468235][ T9368] udevd[9368]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 551.831171][T11501] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1836'. [ 551.855820][T11502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1837'. [ 551.892701][T11504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1836'. [ 552.076118][T11507] Process accounting resumed [ 554.134065][T11543] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1852'. [ 554.192163][T11543] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1852'. [ 554.408508][T11551] Process accounting resumed [ 554.582397][T11555] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 554.582610][T11555] overlayfs: missing 'lowerdir' [ 556.766390][ T5608] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 556.879482][T11576] fuse: Unknown parameter 'fd0x0000000000000004' [ 556.916414][ T5608] usb 5-1: Using ep0 maxpacket: 8 [ 556.919003][ T5608] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 556.919031][ T5608] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 556.919053][ T5608] usb 5-1: config 0 has no interface number 0 [ 556.922828][ T5608] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 556.922858][ T5608] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.922880][ T5608] usb 5-1: Product: syz [ 556.922895][ T5608] usb 5-1: Manufacturer: syz [ 556.922910][ T5608] usb 5-1: SerialNumber: syz [ 556.965530][ T5608] usb 5-1: config 0 descriptor?? [ 557.014020][T11578] netlink: 'syz.2.1865': attribute type 10 has an invalid length. [ 557.014041][T11578] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1865'. [ 557.043441][ T5608] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 557.043547][ T5608] uvcvideo 5-1:0.31: No valid video chain found. [ 557.085930][T11580] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1866'. [ 557.191323][T11583] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1866'. [ 557.295173][ T36] usb 5-1: USB disconnect, device number 8 [ 559.233271][T11615] fuse: Unknown parameter 'fd0x0000000000000004' [ 559.424795][T11621] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1881'. [ 559.437871][T11622] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1880'. [ 559.543731][T11627] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1880'. [ 563.659057][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.661667][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.836464][T11656] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1894'. [ 563.903930][T11659] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1894'. [ 564.444010][ T5610] Bluetooth: hci3: unexpected event for opcode 0x0c25 [ 566.190027][ T5610] Bluetooth: hci3: unexpected event for opcode 0x0c25 [ 566.585625][T11721] netlink: 'syz.4.1919': attribute type 11 has an invalid length. [ 567.637576][T11743] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 567.637599][T11743] overlayfs: missing 'lowerdir' [ 567.673663][T11739] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 568.089413][T11751] netlink: 80 bytes leftover after parsing attributes in process `syz.4.1931'. [ 568.376534][T11759] netlink: 'syz.4.1934': attribute type 11 has an invalid length. [ 569.609577][T11778] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 569.609996][T11778] overlayfs: missing 'lowerdir' [ 570.443248][T11781] fuse: fd is not a fuse device [ 570.901747][T11796] netlink: 80 bytes leftover after parsing attributes in process `syz.2.1949'. [ 571.222387][T11799] netlink: 'syz.3.1950': attribute type 11 has an invalid length. [ 571.993575][T11796] netlink: 'syz.2.1949': attribute type 4 has an invalid length. [ 573.146417][ T5610] Bluetooth: hci1: unexpected event for opcode 0x0c25 [ 573.362714][T11819] fuse: fd is not a fuse device [ 574.368079][T11824] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 574.623449][T11839] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 574.623761][T11839] overlayfs: missing 'lowerdir' [ 574.781272][T11837] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1964'. [ 575.316394][ T4909] Bluetooth: hci5: command 0x0406 tx timeout [ 575.974472][T11853] fuse: Bad value for 'fd' [ 576.104704][T11849] kAFS: unable to lookup cell 'syz1' [ 576.276424][ T6450] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 576.367185][T11868] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 576.367208][T11868] overlayfs: missing 'lowerdir' [ 576.421603][ T6450] usb 3-1: device descriptor read/64, error -71 [ 577.128129][ T6450] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 577.162391][T11869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 577.327228][ T6450] usb 3-1: device descriptor read/64, error -71 [ 577.453804][ T6450] usb usb3-port1: attempt power cycle [ 577.833724][T11874] fuse: fd is not a fuse device [ 577.898474][T11874] tipc: Started in network mode [ 577.898510][T11874] tipc: Node identity ac14142f, cluster identity 4711 [ 577.970126][T11874] tipc: Enabled bearer , priority 10 [ 578.003580][T11881] fuse: fd is not a fuse device [ 578.026629][ T6450] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 578.047217][ T6450] usb 3-1: device descriptor read/8, error -71 [ 578.174519][T11887] fuse: Bad value for 'fd' [ 578.286382][ T6450] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 578.309305][ T6450] usb 3-1: device descriptor read/8, error -71 [ 578.360123][T11896] kAFS: unable to lookup cell 'syz1' [ 578.416775][ T6450] usb usb3-port1: unable to enumerate USB device [ 579.082361][ T36] tipc: Node number set to 2886997039 [ 579.437459][T11902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 580.312099][T11917] fuse: Bad value for 'fd' [ 580.429912][T11924] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1998'. [ 580.552476][T11926] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2000'. [ 581.545879][T11932] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 582.132198][ T5610] Bluetooth: hci2: unexpected event for opcode 0x0c25 [ 582.444473][T11956] fuse: Unknown parameter '0x0000000000000003' [ 582.745233][T11964] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2014'. [ 582.869489][T11970] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2015'. [ 582.893556][T11972] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2018'. [ 584.199877][T11989] fuse: Unknown parameter '0x0000000000000003' [ 584.410547][T12000] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2028'. [ 584.495713][T12005] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2029'. [ 584.526368][ T5608] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 584.547244][T12008] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2031'. [ 584.666375][ T5608] usb 5-1: device descriptor read/64, error -71 [ 584.946495][ T5608] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 585.404688][T12023] fuse: Unknown parameter '0x0000000000000003' [ 585.526852][ T5608] usb 5-1: device descriptor read/64, error -71 [ 585.741386][ T5608] usb usb5-port1: attempt power cycle [ 586.666417][ T5608] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 586.688148][ T5608] usb 5-1: device descriptor read/8, error -71 [ 586.767613][T12042] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2043'. [ 586.926593][ T5608] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 586.947237][ T5608] usb 5-1: device descriptor read/8, error -71 [ 587.056759][ T5608] usb usb5-port1: unable to enumerate USB device [ 587.098938][T12053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2046'. [ 589.769026][T12071] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2054'. [ 591.678001][ T5608] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 592.797236][ T5608] usb 3-1: device descriptor read/64, error -71 [ 593.089957][T12100] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2064'. [ 593.136302][ T5608] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 593.286325][ T5608] usb 3-1: device descriptor read/64, error -71 [ 593.316355][ T5714] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 593.396737][ T5608] usb usb3-port1: attempt power cycle [ 593.456813][T12105] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2066'. [ 593.479178][ T5714] usb 4-1: config 128 has an invalid interface number: 148 but max is 0 [ 593.479207][ T5714] usb 4-1: config 128 has no interface number 0 [ 593.479246][ T5714] usb 4-1: config 128 interface 148 altsetting 9 endpoint 0x7 has invalid wMaxPacketSize 0 [ 593.479266][ T5714] usb 4-1: config 128 interface 148 altsetting 9 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 593.479288][ T5714] usb 4-1: config 128 interface 148 has no altsetting 0 [ 593.544906][ T5714] usb 4-1: New USB device found, idVendor=0cf3, idProduct=e019, bcdDevice=fb.4f [ 593.544937][ T5714] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.544959][ T5714] usb 4-1: Product: syz [ 593.544973][ T5714] usb 4-1: Manufacturer: syz [ 593.544989][ T5714] usb 4-1: SerialNumber: syz [ 593.775846][T12108] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2068'. [ 593.807283][ T5608] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 593.828390][ T5608] usb 3-1: device descriptor read/8, error -71 [ 593.873677][ T5714] usb 4-1: USB disconnect, device number 11 [ 594.906551][ T5714] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 595.056348][ T5714] usb 4-1: Using ep0 maxpacket: 8 [ 595.058788][ T5714] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 595.058845][ T5714] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 595.058871][ T5714] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 595.058897][ T5714] usb 4-1: config 16 interface 0 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 595.058922][ T5714] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 595.058967][ T5714] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 595.058991][ T5714] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.148724][ T5714] usbtmc 4-1:16.0: bulk endpoints not found [ 595.425947][T12133] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2077'. [ 595.943253][T12156] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2088'. [ 596.033499][T12160] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2090'. [ 596.416106][ T5608] usb 4-1: USB disconnect, device number 12 [ 596.749760][T12189] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2100'. [ 597.284334][T12201] fuse: fd is not a fuse device [ 597.855582][T12218] fuse: Unknown parameter 'fd0x0000000000000003' [ 600.390225][T12278] atomic_op ffff88804b672218 conn xmit_atomic 0000000000000000 [ 601.989039][T12300] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2147'. [ 603.745057][T12342] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2166'. [ 603.745081][T12342] netlink: 368 bytes leftover after parsing attributes in process `syz.0.2166'. [ 604.016877][T12350] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 604.055354][T12349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2170'. [ 605.290075][T12370] 9p: Bad value for 'rfdno' [ 606.699770][T12393] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 607.055464][T12410] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 607.554768][T12417] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 607.554768][T12417] program syz.2.2189 not setting count and/or reply_len properly [ 607.971089][ T4909] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 608.009252][ T4909] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 608.028895][ T4909] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 608.033190][ T4909] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 608.034557][ T4909] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 608.221245][T12425] fuse: fd is not a fuse device [ 608.606735][T12431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2202'. [ 608.780619][ T5714] Process accounting resumed [ 609.078314][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 610.060717][T12452] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 610.116376][ T4909] Bluetooth: hci4: command tx timeout [ 610.116518][T12462] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 610.731837][ T56] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 610.731866][ T56] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.199413][ T4909] Bluetooth: hci4: command tx timeout [ 612.903661][ T5700] Process accounting resumed [ 614.308821][ T4909] Bluetooth: hci4: command tx timeout [ 614.473332][ T56] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 614.473371][ T56] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.093575][T12517] sg_write: data in/out 28/14 bytes for SCSI command 0x0-- guessing data in; [ 615.093575][T12517] program syz.2.2221 not setting count and/or reply_len properly [ 615.171293][ T56] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 615.171333][ T56] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 615.758331][ T36] Process accounting resumed [ 616.356283][ T4909] Bluetooth: hci4: command tx timeout [ 616.450135][T12543] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 616.690164][T12546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2233'. [ 616.690199][T12546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2233'. [ 617.755471][ T56] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 617.755511][ T56] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.040127][T12422] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.044995][T12422] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.045208][T12422] bridge_slave_0: entered allmulticast mode [ 619.069821][T12422] bridge_slave_0: entered promiscuous mode [ 619.088961][T12422] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.089185][T12422] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.089392][T12422] bridge_slave_1: entered allmulticast mode [ 619.095679][T12422] bridge_slave_1: entered promiscuous mode [ 619.272847][T12422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 619.294543][T12422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 620.172067][ T36] Process accounting resumed [ 621.114318][T12422] team0: Port device team_slave_0 added [ 621.233779][T12422] team0: Port device team_slave_1 added [ 621.517328][T12422] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 621.517345][T12422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 621.517374][T12422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 622.542952][ T56] dummy0: left allmulticast mode [ 622.572235][ T56] dummy0: left promiscuous mode [ 622.572656][ T56] bridge0: port 3(dummy0) entered disabled state [ 622.729121][ T56] bridge_slave_1: left allmulticast mode [ 622.729156][ T56] bridge_slave_1: left promiscuous mode [ 622.729532][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.128100][ T56] bridge_slave_0: left allmulticast mode [ 623.130157][ T56] bridge_slave_0: left promiscuous mode [ 623.130399][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 623.273479][ T36] Process accounting resumed [ 624.165773][T12624] 9pnet: p9_errstr2errno: server reported unknown error ./file0/../ [ 624.445394][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.445473][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.541467][T12631] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2259'. [ 625.742815][T12639] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2261'. [ 625.742875][T12639] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 625.817027][ T56] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 625.877439][ T56] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 625.918710][ T56] bond0 (unregistering): Released all slaves [ 625.937707][T12422] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 625.937719][T12422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 625.937741][T12422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 625.997949][ T36] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 626.170871][ T36] usb 3-1: config 0 interface 0 altsetting 251 bulk endpoint 0x9 has invalid maxpacket 99 [ 626.170917][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 626.173244][ T36] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 626.173274][ T36] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 626.173296][ T36] usb 3-1: Product: syz [ 626.173311][ T36] usb 3-1: Manufacturer: syz [ 626.173326][ T36] usb 3-1: SerialNumber: syz [ 626.231637][ T36] usb 3-1: config 0 descriptor?? [ 626.234424][T12639] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 626.278129][ T36] usb 3-1: selecting invalid altsetting 0 [ 626.315289][T12422] hsr_slave_0: entered promiscuous mode [ 626.325710][T12422] hsr_slave_1: entered promiscuous mode [ 626.332642][T12422] debugfs: 'hsr0' already exists in 'hsr' [ 626.332669][T12422] Cannot create hsr debugfs directory [ 626.531861][T12639] snd-usb-audio 3-1:0.0: Runtime PM usage count underflow! [ 626.567351][ T5700] usb 3-1: USB disconnect, device number 28 [ 627.259537][ T5714] Process accounting resumed [ 630.567052][T12686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 630.793559][ T5255] 8021q: adding VLAN 0 to HW filter on device eth2 [ 631.153888][T12714] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2282'. [ 633.606076][T12746] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 635.416837][T12778] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2302'. [ 635.444285][ T5255] 8021q: adding VLAN 0 to HW filter on device eth1 [ 635.713469][ T56] hsr_slave_0: left promiscuous mode [ 635.767151][ T56] hsr_slave_1: left promiscuous mode [ 635.769770][ T56] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 635.769864][ T56] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 635.829803][ T56] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 635.829833][ T56] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 636.705792][ T56] veth1_macvtap: left promiscuous mode [ 636.705904][ T56] veth0_macvtap: left promiscuous mode [ 636.729177][ T56] veth1_vlan: left promiscuous mode [ 636.729331][ T56] veth0_vlan: left promiscuous mode [ 636.804284][T12796] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.048369][ T821] IPVS: starting estimator thread 0... [ 638.136708][T12837] IPVS: using max 8 ests per chain, 19200 per kthread [ 638.868255][ T56] team0 (unregistering): Port device team_slave_1 removed [ 638.938610][ T56] team0 (unregistering): Port device team_slave_0 removed [ 640.108582][T12900] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2357'. [ 640.306870][T12817] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 642.234552][T12949] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2374'. [ 642.642700][T12955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2376'. [ 643.188366][T12422] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 643.250581][T12422] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 643.251908][T12422] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 643.410829][T12422] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 643.427192][T12422] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 643.510237][T12422] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 643.568660][T12422] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 643.594535][T12981] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2385'. [ 643.735533][T12422] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 644.375769][T12422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 644.547761][T12422] 8021q: adding VLAN 0 to HW filter on device team0 [ 644.579323][T12666] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.583993][T12666] bridge0: port 1(bridge_slave_0) entered forwarding state [ 644.669936][ T6455] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.670073][ T6455] bridge0: port 2(bridge_slave_1) entered forwarding state [ 645.431568][T13014] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2392'. [ 645.431591][T13014] netlink: 368 bytes leftover after parsing attributes in process `syz.3.2392'. [ 645.464268][T13014] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2392'. [ 646.061591][T13042] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2402'. [ 646.795183][T12422] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 647.127195][T12422] veth0_vlan: entered promiscuous mode [ 647.241698][T12422] veth1_vlan: entered promiscuous mode [ 647.286401][T12422] veth0_macvtap: entered promiscuous mode [ 647.292249][T12422] veth1_macvtap: entered promiscuous mode [ 647.329980][T12422] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 647.335152][T12422] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 647.796398][ T66] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.993676][ T154] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 648.070364][ T154] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 648.434972][ T154] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 649.621212][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 649.621234][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 649.775729][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 649.775752][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 650.540921][T13124] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 650.540952][T13124] overlayfs: missing 'lowerdir' [ 652.822202][T13175] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2453'. [ 652.822225][T13175] netlink: 368 bytes leftover after parsing attributes in process `syz.0.2453'. [ 652.822247][T13175] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2453'. [ 653.988389][T13200] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2464'. [ 653.988451][T13200] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2464'. [ 653.988555][T13200] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2464'. [ 655.655290][T13239] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2482'. [ 655.655321][T13239] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2482'. [ 655.655400][T13239] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2482'. [ 656.445237][T13262] netlink: 'syz.3.2492': attribute type 1 has an invalid length. [ 656.476353][ T5608] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 656.593724][T13267] netlink: 'syz.3.2492': attribute type 10 has an invalid length. [ 656.593745][T13267] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2492'. [ 656.593968][T13262] 8021q: adding VLAN 0 to HW filter on device bond1 [ 656.656459][ T5608] usb 2-1: Using ep0 maxpacket: 8 [ 656.660297][ T5608] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 656.660328][ T5608] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 656.660350][ T5608] usb 2-1: config 0 has no interface number 0 [ 656.663347][ T5608] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 656.663377][ T5608] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.663398][ T5608] usb 2-1: Product: syz [ 656.663413][ T5608] usb 2-1: Manufacturer: syz [ 656.663429][ T5608] usb 2-1: SerialNumber: syz [ 656.771299][ T5608] usb 2-1: config 0 descriptor?? [ 656.824338][ T5608] uvcvideo 2-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 656.824376][ T5608] uvcvideo 2-1:0.31: No valid video chain found. [ 656.879218][ T990] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 656.968145][T13264] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 657.026377][ T36] usb 2-1: USB disconnect, device number 8 [ 657.032799][T13267] dummy0: entered promiscuous mode [ 657.089854][T13267] bond1: (slave dummy0): Removing an active aggregator [ 657.100565][ T5904] bond1: (slave dummy0): link status up again after 0 ms [ 657.140756][ T5904] bond1: Warning: Found an uninitialized port [ 657.140836][ T5904] bond1: (slave dummy0): link status up again after 0 ms [ 657.141686][T13267] bond1: (slave dummy0): Releasing backup interface [ 657.306661][ T36] ================================================================== [ 657.306750][ T36] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 657.306876][ T36] Read of size 8 at addr ffffc90007003008 by task kworker/1:1/36 [ 657.306894][ T36] [ 657.306960][ T36] CPU: 1 UID: 0 PID: 36 Comm: kworker/1:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 657.306999][ T36] Tainted: [L]=SOFTLOCKUP [ 657.307007][ T36] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 657.307025][ T36] Workqueue: usb_hub_wq hub_event [ 657.307111][ T36] Call Trace: [ 657.307120][ T36] [ 657.307131][ T36] dump_stack_lvl+0xe8/0x150 [ 657.307169][ T36] print_address_description+0x55/0x1e0 [ 657.307215][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.307248][ T36] print_report+0x58/0x70 [ 657.307279][ T36] kasan_report+0x117/0x150 [ 657.307346][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.307384][ T36] __list_add_valid_or_report+0x4e/0x130 [ 657.307419][ T36] kcov_remote_stop+0x457/0x680 [ 657.307531][ T36] hub_event+0x4789/0x4cf0 [ 657.307569][ T36] ? __lock_acquire+0x683/0x2ce0 [ 657.307630][ T36] ? register_lock_class+0x31/0x2e0 [ 657.307666][ T36] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 657.307733][ T36] ? __pfx_hub_event+0x10/0x10 [ 657.307765][ T36] ? process_scheduled_works+0xa20/0x14e0 [ 657.307796][ T36] ? rcu_is_watching+0x15/0xb0 [ 657.307853][ T36] ? process_scheduled_works+0xa20/0x14e0 [ 657.307878][ T36] process_scheduled_works+0xa8e/0x14e0 [ 657.307920][ T36] ? __pfx_process_scheduled_works+0x10/0x10 [ 657.307950][ T36] ? assign_work+0x3cf/0x5d0 [ 657.307977][ T36] worker_thread+0xa47/0xfb0 [ 657.308012][ T36] ? __kthread_parkme+0x71/0x1f0 [ 657.308045][ T36] kthread+0x388/0x470 [ 657.308077][ T36] ? __pfx_worker_thread+0x10/0x10 [ 657.308114][ T36] ? __pfx_kthread+0x10/0x10 [ 657.308145][ T36] ret_from_fork+0x514/0xb70 [ 657.308181][ T36] ? __pfx_ret_from_fork+0x10/0x10 [ 657.308213][ T36] ? __switch_to+0xc89/0x1420 [ 657.308242][ T36] ? __pfx_kthread+0x10/0x10 [ 657.308273][ T36] ret_from_fork_asm+0x1a/0x30 [ 657.308304][ T36] [ 657.308312][ T36] [ 657.308317][ T36] The buggy address belongs to a vmalloc virtual mapping [ 657.308384][ T36] Memory state around the buggy address: [ 657.308402][ T36] ffffc90007002f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 657.308433][ T36] ffffc90007002f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 657.308454][ T36] >ffffc90007003000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 657.308465][ T36] ^ [ 657.308508][ T36] ffffc90007003080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 657.308522][ T36] ffffc90007003100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 657.308534][ T36] ================================================================== [ 657.309028][ T36] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 657.309078][ T36] CPU: 1 UID: 0 PID: 36 Comm: kworker/1:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 657.309100][ T36] Tainted: [L]=SOFTLOCKUP [ 657.309106][ T36] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 657.309116][ T36] Workqueue: usb_hub_wq hub_event [ 657.309140][ T36] Call Trace: [ 657.309146][ T36] [ 657.309152][ T36] vpanic+0x56c/0xa60 [ 657.309170][ T36] ? __pfx_vpanic+0x10/0x10 [ 657.309184][ T36] ? __pfx___schedule+0x10/0x10 [ 657.309209][ T36] panic+0xc5/0xd0 [ 657.309222][ T36] ? __pfx_panic+0x10/0x10 [ 657.309236][ T36] ? preempt_schedule_thunk+0x16/0x40 [ 657.309259][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.309283][ T36] check_panic_on_warn+0x89/0xb0 [ 657.309335][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.309358][ T36] end_report+0x73/0x170 [ 657.309374][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.309396][ T36] kasan_report+0x128/0x150 [ 657.309413][ T36] ? __list_add_valid_or_report+0x4e/0x130 [ 657.309439][ T36] __list_add_valid_or_report+0x4e/0x130 [ 657.309469][ T36] kcov_remote_stop+0x457/0x680 [ 657.309494][ T36] hub_event+0x4789/0x4cf0 [ 657.309519][ T36] ? __lock_acquire+0x683/0x2ce0 [ 657.309536][ T36] ? register_lock_class+0x31/0x2e0 [ 657.309560][ T36] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 657.309610][ T36] ? __pfx_hub_event+0x10/0x10 [ 657.309643][ T36] ? process_scheduled_works+0xa20/0x14e0 [ 657.309670][ T36] ? rcu_is_watching+0x15/0xb0 [ 657.309698][ T36] ? process_scheduled_works+0xa20/0x14e0 [ 657.309723][ T36] process_scheduled_works+0xa8e/0x14e0 [ 657.309770][ T36] ? __pfx_process_scheduled_works+0x10/0x10 [ 657.309790][ T36] ? assign_work+0x3cf/0x5d0 [ 657.309809][ T36] worker_thread+0xa47/0xfb0 [ 657.309833][ T36] ? __kthread_parkme+0x71/0x1f0 [ 657.309857][ T36] kthread+0x388/0x470 [ 657.309879][ T36] ? __pfx_worker_thread+0x10/0x10 [ 657.309897][ T36] ? __pfx_kthread+0x10/0x10 [ 657.309919][ T36] ret_from_fork+0x514/0xb70 [ 657.309946][ T36] ? __pfx_ret_from_fork+0x10/0x10 [ 657.309970][ T36] ? __switch_to+0xc89/0x1420 [ 657.309990][ T36] ? __pfx_kthread+0x10/0x10 [ 657.310013][ T36] ret_from_fork_asm+0x1a/0x30 [ 657.310038][ T36] [ 657.310649][ T36] Kernel Offset: disabled