last executing test programs: 7m24.580090494s ago: executing program 32 (id=2490): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000002c0)={r1}, &(0x7f0000000280)=0x8) 4m5.453150621s ago: executing program 3 (id=4609): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000480)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000140)=@attr_riscv64=@attr_addr={0x0, 0x1, @aplic, 0x0}) 4m5.205312255s ago: executing program 3 (id=4615): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x7ff, 0x2) 4m4.851582388s ago: executing program 3 (id=4623): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0, 0xffffffffffffffff}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0xe, 0x48000000, &(0x7f0000000300)="40f0538ef047b21fb60068305500", 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 4m4.773661469s ago: executing program 3 (id=4625): mkdirat(0xffffffffffffff9c, &(0x7f00000010c0)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f00000002c0)='./file0/../file0\x00', 0x0, 0x911091, 0x0) chroot(&(0x7f0000000040)='./file0/file0\x00') mount$bind(&(0x7f00000001c0)='./file0/../file0\x00', &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x2125099, 0x0) 4m4.717017932s ago: executing program 3 (id=4627): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r1, &(0x7f00000004c0)=""/57, 0x39) 4m4.316798212s ago: executing program 3 (id=4631): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='sys/bus/pci/drivers/vfio-pci/new_id\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='1', 0x1) 4m4.218558857s ago: executing program 33 (id=4631): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='sys/bus/pci/drivers/vfio-pci/new_id\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='1', 0x1) 2m11.47508812s ago: executing program 2 (id=6773): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(r0) 2m11.420630791s ago: executing program 2 (id=6775): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x971}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000740)={0x1, 0x0, [{0xfaa, 0x1, 0x0, 0x0, @sint={0xf, 0x7}}]}) 2m10.990478715s ago: executing program 2 (id=6781): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000080), 0x4) sendmsg$802154_dgram(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x40c0) 2m10.979439551s ago: executing program 2 (id=6783): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x15, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r0}, 0xc) 2m10.809803338s ago: executing program 2 (id=6786): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x100) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) rename(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000100)='./file0\x00') 2m10.794489605s ago: executing program 2 (id=6789): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f", 0x35}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="f40000000002000a0000000000000000000000070800044000000004080005400000000e060007400003000013000b0063"], 0xf4}, 0x1, 0x0, 0x0, 0x24000800}, 0x20004080) write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[], 0xfe33) 1m55.782654419s ago: executing program 34 (id=6789): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f", 0x35}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="f40000000002000a0000000000000000000000070800044000000004080005400000000e060007400003000013000b0063"], 0xf4}, 0x1, 0x0, 0x0, 0x24000800}, 0x20004080) write$cgroup_subtree(r0, &(0x7f0000000580)=ANY=[], 0xfe33) 1m35.740922583s ago: executing program 4 (id=7288): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000440)={0x34, r0, 0x801, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY={0x18, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "3203597dfac48362427a40c894"}]}]}, 0x34}}, 0x0) 1m35.655333249s ago: executing program 4 (id=7289): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1007f}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x5, 0x47, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1m35.465270713s ago: executing program 4 (id=7292): openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) 1m35.465048926s ago: executing program 4 (id=7293): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f00000000c0)=0x4, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x28}, 0x11}, 0x1c) 1m35.396496311s ago: executing program 4 (id=7294): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1ff) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000240)={0xaaaaca1, 0x0, [{0xd, 0x1, 0xab60, 0x400, 0x9}, {0x1, 0x1fb, 0x4, 0x5, 0x9}]}) 1m35.297447342s ago: executing program 4 (id=7296): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='tbp 2', 0x5) 1m20.278144596s ago: executing program 35 (id=7296): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='tbp 2', 0x5) 1m3.150684038s ago: executing program 1 (id=7958): connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000000)) 1m1.515435911s ago: executing program 1 (id=7962): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys_mnt\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys_mnt/kernel/mm/transparent_hugepage/enabled\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='always', 0x6) 1m1.510177794s ago: executing program 1 (id=7963): mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 1m1.478083225s ago: executing program 1 (id=7969): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 1m1.400033858s ago: executing program 1 (id=7974): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv4/ping_group_range\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='0 ', 0x2) 1m0.800264735s ago: executing program 1 (id=7984): sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="18000000071401"], 0x18}, 0x1, 0x0, 0x0, 0x40008891}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20040894) 1m0.639166808s ago: executing program 36 (id=7984): sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="18000000071401"], 0x18}, 0x1, 0x0, 0x0, 0x40008891}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x20040894) 55.477310244s ago: executing program 6 (id=8070): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000800000095"], 0x0, 0x10000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000000c0), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) 55.326157332s ago: executing program 6 (id=8072): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x52, '\x00', 0x0, @fallback=0x9af8dba271b76fd5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df12c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 55.262385308s ago: executing program 6 (id=8073): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x58b8, 0x10000, 0x10001, 0x2a7}, &(0x7f0000000740)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r0, 0x0, 0x0}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) 55.187359798s ago: executing program 6 (id=8076): bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000fcffffff0000000007000000850000007b"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x34}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) 55.172249186s ago: executing program 6 (id=8078): mkdir(&(0x7f0000000000)='./nfsd_dir\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd_dir\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd_dir/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='-2', 0x2) 55.077267264s ago: executing program 6 (id=8080): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000240)="d1bf2c2c53ab", 0x6}], 0x1) 40.048248106s ago: executing program 37 (id=8080): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000240)="d1bf2c2c53ab", 0x6}], 0x1) 23.974660292s ago: executing program 8 (id=8402): mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2020) read(r0, &(0x7f0000002340)=""/10, 0x55) 23.953988624s ago: executing program 8 (id=8403): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="000000f5"], 0xa) 23.698616728s ago: executing program 8 (id=8407): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x8, 0x8}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 23.574363663s ago: executing program 8 (id=8409): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./myconfig\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/acm.0\x00', 0x1ff) unlinkat(0xffffffffffffff9c, &(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/acm.0\x00', 0x200) 23.503747491s ago: executing program 8 (id=8410): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)="2a20000000df", 0x6) 23.364491708s ago: executing program 8 (id=8411): io_setup(0xc, &(0x7f0000000200)=0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0x0, 0x7fc00100}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 8.339007251s ago: executing program 38 (id=8411): io_setup(0xc, &(0x7f0000000200)=0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0xff, 0x0, 0x7fc00100}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) io_submit(r0, 0x1, &(0x7f00000002c0)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 5.836349208s ago: executing program 5 (id=8619): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="1f003300d000"], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) 5.05929111s ago: executing program 5 (id=8621): r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1ea1e2) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_freeze_timeout', 0x68a41, 0x3) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000ac0)={r1, 0x0, {0x0, 0x0, 0x0, 0x1ff, 0x4000000000000ff9, 0x0, 0x0, 0xa, 0xc, "faf98357e5a1149989fc8dbec3bd02b82a128bbad0099cebdc25f5abb534464c516bdd8a0f3500", "32d8cc48f7061a74df2cfc06e89f3d9e234b30c50997d3bef409ff2176ff7bfe55c54a5d83cd4a524bd3ffe70c7f40800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237641a8ccf162e43ac61f700000000009b4100", [0x9, 0xa]}}) io_setup(0x5, &(0x7f00000001c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000880)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x8, r0, &(0x7f00000004c0)="e4", 0x1, 0x5, 0x0, 0x2}]) 4.67912714s ago: executing program 5 (id=8635): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) setresgid(0xffffffffffffffff, 0xffffffffffffffff, 0xee00) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x20100, 0x44) 4.574532372s ago: executing program 5 (id=8636): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000140)={r1, 0x1, 0x0, @local}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000300)={r1, 0x1, 0x6, @random="d628cc75124a"}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000240)={0x0, 0x1, 0x6, @remote}, 0x10) 4.519411466s ago: executing program 5 (id=8637): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000340)='./proc/fs/nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/fs/nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)='\x00\x00', 0x2) 4.456154094s ago: executing program 5 (id=8638): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x13, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838000391"}]}}}}}}, 0xfd6c) 3.89753016s ago: executing program 7 (id=8651): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000030000000000000009000000850000002e000000850000001100000095"], &(0x7f0000000080)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100)=r1, 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) 3.814229794s ago: executing program 7 (id=8654): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) read$FUSE(r1, &(0x7f0000000140)={0x2020}, 0x2020) 2.896333872s ago: executing program 7 (id=8659): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000003c0)={@val={0x0, 0x22f0}, @void, @eth={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@val, {0x8100, 0x0, 0x0, 0x20}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x4000, 0x17c1, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x56}}}}}}}}, 0x3e) 2.166122075s ago: executing program 7 (id=8668): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000000c0)={0x1, 0x0, [{0x1, 0x2, 0x2, 0x7, 0x4, 0x7fffffff, 0x4e38}]}) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f00000004c0)=@vmx={0x0, 0x0, 0x465, {0x1000, 0xffffffffffffffff}, {"d07ee51100"}}) 1.799525888s ago: executing program 7 (id=8664): mkdirat(0xffffffffffffff9c, 0x0, 0x777) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='10', 0x2) 1.734152349s ago: executing program 7 (id=8666): syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16, @ANYRES16], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000004e40)={0xfb, 0x11, 0x0, 0x98, "4d512c91002a4950676142687108dcd3f82acf5a895bd90fca2bb40bb4fbf29c"}) 1.260602815s ago: executing program 0 (id=8675): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x1) accept4$x25(r0, 0x0, 0x0, 0x80800) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f2e, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) 1.061112365s ago: executing program 9 (id=8679): r0 = memfd_create(&(0x7f0000000500)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1?\xbdu\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xceF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2]V\xf3\x03\x94\xb9\xe1\xa68\x8d\\\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7A72M\x88k@\xe5\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9e0\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xdf\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn^\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xe6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xba\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc00x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 145.998057ms ago: executing program 0 (id=8687): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000180)={0x7, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x40002019}) ioctl$SW_SYNC_IOC_INC(r0, 0x40045701, &(0x7f0000000080)=0x7) 66.271361ms ago: executing program 0 (id=8688): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000009c0)={@val={0x8, 0x800}, @val={0x2, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x7, 0x4, 0x1, 0x22, 0xfc0, 0x69, 0x0, 0x60, 0x6c, 0x0, @empty, @broadcast, {[@generic={0x9, 0x2}, @generic={0x94, 0x4, "d507"}]}}, "14f3305280f125e6e11a9314b296b53b5d25867c0a8c27b6478984da4eb5a28ada390a7b0a58177e7d56be4ee0efb45c215a64d718cb6f639e60026f3fcd218590d2fd47a1803f67d8c3c5ebe25ed9991203e04d3bdc1e70ef759d8f6ca8744bd9d672c1c9368faa9f538c1e6d3f741c022ddc02e6d3e1881c4ebf6d62df9fc11edf041909cea12539f7b05232c1cd9a748ff7e4a6b7ce7420bab33b3ce6da2742316d128730875e8c1d068a59aef9030e56546effdf83fe2b6fcadf2a73552e77d9cfdb452639cae6aa8f5c7aba74516be0a290f60c30c51e8de293376c07b999d87ac564e47f21f28fda4d277beb21a78ab228bfa2b84461fc73b9a82c9ac29bf066fa44f3f676ef64edab4c6dcaa57c48c0065817b0cbf3263361e93334a400fd74ae663ccc959da070390c833a3dc9381a771d719ae9417cd07b43c30e6a10ae8a59c4fd0a9004cc3f9cb772a64d240d7a0d0dac57f4d7978a304adf48f94ce0b7d6a2dff5d3ff8738a81daad9df5b8d6f361e7032c0d2cc84c73a7a2f07a35b1b26966bb08fe07ecb2438006de2d9ff9b9ca0b94bc44c858e785a261bbfbf5f6cfa78b017d671ee8180312522c8031744591711d0517fb8b120e27fb7752f0a0e85bbf1e7059aa2711bf2355fe98e3df0d7cece9741623e2fa492af8287e0fa75daea5725e0519e70aba398c00ae69c572e327755ba2fa81dc47bdcd4e5b722e0ecc8f92f4cd821d575f5f8421dc2e2994621d17da042fd59a2c3ee0ba998a771e066fcf3646007ef3c731edb9472baaa6a5722b09aa6a4da93d855fee7bc2a4db816880160449c576ed46b4ca1e299595f0116946b841308bbd9c2d8e82ce9bcd9173476523bfa8abb82cbd16ddf2efb4aeb5476ab0f5dadbe2528360195a317f3106d25b016901b65b6eed65062083234f205cf4fefe2ee0af15a86feb5d7473d1cdf202387127171d633c02dc39faca7d69721074c0e7eee28ff71fb9e75d80d8fa6bc70a50bd71f60569cb9a30b0cf5599c790353590fd3fb91f77ec89257faa66ff3d13913906166604af616d8de1b92b9cc459a05daad927ebf023c53afdf5ebad5e1d73632777374dfe33b0b90e0cc4cf85bbba301ffe94b26b9f792bdde6d5a9c644bd15ad45c373f768a3a3868ed96c112f2429a27a97bd7756cec800e4ed644a22a81f1010ec376a5726e530d5bcecc635db756ff9a6e2ee89248949d52f88c84cf71be5428a4675430ecef15f1c8ff6a786e5b74eeb76fd26b53dd6287b8e9134b8096b9425f650039af1b3465ab57662ce70c5e29c559e6ffed62f731fd95d31c2f7fa57d98a8aa0b30e454ea73d4f8ba1242bb511e2d275cd93a4f87cc6b208f85b79b980285cd890dacf77dc2668e3c2ad211998f5e3f15be32a3600a2c59821e7e48d46974d17d642ff7b3f1334057c88bea888120095582d257ccaa903d341c850bd2b446c31980acc6f02f0c559a895614f62aea0eee4a904bd1b35193fd2cbff4354834b5f7e8698bad049cfea27a76ec83dfbe2071ff1523bf127713b062ee3ebf6986bd12c31ab386a490734a47466cdde3a82dc7535b1b068a1aa585322c4bf8dd8cf0ca2b8eb56fcf98cf8129148142344d00fca2cd5611e42c607168abcf92c94be28c15be3485375290b825136e0f4047212a866831bc670b9b038355e0c976673b80584c640ec6681ae724ea58685581d493c809fc8861c60ff245cdc486228b0c3c0ac562a3fd777b7d3d43dcc4cf031b70a101bc64a3727d1f5890890070dfc14847f225a82f5a1b3c702970a25a672aa8c4a24bd7d414bb52c839611e48afe3a9022aa9eeedb2dc4cb20aaeb244b0e438f28d3c6cac9fb16171a8b66b93e48d1afb3feae84bb6a4ed0d00ba862dc6fd474fe210faa0d6d51132dcdc4dcdd5d4f94f1ba7dc8b5712188b0f80bd7f6cc211c1a2796d5c8568a97dbfb9e1bcc6e43858342767ffe5d648873215971e968382870afb0f0b33e3a0dbfe70b982abd73b340abaedd3f71ea30c90544b6a3fb8ce0c240d0bc9da7c12a927223185e5ba907d93c30089ca68525983f04ff85ef98314f69e5c9b4a388ca67813fcd0a9b2c083defac488cb3f7e4ebabc7bf6f4f7601a6c4c1a8d10c2fb13f6863c29cf3dcb8bd56768bb0a9e642bb6b94e5957deaeab3e24223e03764bbb16a7084a05735a8d188cbfabcccfce95848a804b56bd5e2051b1755a0e4262044ea2b037113af2e4e90bfed33bdcdc33824245cad3f94c4c9ea0f414a539c36b55d423fbfe4461774696012ee12e9d9c1d645d6dd72b57cca7e8526cc98b2f9e97e2350320f20092b6e4cbcbb52ec9a406dbb893e303077b675ecbd48e6bec13b700ab09d55e17c8815077a31cd75057c9cd65e7a881924a50bed228517be9c0abb19c3d24c458160405dab3ad0deb989a4e1b2e509b7fa57bcddbe8292512c9656df46acc62a028bb484ad0a6548ed9efdff0e83ca82a1d4c86c7d8810d1e4ff1846d1dc8e80f8206c6834bf9c433bc92ce73560d22ba0c8030b694d737fa0f4deb8b59ea9a35147efc891e993b6489a1ed86bbbf159c590bad0b5892c72383f5afedd58b7fa5e11271b35381dbf4a14daf70505b346cbd83b3258b1b413f7247d04e30e1a9eddbf82e8a25a70903c21e6a16ea34f6d7fe3cad0d51812e827596d50549153e394c4926e5e87b78d0faf440472c12929bb7fd49c959e5b06eb48c51915d80f003c2019525c91bdd4efc0e58d7811b083af3164f254c9c6cf3f8345525770033901308d02a9439131e632d073705e7a28312f8c1ccbeec064113009a34f177d7cd953c9a635f6bb12f0ed871a1d80ba86011e13df3220bda5e49c7c3d70f8c49397f69720f31b38cac3ddc7758f7bd1c99dca967a5aa5c788faf18eb2d996be835c3e5901349104ea63bdf1c195f4d29b8c63a0dcf58d501a102b8ac34709e82c0b0d19f762b1d3c40f01e0cb05b0909b90fb587ea260cdc0a043ac67f649486d3c57b9dbf94e44334fd8034218f82c937e6b8c97b627e8803cab0a27f33ebf0e447ab198cdbfc81371fdb6061dcf8c87c24084614ddfdc71cc2a5324e0ea9a1f7cb21ec46d7e5fd936a2a9224e5fe3c39051eb7269f51832751a36814db4aa01eb1a79eca73480c12b1d7f79bb20ba7b957f7e8343af7c38c81edb6aa48eeb82e17f47f5335f4086ef2db57c4e70e847a77362271e16158e010f95c3227162caa7f911e94893d3bf017fb914dddddf7f982ae898914378e3f5a4bc810f246d84ae977290d20773761b8d52bb493076052022586b8ce915b1f4c8f6ef6093e3e12f56e642b1cde9dda220fd7fb26f40ba08899e0217cf2a0883ab552c9432a7d60c6316f936b57c271e13b35d5cc4f20dfbe5fb1b13e916e62cd39e5bec37d0885f6fb5523860f8ae09592d32574e3d9c570c651fa9f4db0d4b9fbd002af8b6919d758ff04989123533804e4a496def7d1d9740ec83e0670233a732d55425014276efcf6b6634c5ed5a97f25deaab14fe934efe0eb13992ef48e29a7f190f253d3cce9929f3183c01c72315b6a36998016af08f84155ca1ad18acf1a54d23fe605957f7016873187a47d7ded54667d3ba4aab222319c5968d0192a1af47be415fce025329b81d5034d2c608ddb108d7acac2c145bf4abadb97cc6a05398c04a8385dab86979a0c857d2b27eeb7bdcd154e9f3ea7e394d3a41d81b0410356e252f5d0fba812d5099ede64b20d4a865fc359092ed619f0e3e6728acc69ce41b585e3c54f73fac28c38aa41ea53440cec35cebf03caaef987b18d9942c644c3f6a389970f3d7d18db8ea1f2c5ab2c0bb84478ce5e439c10749b278dfe8348391cb2bd4c7634a3ac813a6ea36f95bdd80c87fae037775834eb5029854cfe59c99a9597944e7cbce895d14ed0ee8b84ea586e77dc12fe709cf9a083c2a4806913d8914b379b4ecf27525e84fc1df3ff520f79ec244da60f680b59d848e591c89f069cec4b497d9579a86c19a710c5cc00239d6cf3c8596c924561843ae20ad5cac9bc92bf42157ab35329cd62242fec48117f1f6f801c68f9f3ec9677875916ceea7795dfbdd23121cfb3bb1813fe1ee14ddbd5a45985bc496449f82a2cc200905eaaadd1333bf79128459f47b580fdd5a10787094b08418c1dac843ab0e15d824aff2b3d242fe78d9762d39c713ded38cf972c227831ba6fb963c956458eef5689180baa3ef2aef3d3e57c63c2d4509759fb711dfe2772341ae308a7892e583be0917ef5355bfe68becce5bc5971733ca260055ee6481c3e98698a49a1f03a0f537145d051179601c04cd887a64917480ba96ac046638dd6977599f72a7235506737e7e81a03095cc7e102586ec33b79eff0d1dc2b34912fa89dfb434f0256be53f6695685688af05361d3b6954d416f4be06b9ab7846a44ce25b39c7c79012b2f16159fdf96a3998098691364dbbf930a8e224701ee6f8b899fcde632077a03f649bcfad6f506924db17558b708d38d0b286d6f16f286b26cbf11094def0d017eda65328fe2a24d129bd7ac28679f2a98999e6ae508c3bb31b4e384de7593cf8ac46727cb8a07c30d97c87b638f154e1ae2223a8158e292d9467049cd9115051d3dc0c090f9e9ff6cc425f2fbcd3a4471af5182c0e45485194b6627839d356adf2cf7159b6360f7983a5c50f5cdfcf253cc40a413ed280b9ce7d9d70bef8233fbc8f6e0f5e9100f110519088ce84b41d861171f607338f5acf0664f56c88dd50e86851f59e81c2601f66ee9ced3ecae2dcbd37c55f6058390d6237837ff601900971806e987abbca25221d08f7ccb11a41b3a6246efffaff359e04fa52d7ac630f7d96bc5976817f8a347ddacfe079da0633d855343884bf4d2eb58638cd29d499de7af8490a6d9db3922363839371e819e49e54ef7dc953aa8125e053e3689a22d785c3c1729936eedccf682fd56e0aa6069c1ac88d46b0c06c1f43e631f74f9c8b4557678e90ad7788d25caca67b70da4470cc8d28606acf1fed5d4585085449ced76b1a871ebe8ede8d86570d505010c4f6f4656d2195b6190a1dfe423860b5f767f96c1e0fbf1194b9cab5c87dc2f6ce5f408681e2af319ada237e4232cd356574d7a5edbf7c292acc0c0ca04303614e46b6875f2b58f8b400fda08e24020739c2493ecf7c5d0695ecac14e486bc36a575e6a765d43313c4a4c43c5cc32488c045466504cc690f6b14f12e0a669b701d305a056c610b5f3e696e002bd5b940abac2edde34dbadc88881a5a5fc1d7db4389f33eed574ff8ed69eaf3a656635963e297cf2915c2da4bc7739c5d24017c4757a4aaca2b3323bd4fefefc004d2a675a40b7b31a221d825f79fc12f12b9d6637ca48fc2b55c9e982db14d8cce59172d7d7ee6a1f98a2839d263d7382e81ee306d27e7463a3a0cc71c74df84060ca69331afa4e19e0b124ddf430f4323e682d99f7d77854ba416162182dc161a41af02c75eef1688bef190ca86f712994db24d81831cfe4f54229ba2f5df634e45c2d2980cec96d8aefecdb37dcd7fb360c6117af12bcf894ada94069ba44814334ba4b4d487a866e484b45d7348e07a49460ab64c89f45f8b6f74507179fb6b5f03c202dedbc7cc70723ddb56a000000000000000000"}}, 0xfce) 0s ago: executing program 9 (id=8689): connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r0, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x7}) ioctl$sock_netdev_private(r0, 0x8949, &(0x7f0000000000)) 0s ago: executing program 0 (id=8690): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0xa02, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000020000402504a1a44000000001010902"], 0x0) read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) kernel console output (not intermixed with test programs): n item tag 0x0 [ 640.866508][ T5912] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 640.869218][ T5912] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 640.873518][ T5912] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 640.875703][ T5912] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 640.877998][ T5912] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 640.883421][ T5912] hid-generic 0000:0000:0000.0007: hidraw1: HID v0.00 Device [Zw[ba|\rn)A#6oү?aIs5hV3(; [ 640.883421][ T5912] ѝP$zɷX$w[SRezxuSrl[5l'ZCz2] on tDKY縣Ϫ򞿹,UOp{"ixA[ewÒ}ZXA [ 640.923342][T21377] fido_id[21377]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 641.761250][T21379] ceph: No mds server is up or the cluster is laggy [ 641.807576][T21424] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 642.058814][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 642.127023][ T5773] Bluetooth: hci2: command 0x0c1a tx timeout [ 642.128424][T21450] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6663'. [ 642.131996][T21451] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6664'. [ 642.465995][T21465] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 642.469284][T21465] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 642.785812][T21484] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 642.790823][ T5908] team_slave_0: entered promiscuous mode [ 642.795910][ T5908] team_slave_1: entered promiscuous mode [ 642.818180][T21492] openvswitch: netlink: Actions may not be safe on all matching packets [ 642.833380][T21493] vivid-000: disconnect [ 642.866828][T21487] vivid-000: reconnect [ 643.022436][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 643.067282][T21512] misc userio: Can't change port type on an already running userio instance [ 644.075376][T21524] __nla_validate_parse: 1 callbacks suppressed [ 644.075397][T21524] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6695'. [ 644.125453][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 644.200869][ T5773] Bluetooth: hci2: command 0x0c1a tx timeout [ 644.342818][ T24] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 644.494087][T21546] netlink: 'syz.2.6710': attribute type 1 has an invalid length. [ 644.497363][T21546] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.6710'. [ 644.501480][T21546] netlink: 'syz.2.6710': attribute type 1 has an invalid length. [ 644.510557][T21546] netlink: 2016 bytes leftover after parsing attributes in process `syz.2.6710'. [ 645.369144][T21558] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6714'. [ 645.454017][T21563] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6715'. [ 645.684483][T21583] CIFS: Attempting to mount //127.0.0.1/share [ 645.773218][T21591] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6727'. [ 645.973943][T21604] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6734'. [ 646.204975][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 646.280124][ T5773] Bluetooth: hci2: command 0x0c1a tx timeout [ 646.507994][T21583] CIFS: VFS: Error connecting to socket. Aborting operation. [ 646.510556][T21583] CIFS: VFS: cifs_mount failed w/return code = -4 [ 646.646101][T21621] netlink: 168 bytes leftover after parsing attributes in process `syz.2.6741'. [ 646.960515][ T5908] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 647.110679][ T5908] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 647.115424][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.118759][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.123501][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.127737][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.131837][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.136495][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.140451][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.144473][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.149081][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.153537][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.156910][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.161869][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.165710][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.169496][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.174275][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.178174][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.181965][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.186293][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.190679][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.207474][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.213053][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.217060][ T5908] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 647.221261][ T5908] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 647.225591][ T5908] usb 6-1: config 0 interface 0 has no altsetting 0 [ 647.230180][ T5908] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 647.233804][ T5908] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 647.237283][ T5908] usb 6-1: Product: syz [ 647.239119][ T5908] usb 6-1: Manufacturer: syz [ 647.240974][ T5908] usb 6-1: SerialNumber: syz [ 647.427001][T21643] comedi comedi0: Minor 3 could not be opened [ 647.566559][ T42] audit: type=1800 audit(1785494243.944:877): pid=21653 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.6755" name="bMaxPacketSize0" dev="configfs" ino=92616 res=0 errno=0 [ 648.033353][T21682] pimreg: tun_chr_ioctl cmd 1074025672 [ 648.035782][T21682] pimreg: ignored: set checksum disabled [ 648.280779][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 648.702347][T21704] program syz.4.6780 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 648.713741][T21706] ieee802154 phy0 wpan0: encryption failed: -126 [ 649.559004][ T42] audit: type=1326 audit(1785494245.934:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21735 comm="syz.5.6796" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x0 [ 649.744987][T12485] usb 6-1: USB disconnect, device number 11 [ 650.036381][T21746] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6800'. [ 650.236078][T21756] pci 0000:00:04.0: PCI bridge to [bus 01] [ 650.242314][T21756] pci 0000:00:04.0: bridge window [io 0x1000-0x1fff] [ 650.247417][T21756] pci 0000:00:04.0: bridge window [mem 0xfe800000-0xfe9fffff] [ 650.254776][T21756] pci 0000:00:04.0: bridge window [mem 0xfe000000-0xfe1fffff 64bit pref] [ 650.584414][T21769] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6810'. [ 650.631129][T21771] syz.5.6811 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 650.713073][T21775] vhci_hcd vhci_hcd.0: remove, state 4 [ 650.728296][T21775] usb usb38: USB disconnect, device number 1 [ 650.910947][T21781] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6816'. [ 650.953195][T17122] vhci_hcd vhci_hcd.0: stop threads [ 650.954951][T17122] vhci_hcd vhci_hcd.0: release socket [ 650.957560][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 650.962205][T17122] vhci_hcd vhci_hcd.0: stop threads [ 650.966162][T17122] vhci_hcd vhci_hcd.0: release socket [ 650.975526][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 650.984157][T17122] vhci_hcd vhci_hcd.0: stop threads [ 650.988230][T17122] vhci_hcd vhci_hcd.0: release socket [ 650.993344][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.003911][T17122] vhci_hcd vhci_hcd.0: stop threads [ 651.008531][T17122] vhci_hcd vhci_hcd.0: release socket [ 651.014612][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.019974][T17122] vhci_hcd vhci_hcd.0: stop threads [ 651.027648][T21786] base or size exceeds the MTRR width [ 651.029272][T17122] vhci_hcd vhci_hcd.0: release socket [ 651.034443][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.042113][T17122] vhci_hcd vhci_hcd.0: stop threads [ 651.048328][T17122] vhci_hcd vhci_hcd.0: release socket [ 651.054384][T21787] FAULT_INJECTION: forcing a failure. [ 651.054384][T21787] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 651.059768][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.066620][T17122] vhci_hcd vhci_hcd.0: stop threads [ 651.069932][T17122] vhci_hcd vhci_hcd.0: release socket [ 651.074454][T21787] CPU: 3 UID: 0 PID: 21787 Comm: syz.5.6819 Tainted: G L syzkaller #0 PREEMPT(full) [ 651.074482][T21787] Tainted: [L]=SOFTLOCKUP [ 651.074489][T21787] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 651.074499][T21787] Call Trace: [ 651.074506][T21787] [ 651.074513][T21787] dump_stack_lvl+0x100/0x190 [ 651.074539][T21787] should_fail_ex.cold+0x5/0xa [ 651.074571][T21787] _copy_from_user+0x2e/0xd0 [ 651.074611][T21787] get_old_timespec32+0x82/0x130 [ 651.074637][T21787] ? __pfx_get_old_timespec32+0x10/0x10 [ 651.074664][T21787] ? trace_event_raw_event_x86_fpu+0x2af/0x3c0 [ 651.074715][T21787] __ia32_sys_futex_time32+0x1cc/0x470 [ 651.074748][T21787] ? xfd_validate_state+0x129/0x190 [ 651.074767][T21787] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 651.074798][T21787] __do_fast_syscall_32+0xe7/0x970 [ 651.074823][T21787] do_fast_syscall_32+0x32/0x70 [ 651.074846][T21787] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 651.074867][T21787] RIP: 0023:0xf704efec [ 651.074888][T21787] Code: Unable to access opcode bytes at 0xf704efc2. [ 651.074907][T21787] RSP: 002b:00000000ffb3c6fc EFLAGS: 00000202 ORIG_RAX: 00000000000000f0 [ 651.074925][T21787] RAX: ffffffffffffffda RBX: 00000000f7444f8c RCX: 0000000000000080 [ 651.074936][T21787] RDX: 0000000000000000 RSI: 00000000ffb3c898 RDI: 0000000000000000 [ 651.074945][T21787] RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000000000000000 [ 651.074954][T21787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 651.074964][T21787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 651.074986][T21787] [ 651.076855][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.155919][T17122] vhci_hcd vhci_hcd.0: stop threads [ 651.158592][T17122] vhci_hcd vhci_hcd.0: release socket [ 651.161126][T17122] vhci_hcd vhci_hcd.0: disconnect device [ 651.163513][T21775] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 651.199140][T21775] vhci_hcd vhci_hcd.0: remove, state 4 [ 651.206851][T21775] usb usb37: USB disconnect, device number 1 [ 651.277583][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.279431][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.283273][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.285187][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.286875][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.288737][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.290994][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.292760][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.294520][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.296426][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.298140][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.301267][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.303189][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.304890][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.306693][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.308600][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.310630][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.312447][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.314362][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.316067][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.317813][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.319745][ T12] vhci_hcd vhci_hcd.0: stop threads [ 651.322305][ T12] vhci_hcd vhci_hcd.0: release socket [ 651.324257][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 651.326117][T21775] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 651.561497][T12485] kernel write not supported for file /input/event2 (pid: 12485 comm: kworker/2:11) [ 652.204074][ T42] audit: type=1326 audit(1785494248.584:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21796 comm="syz.5.6823" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x7fc00000 [ 652.901804][T21849] nbd: nbd4 already in use [ 653.053074][T21860] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6849'. [ 654.959955][T16853] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 655.111796][T16853] usb 9-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 655.119365][T16853] usb 9-1: config 0 interface 0 has no altsetting 0 [ 655.126083][T16853] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 655.129753][T16853] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 655.136687][T16853] usb 9-1: Product: syz [ 655.138342][T16853] usb 9-1: Manufacturer: syz [ 655.144830][T16853] usb 9-1: SerialNumber: syz [ 655.894177][ T5848] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 656.085828][ T5848] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 656.094933][ T5848] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 656.104519][ T5848] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 656.112909][ T5848] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.131694][ T5848] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 656.135273][ T5848] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 656.138333][ T5848] usb 6-1: Product: syz [ 656.142175][ T5848] usb 6-1: Manufacturer: syz [ 656.676195][T21933] MTRR 0 not used [ 657.723375][ T24] usb 9-1: USB disconnect, device number 11 [ 658.646277][ T24] usb 6-1: USB disconnect, device number 12 [ 658.907804][T21998] overlayfs: upper fs does not support tmpfile. [ 660.210096][T12485] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 660.340187][ T24] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 660.361383][T12485] usb 9-1: Using ep0 maxpacket: 8 [ 660.386030][T12485] usb 9-1: unable to get BOS descriptor or descriptor too short [ 660.395211][T12485] usb 9-1: no configurations [ 660.397275][T12485] usb 9-1: can't read configurations, error -22 [ 660.503826][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 660.508989][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 660.513659][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 660.536195][ T24] usb 6-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 660.540300][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 660.545969][ T24] usb 6-1: Product: syz [ 660.547785][ T24] usb 6-1: Manufacturer: syz [ 660.551624][ T24] usb 6-1: SerialNumber: syz [ 660.786759][T22090] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6954'. [ 660.819135][T22092] /dev/nullb0: Can't open blockdev [ 661.470374][T12485] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 661.512535][ T36] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 661.527623][ T5103] Bluetooth: hci4: sending frame failed (-49) [ 661.533551][ T5773] Bluetooth: hci4: Opcode 0x1003 failed: -49 [ 661.630007][T12485] usb 9-1: Using ep0 maxpacket: 8 [ 661.632889][T12485] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 661.635616][T12485] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 661.638669][T12485] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 661.642836][T12485] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 661.646103][T12485] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 661.651615][T12485] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 661.655918][T12485] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.097349][T12485] usb 6-1: USB disconnect, device number 13 [ 664.026845][ T5103] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 664.040468][ T5103] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 664.053062][ T5103] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 664.058963][ T5103] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 664.067840][ T5103] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 664.131065][ T5645] usb 9-1: USB disconnect, device number 13 [ 664.216468][T22180] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6991'. [ 664.482732][T22197] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6997'. [ 664.524480][T22199] sctp: [Deprecated]: syz.1.6998 (pid 22199) Use of struct sctp_assoc_value in delayed_ack socket option. [ 664.524480][T22199] Use struct sctp_sack_info instead [ 664.572228][T17122] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.858038][T12485] usb 6-1: new low-speed USB device number 14 using dummy_hcd [ 664.874767][T17122] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.032045][T12485] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 665.047491][T12485] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.055798][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.059412][T12485] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.061068][T22227] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7008'. [ 665.063357][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.071347][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.075949][T12485] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.095439][T12485] usb 6-1: config 168 interface 0 has no altsetting 0 [ 665.100383][T12485] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 665.104176][T12485] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.109599][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.113312][T12485] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.117182][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.124389][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.128163][T12485] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.132561][T12485] usb 6-1: config 168 interface 0 has no altsetting 0 [ 665.135579][T12485] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 665.138175][T12485] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 665.144860][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 665.148482][T12485] usb 6-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 665.152440][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 665.156092][T12485] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 665.159685][T12485] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 665.164096][T12485] usb 6-1: config 168 interface 0 has no altsetting 0 [ 665.168766][T12485] usb 6-1: string descriptor 0 read error: -22 [ 665.172071][T12485] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 665.179138][T12485] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.239124][T17122] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.265964][T22170] bridge0: port 1(bridge_slave_0) entered blocking state [ 665.273283][T22170] bridge0: port 1(bridge_slave_0) entered disabled state [ 665.278450][T22170] bridge_slave_0: entered allmulticast mode [ 665.283685][T22170] bridge_slave_0: entered promiscuous mode [ 665.287399][T22170] bridge0: port 2(bridge_slave_1) entered blocking state [ 665.290118][T22170] bridge0: port 2(bridge_slave_1) entered disabled state [ 665.292605][T22170] bridge_slave_1: entered allmulticast mode [ 665.295486][T22170] bridge_slave_1: entered promiscuous mode [ 665.315155][T22241] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7014'. [ 665.340056][T22170] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 665.384398][T17122] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.421808][T22170] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 665.448557][T22170] team0: Port device team_slave_0 added [ 665.464466][T22170] team0: Port device team_slave_1 added [ 665.483356][T22170] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 665.486558][T22170] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 665.495223][T22170] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 665.504944][T22170] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 665.508042][T22170] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 665.529782][T22170] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 665.744282][T22268] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 665.746710][T22268] IPv6: NLM_F_CREATE should be set when creating new route [ 665.749151][T22268] IPv6: NLM_F_CREATE should be set when creating new route [ 665.762100][T22268] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 665.825390][T22170] hsr_slave_0: entered promiscuous mode [ 665.828236][T22170] hsr_slave_1: entered promiscuous mode [ 665.830986][T22170] debugfs: 'hsr0' already exists in 'hsr' [ 665.835139][T22170] Cannot create hsr debugfs directory [ 665.970494][T17122] bridge_slave_1: left allmulticast mode [ 665.973316][T17122] bridge_slave_1: left promiscuous mode [ 665.982857][T17122] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.076348][T17122] bridge_slave_0: left allmulticast mode [ 666.084331][T17122] bridge_slave_0: left promiscuous mode [ 666.086395][T17122] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.104915][T17122] dvmrp8: left allmulticast mode [ 666.122885][ T5773] Bluetooth: hci4: command tx timeout [ 666.131387][T22287] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7034'. [ 666.368113][T17122] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 666.377454][T17122] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 666.384712][T17122] bond0 (unregistering): Released all slaves [ 666.400048][ T5458] 8021q: adding VLAN 0 to HW filter on device eth2 [ 666.618749][T17122] tipc: Left network mode [ 666.624524][T22305] Bluetooth: hci2: Frame reassembly failed (-84) [ 666.694839][T22170] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 666.724534][T22170] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 666.795000][T22170] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 666.813438][T22170] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 666.816787][ T5458] 8021q: adding VLAN 0 to HW filter on device eth3 [ 666.820275][T22170] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 666.834636][T22170] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 666.838506][T22170] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 666.854595][T22170] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 666.973768][T22170] 8021q: adding VLAN 0 to HW filter on device bond0 [ 667.013062][T22170] 8021q: adding VLAN 0 to HW filter on device team0 [ 667.024719][T16892] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.027629][T16892] bridge0: port 1(bridge_slave_0) entered forwarding state [ 667.045282][T16892] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.047542][T16892] bridge0: port 2(bridge_slave_1) entered forwarding state [ 667.071422][T17122] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 667.074003][T17122] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 667.081174][T17122] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 667.084637][T17122] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 667.113935][T17122] veth1_macvtap: left promiscuous mode [ 667.119083][T17122] veth0_macvtap: left promiscuous mode [ 667.122091][T17122] veth1_vlan: left promiscuous mode [ 667.124947][T17122] veth0_vlan: left promiscuous mode [ 667.397808][T17122] team0 (unregistering): Port device team_slave_1 removed [ 667.412993][T17122] team0 (unregistering): Port device team_slave_0 removed [ 667.522334][ T5458] 8021q: adding VLAN 0 to HW filter on device eth4 [ 667.618206][ T1475] usb 6-1: USB disconnect, device number 14 [ 667.773153][ T5458] 8021q: adding VLAN 0 to HW filter on device eth5 [ 668.035849][T22170] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 668.143859][T16853] kernel write not supported for file bpf-map (pid: 16853 comm: kworker/1:1) [ 668.202205][ T5103] Bluetooth: hci4: command tx timeout [ 668.311921][T22170] veth0_vlan: entered promiscuous mode [ 668.333555][T22170] veth1_vlan: entered promiscuous mode [ 668.370620][T22170] veth0_macvtap: entered promiscuous mode [ 668.375579][T22170] veth1_macvtap: entered promiscuous mode [ 668.392399][T22170] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 668.402170][T22170] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 668.466488][ T5837] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.485412][ T5837] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.492987][ T5837] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.522163][ T5837] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.547295][T16892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.549876][T16892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.576550][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.580394][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.680202][ T5103] Bluetooth: hci2: command 0x1003 tx timeout [ 668.680714][ T5773] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 669.013119][T22406] block nbd5: Unsupported socket: should be TCP or UNIX. [ 669.414362][T22422] gretap0: entered promiscuous mode [ 670.280886][ T5773] Bluetooth: hci4: command tx timeout [ 670.590053][ T5912] kernel read not supported for file /dsp1 (pid: 5912 comm: kworker/1:5) [ 671.302256][T22499] netlink: 36 bytes leftover after parsing attributes in process `syz.6.7101'. [ 672.146870][T22527] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7115'. [ 672.232980][T22533] netlink: 'syz.4.7118': attribute type 2 has an invalid length. [ 672.235523][T22533] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7118'. [ 672.336334][T22536] overlayfs: upper fs does not support tmpfile. [ 672.363977][ T5773] Bluetooth: hci4: command tx timeout [ 672.730805][T22543] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7122'. [ 673.895360][T22565] bond1: invalid ARP target 0.0.0.0 specified for addition [ 673.897863][T22565] bond1: option arp_ip_target: invalid value (0) [ 673.920958][T22565] bond1 (unregistering): Released all slaves [ 673.996877][T12485] usb 11-1: new low-speed USB device number 2 using dummy_hcd [ 674.156274][T12485] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 674.161001][T12485] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 674.164684][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 674.168108][T12485] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 674.172553][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 674.180485][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 674.185248][T12485] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 674.193731][T12485] usb 11-1: config 168 interface 0 has no altsetting 0 [ 674.197489][T22584] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 674.198350][T12485] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 674.199781][T22584] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 674.209173][T12485] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 674.220828][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 674.226698][T12485] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 674.231077][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 674.234682][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 674.238403][T12485] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 674.243828][T12485] usb 11-1: config 168 interface 0 has no altsetting 0 [ 674.249084][T12485] usb 11-1: config 168 descriptor has 1 excess byte, ignoring [ 674.252046][T12485] usb 11-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 674.255827][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 674.259357][T12485] usb 11-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 674.263671][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 674.267620][T12485] usb 11-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 674.274425][T12485] usb 11-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 674.280136][T12485] usb 11-1: config 168 interface 0 has no altsetting 0 [ 674.287841][T12485] usb 11-1: string descriptor 0 read error: -22 [ 674.296451][T12485] usb 11-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 674.304245][T12485] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.544039][ T34] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 674.707216][ T34] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 674.721127][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.724521][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.728762][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.734035][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.747057][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.752302][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.758637][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.771004][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.779935][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.787941][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.793652][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.797672][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.801670][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.805210][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.809415][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.827484][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.831954][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.843971][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.851253][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.857338][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.869393][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.873493][ T34] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 674.878978][ T34] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 674.890114][ T34] usb 10-1: config 0 interface 0 has no altsetting 0 [ 674.893970][ T34] usb 10-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 674.898428][ T34] usb 10-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 674.909381][ T34] usb 10-1: Product: syz [ 674.911730][ T34] usb 10-1: Manufacturer: syz [ 674.913802][ T34] usb 10-1: SerialNumber: syz [ 674.941469][T22607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7149'. [ 675.242984][ C0] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 675.440444][T12485] IPVS: starting estimator thread 0... [ 675.531833][T22628] IPVS: using max 41 ests per chain, 98400 per kthread [ 675.564811][T22632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 675.572354][T22632] bridge_slave_0: left allmulticast mode [ 675.574865][T22632] bridge_slave_0: left promiscuous mode [ 675.577253][T22632] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.765337][T22648] ieee802154 phy0 wpan0: encryption failed: -126 [ 675.869909][T22651] ieee802154 phy0 wpan0: encryption failed: -126 [ 676.737521][ T5912] usb 11-1: USB disconnect, device number 2 [ 676.796610][T22663] bond2: invalid ARP target 0.0.0.0 specified for addition [ 676.799049][T22663] bond2: option arp_ip_target: invalid value (0) [ 676.813522][T22663] bond2 (unregistering): Released all slaves [ 677.317073][ T5912] usb 10-1: USB disconnect, device number 3 [ 677.715872][T22697] GUP no longer grows the stack in syz.6.7186 (22697): 80009000-8000a000 (80005000) [ 677.721433][T22697] CPU: 1 UID: 0 PID: 22697 Comm: syz.6.7186 Tainted: G L syzkaller #0 PREEMPT(full) [ 677.721469][T22697] Tainted: [L]=SOFTLOCKUP [ 677.721474][T22697] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 677.721482][T22697] Call Trace: [ 677.721486][T22697] [ 677.721491][T22697] dump_stack_lvl+0x100/0x190 [ 677.721510][T22697] gup_vma_lookup.cold+0x83/0x96 [ 677.721537][T22697] __get_user_pages+0x241/0x32a0 [ 677.721570][T22697] ? down_read_killable+0x35e/0x520 [ 677.721603][T22697] ? __pfx___get_user_pages+0x10/0x10 [ 677.721641][T22697] __gup_longterm_locked+0x87d/0x16f0 [ 677.721675][T22697] ? __pfx___gup_longterm_locked+0x10/0x10 [ 677.721702][T22697] ? lock_acquire+0x1b9/0x370 [ 677.721733][T22697] gup_fast_fallback+0x16dc/0x2790 [ 677.721760][T22697] ? __pfx_gup_fast_fallback+0x10/0x10 [ 677.721775][T22697] ? find_held_lock+0x2b/0x80 [ 677.721790][T22697] ? __lock_acquire+0x49f/0x1a40 [ 677.721815][T22697] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 677.721846][T22697] get_user_pages_fast+0xa7/0xf0 [ 677.721864][T22697] ? __pfx_get_user_pages_fast+0x10/0x10 [ 677.721885][T22697] ? iov_iter_advance+0xac/0x6d0 [ 677.721907][T22697] __iov_iter_get_pages_alloc+0x8f2/0x1f20 [ 677.721929][T22697] ? pipe_lock+0x69/0x80 [ 677.721942][T22697] ? __pfx___iov_iter_get_pages_alloc+0x10/0x10 [ 677.721960][T22697] ? __pfx___mutex_lock+0x10/0x10 [ 677.721977][T22697] ? iovec_from_user+0xda/0x140 [ 677.722001][T22697] iov_iter_get_pages2+0xa3/0x100 [ 677.722017][T22697] ? __pfx_iov_iter_get_pages2+0x10/0x10 [ 677.722033][T22697] ? wait_for_space+0x2ca/0x3b0 [ 677.722055][T22697] __do_sys_vmsplice+0x7dd/0x13c0 [ 677.722072][T22697] ? __pfx___do_sys_vmsplice+0x10/0x10 [ 677.722089][T22697] ? __pfx_futex_wait+0x10/0x10 [ 677.722127][T22697] ? __do_fast_syscall_32+0xe7/0x970 [ 677.722144][T22697] __do_fast_syscall_32+0xe7/0x970 [ 677.722162][T22697] do_fast_syscall_32+0x32/0x70 [ 677.722179][T22697] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 677.722194][T22697] RIP: 0023:0xf6fdefec [ 677.722210][T22697] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 677.722215][T22697] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 000000000000013c [ 677.722227][T22697] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 677.722236][T22697] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 677.722243][T22697] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 677.722250][T22697] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 677.722256][T22697] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 677.722270][T22697] [ 678.001254][T22711] input: syz0 as /devices/virtual/input/input47 [ 679.634263][T22791] netlink: 76 bytes leftover after parsing attributes in process `syz.6.7222'. [ 679.649783][T22791] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 679.999482][ T42] audit: type=1326 audit(1785494276.374:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.007145][ T42] audit: type=1326 audit(1785494276.374:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.014432][ T42] audit: type=1326 audit(1785494276.384:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.021357][ T42] audit: type=1326 audit(1785494276.384:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.028069][ T42] audit: type=1326 audit(1785494276.384:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.035367][ T42] audit: type=1326 audit(1785494276.384:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf7f55fec code=0x7ffc0000 [ 680.046455][ T42] audit: type=1326 audit(1785494276.384:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f56008 code=0x7ffc0000 [ 680.055368][ T42] audit: type=1326 audit(1785494276.384:887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f56008 code=0x7ffc0000 [ 680.063101][ T42] audit: type=1326 audit(1785494276.384:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f56008 code=0x7ffc0000 [ 680.071847][ T42] audit: type=1326 audit(1785494276.384:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22812 comm="syz.1.7227" exe="/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f56008 code=0x7ffc0000 [ 681.810330][T22866] loop4: detected capacity change from 0 to 7 [ 681.830140][ C3] blk_print_req_error: 5 callbacks suppressed [ 681.830154][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.835384][ C3] buffer_io_error: 5 callbacks suppressed [ 681.835394][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.861418][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.864771][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.869255][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.872257][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.874797][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.877796][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.885914][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.889972][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.893539][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.897589][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.903011][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.907120][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.910652][T22866] ldm_validate_partition_table(): Disk read failed. [ 681.914199][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.918216][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.922274][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.926276][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.929950][ C3] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 681.933978][ C3] Buffer I/O error on dev loop4, logical block 0, async page read [ 681.938558][T22866] Dev loop4: unable to read RDB block 0 [ 681.942340][T22866] loop4: unable to read partition table [ 681.945084][T22866] loop4: partition table beyond EOD, truncated [ 681.947920][T22866] loop_reread_partitions: partition scan of loop4 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 682.797171][ T5458] veth1_vlan: left promiscuous mode [ 682.993919][T22921] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 683.008679][T22921] overlayfs: overlapping lowerdir path [ 683.164086][ T5458] veth1_vlan: entered promiscuous mode [ 683.215970][T22941] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7277'. [ 683.306029][T22949] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7280'. [ 683.380145][ T5908] usb 11-1: new high-speed USB device number 3 using dummy_hcd [ 683.410376][T12485] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 683.570182][ T5908] usb 11-1: unable to get BOS descriptor or descriptor too short [ 683.575363][ T5908] usb 11-1: no configurations [ 683.579180][ T5908] usb 11-1: can't read configurations, error -22 [ 683.603803][T12485] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 683.606802][T12485] usb 10-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 683.610180][T12485] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 683.613087][T12485] usb 10-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 683.616915][T12485] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 683.620858][T12485] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 683.626190][T12485] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 683.629409][T12485] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 683.632522][T12485] usb 10-1: Product: syz [ 683.634047][T12485] usb 10-1: Manufacturer: syz [ 684.564693][T23002] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7298'. [ 684.570206][T23002] netlink: 104 bytes leftover after parsing attributes in process `syz.6.7298'. [ 684.573287][T23002] netlink: 104 bytes leftover after parsing attributes in process `syz.6.7298'. [ 685.260490][ C3] IPv4: Oversized IP packet from 127.0.0.1 [ 685.483063][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.485220][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.500188][T23038] Invalid logical block size (4095) [ 685.565043][T23046] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7315'. [ 685.569354][T23046] netlink: 28 bytes leftover after parsing attributes in process `syz.6.7315'. [ 685.572393][T23046] netlink: 28 bytes leftover after parsing attributes in process `syz.6.7315'. [ 685.609222][T23050] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7317'. [ 685.613714][T23050] netlink: 72 bytes leftover after parsing attributes in process `syz.6.7317'. [ 686.191751][ T24] usb 10-1: USB disconnect, device number 4 [ 686.245017][T23071] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7325'. [ 686.258571][T23071] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7325'. [ 686.261551][T23071] netlink: 28 bytes leftover after parsing attributes in process `syz.5.7325'. [ 687.029780][T23098] input: syz1 as /devices/virtual/input/input48 [ 687.350877][T23113] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7346'. [ 687.353948][T23113] macvlan0: left allmulticast mode [ 687.355717][T23113] netlink: 'syz.1.7346': attribute type 1 has an invalid length. [ 687.358267][T23113] netlink: 'syz.1.7346': attribute type 2 has an invalid length. [ 687.706727][T23134] tipc: New replicast peer: 255.255.255.255 [ 687.713448][T23134] tipc: Enabled bearer , priority 10 [ 687.804952][T23136] serio: Serial port ttynull [ 687.889761][T23145] netlink: 'syz.5.7360': attribute type 8 has an invalid length. [ 688.088005][T23153] ieee802154 phy0 wpan0: encryption failed: -126 [ 688.710059][ T5912] tipc: Node number set to 2130706433 [ 688.765441][ T5773] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 689.378720][T23190] Format for adding new device is "id port_count num_queues" (uint uint uint). [ 690.535391][T23240] pimreg: tun_chr_ioctl cmd 1074025684 [ 691.204803][T23265] netlink: 56 bytes leftover after parsing attributes in process `syz.5.7411'. [ 691.208561][T23265] netlink: 56 bytes leftover after parsing attributes in process `syz.5.7411'. [ 691.451829][T23275] netpci0: tun_chr_ioctl cmd 1074025681 [ 691.746576][T23291] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 692.195987][T23315] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.201724][ T5848] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 692.207848][T23314] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.350349][ T5848] usb 10-1: Using ep0 maxpacket: 8 [ 692.357827][ T5848] usb 10-1: config 0 has an invalid interface number: 186 but max is 0 [ 692.365893][ T5848] usb 10-1: config 0 has no interface number 0 [ 692.370611][ T5848] usb 10-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 692.380072][ T5848] usb 10-1: config 0 interface 186 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 692.386377][ T5848] usb 10-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 692.393384][ T5848] usb 10-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 692.399012][ T5848] usb 10-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 692.414907][ T5848] usb 10-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 692.419410][ T5848] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.425010][ T5848] usb 10-1: Product: syz [ 692.426815][ T5848] usb 10-1: Manufacturer: syz [ 692.440133][ T5848] usb 10-1: SerialNumber: syz [ 692.708019][T12485] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.711950][T12485] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.717130][T12485] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.720859][T12485] rtc_cmos PNP0B00:00: Alarms can be up to one day in the future [ 692.723516][T12485] rtc rtc0: __rtc_set_alarm: err=-22 [ 693.240893][T23328] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7439'. [ 693.244909][T23328] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7439'. [ 694.972313][ T5912] usb 10-1: USB disconnect, device number 5 [ 695.171321][T23472] loop9: detected capacity change from 0 to 7 [ 695.595883][ C3] blk_print_req_error: 6 callbacks suppressed [ 695.595899][ C3] invalid error, dev loop9, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 695.601212][ C3] buffer_io_error: 10 callbacks suppressed [ 695.601221][ C3] Buffer I/O error on dev loop9, logical block 0, lost async page write [ 696.391850][T23546] io-wq is not configured for unbound workers [ 696.427383][ T42] kauditd_printk_skb: 4640 callbacks suppressed [ 696.427398][ T42] audit: type=1326 audit(1785494292.804:5530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23551 comm="syz.1.7533" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f55fec code=0x0 [ 697.285792][T23591] CIFS: bad ip= option (1270.0.1) [ 697.290999][T23591] CIFS: Attempting to mount (null) [ 698.064838][T23605] input: syz0 as /devices/virtual/input/input51 [ 698.120697][T23591] CIFS: VFS: Error connecting to socket. Aborting operation. [ 698.123225][T23591] CIFS: VFS: cifs_mount failed w/return code = -4 [ 698.345485][T23628] scsi_dev_info_list_add_str: bad dev info string 'end' '' '' [ 698.435798][T23636] block2mtd: error: cannot open device #! [ 699.600274][ T5103] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 699.615491][ T5103] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 699.626679][ T5103] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 699.633881][ T5103] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 699.636830][ T5103] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 699.726977][T23689] usbcore.quirks: string doesn't fit in 127 chars. [ 700.003982][T23708] C: renamed from veth1_to_team (while UP) [ 700.013549][T23708] netlink: 'syz.5.7601': attribute type 2 has an invalid length. [ 700.016911][T23708] netlink: 128 bytes leftover after parsing attributes in process `syz.5.7601'. [ 700.020910][T23708] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 700.027565][T23710] loop5: detected capacity change from 0 to 7 [ 700.083616][T13329] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.091055][T13329] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.100836][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.106632][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.111463][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.116285][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.118776][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.123399][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.126279][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.129316][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.132262][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.135377][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.137863][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.141410][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.145930][T23710] ldm_validate_partition_table(): Disk read failed. [ 700.148142][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.152254][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.155423][T23710] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 700.158517][T23710] Buffer I/O error on dev loop5, logical block 0, async page read [ 700.161308][T23710] Dev loop5: unable to read RDB block 0 [ 700.163375][T23710] loop5: unable to read partition table [ 700.165370][T23710] loop5: partition table beyond EOD, truncated [ 700.174642][T23710] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 700.323321][T23680] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.328933][T23680] bridge0: port 1(bridge_slave_0) entered disabled state [ 700.332049][T23680] bridge_slave_0: entered allmulticast mode [ 700.334907][T23680] bridge_slave_0: entered promiscuous mode [ 700.338582][T23680] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.341820][T23680] bridge0: port 2(bridge_slave_1) entered disabled state [ 700.344292][T23680] bridge_slave_1: entered allmulticast mode [ 700.347045][T23680] bridge_slave_1: entered promiscuous mode [ 700.368236][T23680] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 700.374586][T23680] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 700.404007][T23680] team0: Port device team_slave_0 added [ 700.407454][T23680] team0: Port device team_slave_1 added [ 700.443118][T23680] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 700.445888][T23680] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 700.456115][T23680] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 700.461821][T23680] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 700.464950][T23680] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 700.475591][T23680] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 700.527029][T23680] hsr_slave_0: entered promiscuous mode [ 700.530899][T23680] hsr_slave_1: entered promiscuous mode [ 700.533143][T23680] debugfs: 'hsr0' already exists in 'hsr' [ 700.534978][T23680] Cannot create hsr debugfs directory [ 700.665568][T23680] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 700.692730][T23680] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 700.696156][T23680] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 700.703053][T23680] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 700.707185][T23680] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 700.713798][T23680] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 700.716856][T23680] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 700.723529][T23680] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 700.738766][T23680] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.741232][T23680] bridge0: port 2(bridge_slave_1) entered forwarding state [ 700.743637][T23680] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.746727][T23680] bridge0: port 1(bridge_slave_0) entered forwarding state [ 700.787260][T23680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 700.801006][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 700.807567][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 700.876608][T23680] 8021q: adding VLAN 0 to HW filter on device team0 [ 700.890226][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.892615][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 700.907251][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.909572][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 700.966060][T23761] syzkaller1: tun_chr_ioctl cmd 35108 [ 701.296002][T23680] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 701.524222][T23680] veth0_vlan: entered promiscuous mode [ 701.534236][T23680] veth1_vlan: entered promiscuous mode [ 701.565818][T23680] veth0_macvtap: entered promiscuous mode [ 701.573052][T23812] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7636'. [ 701.587599][T23680] veth1_macvtap: entered promiscuous mode [ 701.598625][T23680] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 701.608269][T23680] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 701.660525][T23817] netlink: 'syz.5.7638': attribute type 5 has an invalid length. [ 701.663225][T23817] netlink: 3657 bytes leftover after parsing attributes in process `syz.5.7638'. [ 701.684687][ T5837] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.717420][ T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.726813][ T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.736828][ T5773] Bluetooth: hci2: command tx timeout [ 701.784359][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 701.790301][ T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 701.799462][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 701.824578][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 701.830319][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 702.006182][T23839] loop9: detected capacity change from 0 to 255852544 [ 702.069959][T23839] loop9: detected capacity change from 255852544 to 524287871 [ 703.027436][T23889] usbip-vudc usbip-vudc.0: gadget not bound [ 703.618664][T23920] batadv_slave_1: entered promiscuous mode [ 703.622453][T23920] batadv_slave_1: left promiscuous mode [ 703.662887][T23922] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7686'. [ 703.779014][ T5877] hid-generic 0005:16C0:5505.0008: item fetching failed at offset 0/1 [ 703.788183][ T5877] hid-generic 0005:16C0:5505.0008: probe with driver hid-generic failed with error -22 [ 703.800776][ T5773] Bluetooth: hci2: command tx timeout [ 703.925423][T23938] netlink: 4 bytes leftover after parsing attributes in process `syz.7.7693'. [ 704.520237][T23961] netlink: 3 bytes leftover after parsing attributes in process `syz.5.7703'. [ 704.992395][T23993] netlink: 7 bytes leftover after parsing attributes in process `syz.6.7719'. [ 705.080278][ T34] hid_parser_main: 6 callbacks suppressed [ 705.080294][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x3 [ 705.086698][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x3 [ 705.092592][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.096625][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.100084][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.104133][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.108822][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.112096][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.116813][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.119348][ T34] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 705.126467][ T34] hid-generic 0000:0000:0000.0009: hidraw1: HID v0.03 Device [syz1] on syz1 [ 705.176706][T24003] fido_id[24003]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 705.300862][T24015] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7728'. [ 705.483391][T24026] netlink: 'syz.5.7733': attribute type 1 has an invalid length. [ 705.815451][ T5773] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 705.880449][ T5773] Bluetooth: hci2: command tx timeout [ 705.976276][T24064] udc usbip-vudc.0: soft-connect without a gadget driver [ 707.663098][T24125] team0: No ports can be present during mode change [ 707.750055][ T1346] usb 11-1: new full-speed USB device number 5 using dummy_hcd [ 707.971480][ T5773] Bluetooth: hci2: command tx timeout [ 708.001184][T24141] netlink: 16 bytes leftover after parsing attributes in process `syz.7.7784'. [ 708.004716][ T1346] usb 11-1: unable to get BOS descriptor or descriptor too short [ 708.008489][T24141] netlink: 12 bytes leftover after parsing attributes in process `syz.7.7784'. [ 708.011644][ T1346] usb 11-1: unable to read config index 0 descriptor/start: -71 [ 708.015689][T24141] netlink: 12 bytes leftover after parsing attributes in process `syz.7.7784'. [ 708.019298][ T1346] usb 11-1: can't read configurations, error -71 [ 708.643294][T24167] bond0: (slave macvlan3): Error -98 calling set_mac_address [ 708.695277][T16853] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 708.849994][T16853] usb 10-1: Using ep0 maxpacket: 8 [ 708.852921][T16853] usb 10-1: config index 0 descriptor too short (expected 74, got 45) [ 708.855663][T16853] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 708.859248][T16853] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 708.862577][T16853] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 65535, setting to 1024 [ 708.866295][T16853] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 708.869591][T16853] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 708.874584][T16853] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 708.878058][T16853] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 709.077799][T24183] ima: policy update failed [ 709.082364][ T42] audit: type=1802 audit(1785494305.464:5531): pid=24183 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.6.7804" res=0 errno=0 [ 709.140283][ T5848] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 709.317783][ T5848] usb 12-1: unable to get BOS descriptor or descriptor too short [ 709.321072][ T5848] usb 12-1: unable to read config index 0 descriptor/start: -71 [ 709.323615][ T5848] usb 12-1: can't read configurations, error -71 [ 709.573375][ T42] audit: type=1326 audit(1785494305.954:5532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24174 comm="syz.1.7801" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f55fec code=0x7fc00000 [ 710.528576][T24265] Format for deleting device is "id" (uint). [ 710.753778][T24281] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7850'. [ 711.010361][T24296] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 711.012762][T24296] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 711.014752][T24296] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 711.022916][T24296] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 711.032888][T24296] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 711.035440][T24296] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 711.090553][T24296] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 711.303445][ T42] audit: type=1326 audit(1785494307.684:5533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.332449][ T42] audit: type=1326 audit(1785494307.684:5534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.343534][ T42] audit: type=1326 audit(1785494307.684:5535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=360 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.364504][ T42] audit: type=1326 audit(1785494307.684:5536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.375096][ T42] audit: type=1326 audit(1785494307.684:5537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.395958][ T42] audit: type=1326 audit(1785494307.684:5538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.408141][ T42] audit: type=1326 audit(1785494307.684:5539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.419371][ T42] audit: type=1326 audit(1785494307.684:5540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24316 comm="syz.7.7865" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 711.468169][ T5877] usb 10-1: USB disconnect, device number 6 [ 711.531235][T24333] block2mtd: device name too long [ 712.154220][T24357] overlayfs: invalid origin (0000) [ 712.572097][T24368] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 712.585225][T24368] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 712.591431][T24368] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 712.678681][T24381] printk: legacy console [ttyGS0] disabled [ 713.745808][T24422] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7912'. [ 713.748919][T24422] netlink: 'syz.6.7912': attribute type 1 has an invalid length. [ 713.755533][T24422] macvlan1: entered allmulticast mode [ 713.757356][T24422] gretap0: entered allmulticast mode [ 714.427116][T24461] kvm: kvm [24460]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x4000008a) = 0x39 [ 714.600375][ T5773] Bluetooth: hci4: command 0x0c1a tx timeout [ 714.605143][ T5103] Bluetooth: hci2: command 0x0c1a tx timeout [ 714.614009][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 714.940559][ T5877] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 715.023829][T24482] lvs 1-0:1.0: Bind LVS driver with SS root Hub only [ 715.028317][T24482] lvs 1-0:1.0: probe with driver lvs failed with error -22 [ 715.173319][T24498] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7944'. [ 715.174274][T24499] netlink: 4 bytes leftover after parsing attributes in process `syz.6.7945'. [ 716.340653][ T42] kauditd_printk_skb: 5 callbacks suppressed [ 716.340667][ T42] audit: type=1326 audit(1785494312.724:5546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24534 comm="syz.5.7954" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf704efec code=0x0 [ 716.680126][ T5773] Bluetooth: hci2: command 0x0c1a tx timeout [ 716.690916][ T5773] Bluetooth: hci4: command 0x0c1a tx timeout [ 716.692088][ T5645] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 718.503393][T24615] uhci_hcd 0000:00:1d.0: remove, state 4 [ 718.511567][T24615] usb usb1: USB disconnect, device number 1 [ 718.599771][T24615] uhci_hcd 0000:00:1d.0: USB bus 1 deregistered [ 718.760132][ T5773] Bluetooth: hci4: command 0x0c1a tx timeout [ 718.760275][ T5103] Bluetooth: hci2: command 0x0c1a tx timeout [ 719.194948][ T5773] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 719.202288][ T5773] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 719.209518][ T5773] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 719.213571][ T5773] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 719.217093][ T5773] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 719.686628][ T5908] hid_parser_main: 68 callbacks suppressed [ 719.686645][ T5908] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 719.697720][ T5908] hid-generic 0000:0000:0000.000A: hidraw1: HID v0.00 Device [syz1] on syz0 [ 719.751274][T24670] fido_id[24670]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 719.871013][T24637] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.873616][T24637] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.876109][T24637] bridge_slave_0: entered allmulticast mode [ 719.878970][T24637] bridge_slave_0: entered promiscuous mode [ 719.883429][T24637] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.885793][T24637] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.888183][T24637] bridge_slave_1: entered allmulticast mode [ 719.892008][T24637] bridge_slave_1: entered promiscuous mode [ 719.910213][T24637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 719.916707][T24637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 719.932833][T24637] team0: Port device team_slave_0 added [ 719.936654][T24637] team0: Port device team_slave_1 added [ 719.950219][T24637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 719.952412][T24637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 719.961523][T24637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 719.966927][T24637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 719.969186][T24637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 719.977519][T24637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 720.001524][T24637] hsr_slave_0: entered promiscuous mode [ 720.003879][T24637] hsr_slave_1: entered promiscuous mode [ 720.006038][T24637] debugfs: 'hsr0' already exists in 'hsr' [ 720.007858][T24637] Cannot create hsr debugfs directory [ 720.144854][T24637] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 720.159245][T24637] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 720.163101][T24637] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 720.169292][T24637] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 720.173494][T24637] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 720.184163][T24637] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 720.187232][T24637] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 720.200886][T24637] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 720.222566][T24637] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.224896][T24637] bridge0: port 2(bridge_slave_1) entered forwarding state [ 720.227291][T24637] bridge0: port 1(bridge_slave_0) entered blocking state [ 720.229687][T24637] bridge0: port 1(bridge_slave_0) entered forwarding state [ 720.269813][T24637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 720.281704][ T38] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.284836][ T38] bridge0: port 2(bridge_slave_1) entered disabled state [ 720.312545][T24637] 8021q: adding VLAN 0 to HW filter on device team0 [ 720.321467][T16892] bridge0: port 1(bridge_slave_0) entered blocking state [ 720.323748][T16892] bridge0: port 1(bridge_slave_0) entered forwarding state [ 720.330457][T16892] bridge0: port 2(bridge_slave_1) entered blocking state [ 720.332756][T16892] bridge0: port 2(bridge_slave_1) entered forwarding state [ 720.340446][ T5908] usb 11-1: new high-speed USB device number 7 using dummy_hcd [ 720.490220][ T5908] usb 11-1: Using ep0 maxpacket: 8 [ 720.503123][ T5908] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 720.507457][ T5908] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 720.607451][T24637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 720.671366][T24721] dummy0: entered promiscuous mode [ 720.680858][T24721] dummy0: left promiscuous mode [ 720.885260][T24637] veth0_vlan: entered promiscuous mode [ 720.895502][T24637] veth1_vlan: entered promiscuous mode [ 720.916078][T24637] veth0_macvtap: entered promiscuous mode [ 720.924342][T24637] veth1_macvtap: entered promiscuous mode [ 720.958228][T24637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 720.978030][T24637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 721.051854][T17122] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.056306][T17122] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.066416][T17122] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.072131][T17122] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.196367][T16892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 721.198953][T16892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 721.236352][T16892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 721.240036][T16892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 721.240236][ T5103] Bluetooth: hci3: command tx timeout [ 721.970647][T24770] e1000e 0000:00:02.0 eth1: removed PHC [ 723.116992][ T5877] usb 11-1: USB disconnect, device number 7 [ 723.330253][ T5103] Bluetooth: hci3: command tx timeout [ 723.976227][T24850] input: syz0 as /devices/virtual/input/input53 [ 724.696483][T24900] loop5: detected capacity change from 0 to 7 [ 724.704940][T24900] Dev loop5: unable to read RDB block 7 [ 724.708430][T24900] loop5: unable to read partition table [ 724.710504][T24900] loop5: partition table beyond EOD, truncated [ 724.716250][T24900] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 724.898747][T24910] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 725.074489][T24916] block2mtd: error: cannot open device [ 725.400235][ T5103] Bluetooth: hci3: command tx timeout [ 726.155355][ T5773] Bluetooth: hci5: sending frame failed (-49) [ 726.157883][ T5103] Bluetooth: hci5: Entering manufacturer mode failed (-49) [ 726.339484][ T5103] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 726.346738][ T5103] CPU: 3 UID: 0 PID: 5103 Comm: kworker/u34:1 Tainted: G L syzkaller #0 PREEMPT(full) [ 726.346771][ T5103] Tainted: [L]=SOFTLOCKUP [ 726.346778][ T5103] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 726.346791][ T5103] Workqueue: hci3 hci_rx_work [ 726.346822][ T5103] Call Trace: [ 726.346828][ T5103] [ 726.346837][ T5103] dump_stack_lvl+0x100/0x190 [ 726.346862][ T5103] sysfs_warn_dup.cold+0x1c/0x28 [ 726.346891][ T5103] sysfs_create_dir_ns+0x24b/0x2b0 [ 726.346919][ T5103] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 726.346943][ T5103] ? find_held_lock+0x2b/0x80 [ 726.346967][ T5103] ? kobject_add_internal+0x25f/0x930 [ 726.346997][ T5103] ? kobject_add_internal+0x25f/0x930 [ 726.347057][ T5103] ? do_raw_spin_unlock+0x145/0x1e0 [ 726.347082][ T5103] kobject_add_internal+0x2c8/0x930 [ 726.347117][ T5103] kobject_add+0x16a/0x1e0 [ 726.347147][ T5103] ? __pfx_kobject_add+0x10/0x10 [ 726.347174][ T5103] ? class_to_subsys+0x10f/0x150 [ 726.347198][ T5103] ? kobject_put+0xb9/0x640 [ 726.347224][ T5103] ? _raw_spin_unlock+0x28/0x50 [ 726.347250][ T5103] device_add+0x294/0x1970 [ 726.347281][ T5103] ? __pfx_dev_set_name+0x10/0x10 [ 726.347302][ T5103] ? __pfx_device_add+0x10/0x10 [ 726.347331][ T5103] ? mgmt_send_event_skb+0x2fb/0x460 [ 726.347363][ T5103] hci_conn_add_sysfs+0x1a3/0x260 [ 726.347390][ T5103] le_conn_complete_evt+0x11eb/0x1f60 [ 726.347420][ T5103] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 726.347440][ T5103] ? hci_event_packet+0x186/0xcd0 [ 726.347467][ T5103] hci_le_conn_complete_evt+0x23c/0x3a0 [ 726.347490][ T5103] ? skb_pull_data+0x15f/0x1e0 [ 726.347516][ T5103] hci_le_meta_evt+0x34a/0x5f0 [ 726.347540][ T5103] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 726.347568][ T5103] hci_event_packet+0x51c/0xcd0 [ 726.347593][ T5103] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 726.347618][ T5103] ? __pfx_hci_event_packet+0x10/0x10 [ 726.347645][ T5103] ? kcov_remote_start+0x384/0x670 [ 726.347670][ T5103] ? lockdep_hardirqs_on+0x78/0x100 [ 726.347698][ T5103] hci_rx_work+0x451/0xfc0 [ 726.347726][ T5103] process_one_work+0xa23/0x1940 [ 726.347766][ T5103] ? __pfx_process_one_work+0x10/0x10 [ 726.347801][ T5103] ? __pfx_hci_rx_work+0x10/0x10 [ 726.347825][ T5103] worker_thread+0x5ef/0xe50 [ 726.347859][ T5103] ? __pfx_worker_thread+0x10/0x10 [ 726.347886][ T5103] ? kthread+0x13a/0x450 [ 726.347911][ T5103] ? __pfx_worker_thread+0x10/0x10 [ 726.347935][ T5103] kthread+0x370/0x450 [ 726.347955][ T5103] ? __pfx_kthread+0x10/0x10 [ 726.347980][ T5103] ret_from_fork+0x72b/0xd50 [ 726.348006][ T5103] ? __pfx_ret_from_fork+0x10/0x10 [ 726.348035][ T5103] ? __switch_to+0x800/0x10f0 [ 726.348067][ T5103] ? __pfx_kthread+0x10/0x10 [ 726.348093][ T5103] ret_from_fork_asm+0x1a/0x30 [ 726.348134][ T5103] [ 726.348206][ T5103] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 726.456667][ T5103] Bluetooth: hci3: failed to register connection device [ 726.713333][T24960] bond0: invalid NS target ff00:: specified for addition [ 726.716444][T24960] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 726.822104][T24965] binder: 24963:24965 ioctl c0306201 800001c0 returned -14 [ 727.480000][ T5773] Bluetooth: hci3: command tx timeout [ 728.100543][T25013] input: syz1 as /devices/virtual/input/input54 [ 728.295535][T25024] netlink: 'syz.7.8137': attribute type 3 has an invalid length. [ 728.825927][T25045] netlink: 48 bytes leftover after parsing attributes in process `syz.8.8147'. [ 728.902561][T25051] netlink: 68 bytes leftover after parsing attributes in process `syz.5.8150'. [ 728.905391][T25051] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8150'. [ 728.908759][T25051] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8150'. [ 729.103014][T25065] overlayfs: upper fs does not support file handles, falling back to index=off. [ 729.203801][T25072] [U] [ 729.206026][T25072] [U] [ 729.206960][T25072] [U] [ 729.207867][T25072] [U] [ 729.208801][T25072] [U] [ 729.209687][T25072] [U] [ 729.210593][T25072] [U] [ 729.211503][T25072] [U] [ 729.213542][T25072] [U] [ 729.214493][T25072] [U] [ 729.215400][T25072] [U] [ 729.216293][T25072] [U] [ 729.217178][T25072] [U] [ 729.218055][T25072] [U] [ 729.218950][T25072] [U] [ 729.219996][T25072] [U] [ 729.221623][T25072] [U] [ 729.222769][T25072] [U] [ 729.223902][T25072] [U] [ 729.225009][T25072] [U] [ 729.226085][T25072] [U] [ 729.227245][T25072] [U] [ 729.228385][T25072] [U] [ 729.229304][T25072] [U] [ 729.232135][T25072] [U] [ 729.233072][T25072] [U] [ 729.234000][T25072] [U] [ 729.235125][T25072] [U] [ 729.236184][T25072] [U] [ 729.237090][T25072] [U] [ 729.238000][T25072] [U] [ 729.239069][T25072] [U] [ 729.241342][T25072] [U] [ 729.242283][T25072] [U] [ 729.243219][T25072] [U] [ 729.244160][T25072] [U] [ 729.245061][T25072] [U] [ 729.245963][T25072] [U] [ 729.246880][T25072] [U] [ 729.247784][T25072] [U] [ 729.249131][T25072] [U] [ 729.250074][T25072] [U] [ 729.250988][T25072] [U] [ 729.251912][T25072] [U] [ 729.252813][T25072] [U] [ 729.253715][T25072] [U] [ 729.254621][T25072] [U] [ 729.255635][T25072] [U] [ 729.257700][T25072] [U] [ 729.258664][T25072] [U] [ 729.259569][T25072] [U] [ 729.260476][T25072] [U] [ 729.261470][T25072] [U] [ 729.262594][T25072] [U] [ 729.263705][T25072] [U] [ 729.264819][T25072] [U] [ 729.265780][T16853] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 729.266711][T25072] [U] [ 729.269213][T25072] [U] [ 729.270113][T25072] [U] [ 729.270654][ T5877] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 729.271009][T25072] [U] [ 729.275717][T25072] [U] [ 729.276654][T25072] [U] [ 729.277561][T25072] [U] [ 729.278468][T25072] [U] [ 729.280267][T25072] [U] [ 729.281188][T25072] [U] [ 729.282125][T25072] [U] [ 729.283059][T25072] [U] [ 729.283952][T25072] [U] [ 729.284838][T25072] [U] [ 729.285731][T25072] [U] [ 729.286639][T25072] [U] [ 729.287587][T25072] [U] [ 729.288519][T25072] [U] [ 729.289419][T25072] [U] [ 729.290340][T25072] [U] [ 729.291249][T25072] [U] [ 729.292162][T25072] [U] [ 729.293047][T25072] [U] [ 729.293947][T25072] [U] [ 729.296536][T25072] [U] [ 729.297842][T25072] [U] [ 729.298976][T25072] [U] [ 729.299881][T25072] [U] [ 729.300766][T25072] [U] [ 729.301783][T25072] [U] [ 729.302902][T25072] [U] [ 729.304000][T25072] [U] [ 729.305929][T25072] [U] [ 729.307085][T25072] [U] [ 729.307982][T25072] [U] [ 729.308904][T25072] [U] [ 729.309789][T25072] [U] [ 729.310705][T25072] [U] [ 729.311584][T25072] [U] [ 729.312489][T25072] [U] [ 729.314383][T25072] [U] [ 729.315302][T25072] [U] [ 729.316208][T25072] [U] [ 729.317243][T25072] [U] [ 729.318348][T25072] [U] [ 729.319193][T25072] [U] [ 729.320220][T25072] [U] [ 729.321292][T25072] [U] [ 729.323504][T25072] [U] [ 729.324594][T25072] [U] [ 729.325633][T25072] [U] [ 729.326543][T25072] [U] [ 729.327427][T25072] [U] [ 729.328525][T25072] [U] [ 729.329564][T25072] [U] [ 729.330655][T25072] [U] [ 729.332974][T25072] [U] [ 729.334126][T25072] [U] [ 729.335228][T25072] [U] [ 729.336318][T25072] [U] [ 729.337403][T25072] [U] [ 729.338528][T25072] [U] [ 729.339605][T25072] [U] [ 729.340673][T25072] [U] [ 729.343117][T25072] [U] [ 729.344267][T25072] [U] [ 729.345359][T25072] [U] [ 729.346456][T25072] [U] [ 729.347542][T25072] [U] [ 729.348655][T25072] [U] [ 729.349738][T25072] [U] [ 729.380613][T25071] [U] [ 729.445749][T16853] usb 13-1: Using ep0 maxpacket: 8 [ 729.486962][T16853] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 729.493410][T16853] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 729.496456][T16853] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 729.499501][T16853] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 729.521670][T16853] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 729.532450][T16853] usb 13-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 729.542145][T16853] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 731.140361][T19110] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 731.361649][T25126] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 731.375588][T25126] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8180'. [ 731.426758][T25135] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8183'. [ 731.465223][T25137] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8184'. [ 731.893073][ T5911] usb 13-1: USB disconnect, device number 2 [ 732.879366][T25173] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8193'. [ 733.068716][T25184] batman_adv: batadv0: Interface deactivated: dummy0 [ 733.107241][T25184] batman_adv: batadv0: Removing interface: dummy0 [ 733.200018][T16853] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 733.262279][T25186] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 733.349997][T16853] usb 12-1: Using ep0 maxpacket: 8 [ 733.352934][T16853] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 733.356605][T16853] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 733.360706][T16853] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 733.364499][T16853] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 733.368684][T16853] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 733.372231][T16853] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 733.923477][T25211] netlink: 16 bytes leftover after parsing attributes in process `syz.8.8210'. [ 733.971443][T25215] CacheFiles: Failed to register: -95 [ 734.612601][T12484] kernel read not supported for file /kmsg (pid: 12484 comm: kworker/2:10) [ 734.977931][T25270] syzkaller1: entered promiscuous mode [ 734.980528][T25270] syzkaller1: entered allmulticast mode [ 735.106187][T25272] netlink: 'syz.8.8238': attribute type 1 has an invalid length. [ 735.109597][T25272] netlink: 193500 bytes leftover after parsing attributes in process `syz.8.8238'. [ 735.114397][T25272] netlink: 'syz.8.8238': attribute type 1 has an invalid length. [ 735.117852][T25272] netlink: 2016 bytes leftover after parsing attributes in process `syz.8.8238'. [ 735.977759][ T5908] usb 12-1: USB disconnect, device number 4 [ 737.006841][T25320] can0: slcan on ptm0. [ 737.112457][T25319] can0 (unregistered): slcan off ptm0. [ 737.140026][T16853] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 737.310773][T16853] usb 10-1: Using ep0 maxpacket: 16 [ 737.313861][T16853] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 737.318895][T16853] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 737.326047][T16853] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 737.329258][T16853] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 737.332612][T16853] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 737.337838][T16853] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 737.343407][T16853] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 737.346440][T16853] usb 10-1: Manufacturer: syz [ 737.603135][ T42] audit: type=1326 audit(1785494589.976:5547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25350 comm="syz.8.8270" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70befec code=0x0 [ 738.914740][ T42] audit: type=1326 audit(1785494591.286:5548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25374 comm="syz.8.8279" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf70befec code=0x0 [ 739.006511][T25379] loop8: detected capacity change from 0 to 7 [ 739.009631][T25379] Dev loop8: unable to read RDB block 7 [ 739.011982][T25379] loop8: unable to read partition table [ 739.014162][T25379] loop8: partition table beyond EOD, truncated [ 739.016495][T25379] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 739.118034][ T5773] Bluetooth: hci2: Invalid handle: 0xffc9 > 0x0eff [ 739.825340][ T5773] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 739.844076][ T5773] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 739.848453][ T5773] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 739.855352][ T5773] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 739.858811][ T5773] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 739.943976][T25394] overlayfs: upper fs does not support file handles, falling back to index=off. [ 739.947739][ T5908] usb 10-1: USB disconnect, device number 7 [ 740.131268][T25407] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 740.155054][T12484] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 740.280989][ T5773] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 740.612012][T25388] bridge0: port 1(bridge_slave_0) entered blocking state [ 740.614734][T25388] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.617230][T25388] bridge_slave_0: entered allmulticast mode [ 740.621602][T25388] bridge_slave_0: entered promiscuous mode [ 740.627677][T25388] bridge0: port 2(bridge_slave_1) entered blocking state [ 740.630187][T25388] bridge0: port 2(bridge_slave_1) entered disabled state [ 740.632684][T25388] bridge_slave_1: entered allmulticast mode [ 740.636176][T25388] bridge_slave_1: entered promiscuous mode [ 740.663709][T25388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 740.671345][T25388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 740.694108][T25388] team0: Port device team_slave_0 added [ 740.697791][T25388] team0: Port device team_slave_1 added [ 740.719360][T25388] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 740.722211][T25388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 740.731680][T25388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 740.737726][T25388] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 740.740678][T25388] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 740.751481][T25388] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 740.784272][T25388] hsr_slave_0: entered promiscuous mode [ 740.787289][T25388] hsr_slave_1: entered promiscuous mode [ 740.790378][T25388] debugfs: 'hsr0' already exists in 'hsr' [ 740.792715][T25388] Cannot create hsr debugfs directory [ 740.979427][T25388] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 740.987768][T25388] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 740.991684][T25388] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 741.001487][T25388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 741.005247][T25388] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 741.012825][T12484] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 741.025680][T25388] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 741.029524][T25388] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 741.037465][T25388] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 741.053872][T25388] bridge0: port 2(bridge_slave_1) entered blocking state [ 741.056975][T25388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 741.060269][T25388] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.063280][T25388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 741.113435][T25388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 741.128921][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 741.138488][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 741.161872][T25440] overlayfs: upper fs does not support file handles, falling back to index=off. [ 741.176857][T25444] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input55 [ 741.182091][T25388] 8021q: adding VLAN 0 to HW filter on device team0 [ 741.236337][ T162] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.239355][ T162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 741.267001][ T162] bridge0: port 2(bridge_slave_1) entered blocking state [ 741.269969][ T162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 741.820730][T25388] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 741.880166][ T5103] Bluetooth: hci5: command tx timeout [ 741.999295][T25388] veth0_vlan: entered promiscuous mode [ 742.006669][T25388] veth1_vlan: entered promiscuous mode [ 742.027211][T25388] veth0_macvtap: entered promiscuous mode [ 742.032415][T25388] veth1_macvtap: entered promiscuous mode [ 742.045792][T25388] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 742.053092][T25388] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 742.090078][ T12] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.111189][ T5837] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.114868][ T5837] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.117973][ T5837] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.128254][ T81] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.132778][ T81] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.150876][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.154379][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.234417][T25483] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8315'. [ 742.293705][T25488] overlayfs: upper fs does not support file handles, falling back to index=off. [ 742.443795][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.450336][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.455821][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.461579][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.469195][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.472457][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.478441][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.485234][ T34] hid-generic 0006:0008:0001.000B: unknown main item tag 0x0 [ 742.492477][ T34] hid-generic 0006:0008:0001.000B: hidraw1: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 742.541630][T25501] fido_id[25501]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 743.220182][ T34] usb 14-1: new low-speed USB device number 2 using dummy_hcd [ 743.375358][ T34] usb 14-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 743.381957][ T34] usb 14-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 743.385885][ T34] usb 14-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 743.389353][ T34] usb 14-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 743.392516][ T34] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 743.960341][ T5103] Bluetooth: hci5: command tx timeout [ 744.724892][T25558] zero sized request [ 745.956791][T16853] usb 14-1: USB disconnect, device number 2 [ 746.039942][ T5103] Bluetooth: hci5: command tx timeout [ 746.929776][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.931996][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.130024][ T5103] Bluetooth: hci5: command tx timeout [ 750.663198][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.669147][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.672815][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.678508][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.682633][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.687482][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.696003][T25619] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.720370][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.727943][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.959989][ C3] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.103227][T25638] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.106763][T25638] bridge0: port 1(bridge_slave_0) entered disabled state [ 755.563744][T25683] bridge_slave_0: left allmulticast mode [ 755.568371][T25683] bridge_slave_0: left promiscuous mode [ 755.570988][T25683] bridge0: port 1(bridge_slave_0) entered disabled state [ 755.617963][T25683] bridge_slave_1: left allmulticast mode [ 755.623758][T25683] bridge_slave_1: left promiscuous mode [ 755.630467][T25683] bridge0: port 2(bridge_slave_1) entered disabled state [ 755.647878][T25689] input: syz1 as /devices/virtual/input/input56 [ 755.675425][T25683] bond0: (slave bond_slave_0): Releasing backup interface [ 755.703213][T25683] bond0: (slave bond_slave_1): Releasing backup interface [ 755.715338][T25693] loop4: detected capacity change from 0 to 7 [ 755.718867][T25693] Dev loop4: unable to read RDB block 7 [ 755.721689][T25693] loop4: unable to read partition table [ 755.724293][T25693] loop4: partition table beyond EOD, truncated [ 755.729318][T25693] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 755.734646][T25683] team0: Port device team_slave_0 removed [ 755.758959][T25683] team0: Port device team_slave_1 removed [ 755.762951][T25683] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 755.766046][T25683] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 755.784869][T25683] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 755.788003][T25683] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 755.797770][T25683] net_ratelimit: 122 callbacks suppressed [ 755.797782][T25683] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 755.827943][T25699] ipvlan1: entered promiscuous mode [ 755.830428][T25699] ipvlan1: entered allmulticast mode [ 755.832788][T25699] gretap0: entered allmulticast mode [ 755.836111][T25699] team0: Device ipvlan1 failed to register rx_handler [ 755.880247][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.981833][ T5877] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.165182][T25709] printk: legacy console [ttyGS0] disabled [ 756.360850][ T5911] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.526466][ T5911] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.780375][T25731] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 756.783003][T25731] IPv6: NLM_F_CREATE should be set when creating new route [ 756.932592][T25739] lo: entered promiscuous mode [ 756.934402][T25739] lo: entered allmulticast mode [ 756.944979][T25739] tunl0: entered promiscuous mode [ 756.949327][T25739] tunl0: entered allmulticast mode [ 756.954672][T25739] gre0: entered promiscuous mode [ 756.956400][T25739] gre0: entered allmulticast mode [ 756.961492][T25739] gretap0: entered promiscuous mode [ 756.963599][T25739] gretap0: entered allmulticast mode [ 756.966855][T25739] erspan0: entered promiscuous mode [ 756.968679][T25739] erspan0: entered allmulticast mode [ 756.977585][T25739] ip_vti0: entered promiscuous mode [ 756.983713][T25739] ip_vti0: entered allmulticast mode [ 756.990022][T25739] ip6_vti0: entered promiscuous mode [ 756.993067][T25739] ip6_vti0: entered allmulticast mode [ 756.996788][T25739] sit0: entered promiscuous mode [ 756.999376][T25739] sit0: entered allmulticast mode [ 757.004299][T25739] ip6tnl0: entered promiscuous mode [ 757.006712][T25739] ip6tnl0: entered allmulticast mode [ 757.010769][T25739] ip6gre0: entered promiscuous mode [ 757.013046][T25739] ip6gre0: entered allmulticast mode [ 757.016547][T25739] syz_tun: entered promiscuous mode [ 757.019025][T25739] syz_tun: entered allmulticast mode [ 757.023236][T25739] ip6gretap0: entered promiscuous mode [ 757.025670][T25739] ip6gretap0: entered allmulticast mode [ 757.029563][T25739] bridge0: entered promiscuous mode [ 757.032469][T25739] bridge0: entered allmulticast mode [ 757.610786][ T5911] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.968772][T25783] netlink: 8 bytes leftover after parsing attributes in process `syz.9.8438'. [ 758.110864][T12479] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 758.273086][T12479] usb 12-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 758.286605][T12479] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 758.294912][T12479] usb 12-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 758.305157][T12479] usb 12-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 758.309779][T12479] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 758.317356][T12479] usb 12-1: Product: syz [ 758.321728][T12479] usb 12-1: Manufacturer: syz [ 758.324377][T12479] usb 12-1: SerialNumber: syz [ 758.693327][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.115795][T25820] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.123963][T25820] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.127864][T25820] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 760.465919][ T5837] tipc: Subscription rejected, illegal request [ 760.571904][T25848] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 760.889696][T12484] usb 12-1: USB disconnect, device number 5 [ 761.106238][T25868] netlink: 8 bytes leftover after parsing attributes in process `syz.7.8480'. [ 761.111352][T25868] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8480'. [ 761.152513][ T5837] netdevsim netdevsim7 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.164205][ T5837] netdevsim netdevsim7 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.173901][ T5837] netdevsim netdevsim7 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.180193][ T5837] netdevsim netdevsim7 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 761.489803][T25884] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 761.510715][T25884] CPU: 3 UID: 0 PID: 25884 Comm: syz.9.8486 Tainted: G L syzkaller #0 PREEMPT(full) [ 761.510750][T25884] Tainted: [L]=SOFTLOCKUP [ 761.510756][T25884] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 761.510768][T25884] Call Trace: [ 761.510776][T25884] [ 761.510785][T25884] dump_stack_lvl+0x100/0x190 [ 761.510815][T25884] sysfs_warn_dup.cold+0x1c/0x28 [ 761.510847][T25884] sysfs_create_dir_ns+0x24b/0x2b0 [ 761.510876][T25884] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 761.510904][T25884] ? find_held_lock+0x2b/0x80 [ 761.510930][T25884] ? kobject_add_internal+0x25f/0x930 [ 761.510963][T25884] ? kobject_add_internal+0x25f/0x930 [ 761.510996][T25884] ? class_dir_child_ns_type+0xd/0x60 [ 761.511048][T25884] kobject_add_internal+0x2c8/0x930 [ 761.511086][T25884] kobject_add+0x16a/0x1e0 [ 761.511118][T25884] ? __pfx_kobject_add+0x10/0x10 [ 761.511152][T25884] ? get_device_parent+0x1b3/0x4c0 [ 761.511182][T25884] ? kobject_put+0xb9/0x640 [ 761.511218][T25884] device_add+0x294/0x1970 [ 761.511248][T25884] ? lockdep_init_map_type+0x5c/0x250 [ 761.511267][T25884] ? __pfx_device_add+0x10/0x10 [ 761.511295][T25884] ? lockdep_init_map_type+0x5c/0x250 [ 761.511314][T25884] ? __init_waitqueue_head+0xca/0x150 [ 761.511343][T25884] tty_register_device_attr+0x388/0x7f0 [ 761.511378][T25884] ? lockdep_init_map_type+0x5c/0x250 [ 761.511397][T25884] ? __pfx_tty_register_device_attr+0x10/0x10 [ 761.511430][T25884] ? tty_port_init+0x156/0x1c0 [ 761.511462][T25884] gsm_activate_mux+0x155/0x2a0 [ 761.511491][T25884] gsmld_ioctl+0xbbc/0x15c0 [ 761.511517][T25884] ? __pfx_gsmld_ioctl+0x10/0x10 [ 761.511556][T25884] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 761.511591][T25884] ? __pfx_gsmld_ioctl+0x10/0x10 [ 761.511607][T25884] tty_compat_ioctl+0x396/0x420 [ 761.511634][T25884] ? __pfx_tty_compat_ioctl+0x10/0x10 [ 761.511660][T25884] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 761.511693][T25884] __do_fast_syscall_32+0xe7/0x970 [ 761.511723][T25884] do_fast_syscall_32+0x32/0x70 [ 761.511749][T25884] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 761.511772][T25884] RIP: 0023:0xf7f73fec [ 761.511795][T25884] Code: Unable to access opcode bytes at 0xf7f73fc2. [ 761.511804][T25884] RSP: 002b:00000000f541550c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 761.511824][T25884] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000404c4701 [ 761.511835][T25884] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 761.511846][T25884] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 761.511856][T25884] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 761.511867][T25884] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 761.511893][T25884] [ 761.511952][T25884] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 761.760850][T25891] veth1_to_bond: entered allmulticast mode [ 761.800471][T16853] net_ratelimit: 1030 callbacks suppressed [ 761.800491][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.801705][T25891] veth1_to_bond: left allmulticast mode [ 762.600091][T12485] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.690257][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.696914][ C2] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.840254][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.891592][T25924] netlink: 16 bytes leftover after parsing attributes in process `syz.7.8503'. [ 763.455807][T25947] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 763.903808][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.932397][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.969299][T16853] libceph: connect (1)[c::]:6789 error -101 [ 764.972848][T16853] libceph: mon0 (1)[c::]:6789 connect error [ 765.013707][T25976] ceph: No mds server is up or the cluster is laggy [ 765.512159][ T5877] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.644543][T12484] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.061699][ T42] audit: type=1326 audit(1785494618.436:5549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25997 comm="syz.5.8531" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf704efec code=0x0 [ 767.021573][T16853] net_ratelimit: 2 callbacks suppressed [ 767.021590][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.373717][ T5911] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 767.422482][T26029] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 767.561936][T16853] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 767.573410][T26037] netlink: 83 bytes leftover after parsing attributes in process `syz.7.8547'. [ 767.960009][T24468] Bluetooth: hci2: command 0x0c1a tx timeout [ 768.040781][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.649380][T26063] netlink: 12 bytes leftover after parsing attributes in process `syz.5.8558'. [ 768.684244][T12484] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 768.873068][ T42] audit: type=1800 audit(1785494621.246:5550): pid=26070 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.8561" name="dummy_udc" dev="gadgetfs" ino=7993 res=0 errno=0 [ 769.081520][ T5851] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.243555][ T5103] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 769.526819][T26084] syzkaller1: entered promiscuous mode [ 769.528692][T26084] syzkaller1: entered allmulticast mode [ 769.710262][T26086] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 769.870839][T26094] netlink: 20 bytes leftover after parsing attributes in process `syz.5.8572'. [ 769.897232][ T42] audit: type=1326 audit(1785494622.266:5551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26090 comm="syz.7.8571" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf709efec code=0x0 [ 769.934393][T26098] netlink: 8 bytes leftover after parsing attributes in process `syz.9.8573'. [ 770.050552][ T5103] Bluetooth: hci2: command 0x0c1a tx timeout [ 770.139539][ T5851] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.364791][T26111] mtrr: base(0x61616161000) is not aligned on a size(0x61616161000) boundary [ 770.676963][T26108] sr 2:0:0:0: [sr0] CDROM not ready. Make sure there is a disc in the drive. [ 770.890665][T26128] overlayfs: failed lookup in lower (newroot/1106, name='file0', err=-40): overlapping layers [ 771.160565][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.240197][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.244535][T12485] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.291970][ T5877] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.658850][ T5103] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 771.672537][ T5103] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 771.677193][ T5103] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 771.681332][ T5103] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 771.687094][ T5103] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 772.200353][ T5851] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.298887][T26175] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 772.301411][T26173] overlayfs: failed to decode file handle (len=8, type=251, flags=0, err=-22) [ 772.443160][T26184] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.447372][T26184] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.454186][T26186] overlayfs: failed to decode file handle (len=5, type=0, flags=0, err=-22) [ 772.458564][T26184] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.468113][T26184] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.481874][T26184] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.491124][T26183] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.722466][T26149] bridge0: port 1(bridge_slave_0) entered blocking state [ 772.727042][T26149] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.737634][T26149] bridge_slave_0: entered allmulticast mode [ 772.743412][T26149] bridge_slave_0: entered promiscuous mode [ 772.752293][T26149] bridge0: port 2(bridge_slave_1) entered blocking state [ 772.758290][T26149] bridge0: port 2(bridge_slave_1) entered disabled state [ 772.762848][T26149] bridge_slave_1: entered allmulticast mode [ 772.767958][T26149] bridge_slave_1: entered promiscuous mode [ 772.794757][T26149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 772.799352][T26149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 772.817342][T26149] team0: Port device team_slave_0 added [ 772.820844][T26149] team0: Port device team_slave_1 added [ 772.835764][T26149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 772.837975][T26149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 772.849732][T26149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 772.855880][T26149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 772.858628][T26149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 772.868781][T26149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 772.898410][T26149] hsr_slave_0: entered promiscuous mode [ 772.904623][T26149] hsr_slave_1: entered promiscuous mode [ 772.906871][T26149] debugfs: 'hsr0' already exists in 'hsr' [ 772.908703][T26149] Cannot create hsr debugfs directory [ 772.911794][T26205] syzkaller1: entered promiscuous mode [ 772.913611][T26205] syzkaller1: entered allmulticast mode [ 773.115601][T26149] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.120616][T26149] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.228545][T26149] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.232944][T26149] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.263112][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.334616][T26149] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.337803][T26149] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.516185][T26149] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.523686][T26149] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.734677][T26149] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 773.752562][T26149] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 773.758624][T26149] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 773.774002][T26149] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 773.784524][T26149] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 773.799060][T26149] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 773.800453][ T5103] Bluetooth: hci6: command tx timeout [ 773.808599][T12484] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.841204][T26149] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 773.860316][T26149] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 773.914910][T26149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 773.941834][T26149] 8021q: adding VLAN 0 to HW filter on device team0 [ 773.952338][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 773.954644][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 773.964411][ T5773] Bluetooth: hci1: command 0x0c1a tx timeout [ 773.964498][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 773.969082][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 774.278017][T26149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 774.281016][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.312032][T26149] veth0_vlan: entered promiscuous mode [ 774.324691][T26149] veth1_vlan: entered promiscuous mode [ 774.350531][T26149] veth0_macvtap: entered promiscuous mode [ 774.355204][T26149] veth1_macvtap: entered promiscuous mode [ 774.383700][T26149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 774.396010][T26149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 774.473714][T17122] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 774.484233][T17122] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 774.516343][ T5837] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 774.522027][ T5837] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 774.527428][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 774.532896][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 774.593092][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 774.597395][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 774.695579][T26241] loop5: detected capacity change from 0 to 7 [ 774.698491][ C1] blk_print_req_error: 6 callbacks suppressed [ 774.698501][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.703730][ C1] buffer_io_error: 6 callbacks suppressed [ 774.703741][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.711678][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.714728][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.717315][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.720409][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.726991][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.730541][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.734028][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.737934][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.741805][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.744876][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.747495][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.750867][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.754560][T26241] ldm_validate_partition_table(): Disk read failed. [ 774.758777][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.763665][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.766719][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.769430][ C2] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 774.772560][ C2] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.775267][ C1] Buffer I/O error on dev loop5, logical block 0, async page read [ 774.778167][T26241] Dev loop5: unable to read RDB block 0 [ 774.781862][T26241] loop5: unable to read partition table [ 774.783992][T26241] loop5: partition table beyond EOD, truncated [ 774.786346][T26241] loop_reread_partitions: partition scan of loop5 (Wý* %4FLQk݊5) failed (rc=-5) [ 774.855201][ T42] audit: type=1326 audit(1785494627.226:5552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.866675][ T42] audit: type=1326 audit(1785494627.226:5553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.873621][ T42] audit: type=1326 audit(1785494627.226:5554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=430 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.883277][ T42] audit: type=1326 audit(1785494627.226:5555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.894554][ T42] audit: type=1326 audit(1785494627.226:5556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.904024][ T42] audit: type=1326 audit(1785494627.236:5557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=431 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.913784][ T42] audit: type=1326 audit(1785494627.236:5558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.920621][ T42] audit: type=1326 audit(1785494627.236:5559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.927565][ T42] audit: type=1326 audit(1785494627.236:5560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=432 compat=1 ip=0xf709efec code=0x7ffc0000 [ 774.934269][ T42] audit: type=1326 audit(1785494627.236:5561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26254 comm="syz.7.8628" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x7ffc0000 [ 775.136910][T26268] batadv_slave_1: entered promiscuous mode [ 775.140659][T26267] batadv_slave_1: left promiscuous mode [ 775.497751][T26279] netlink: 762 bytes leftover after parsing attributes in process `syz.0.8642'. [ 775.890095][ T5103] Bluetooth: hci6: command tx timeout [ 775.921763][T26302] syzkaller1: entered promiscuous mode [ 775.923666][T26302] syzkaller1: entered allmulticast mode [ 777.391163][ T24] net_ratelimit: 3 callbacks suppressed [ 777.391178][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.630832][ T5911] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.970187][ T5103] Bluetooth: hci6: command tx timeout [ 778.240125][T12479] usb 12-1: new full-speed USB device number 6 using dummy_hcd [ 778.403026][T12479] usb 12-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 778.409638][T12479] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 778.420190][T12479] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 778.433164][T12479] usb 12-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 778.440308][T12479] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 778.447264][T12479] usb 12-1: Product: syz [ 778.460000][T12479] usb 12-1: Manufacturer: syz [ 778.477040][T12479] usb 12-1: SerialNumber: syz [ 778.561137][T26365] IPv6: A: Disabled Multicast RS [ 778.698895][T16853] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.370956][T26377] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 779.636951][T26387] syzkaller1: entered promiscuous mode [ 779.638799][T26387] syzkaller1: entered allmulticast mode [ 779.731093][ T5911] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.912658][ T5645] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 779.993690][T26394] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 779.998714][T26394] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 780.002212][T26394] CPU: 2 UID: 0 PID: 26394 Comm: syz.0.8690 Tainted: G L syzkaller #0 PREEMPT(full) [ 780.006682][T26394] Tainted: [L]=SOFTLOCKUP [ 780.008519][T26394] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 780.012719][T26394] RIP: 0010:dummy_udc_start+0x91/0x1d0 [ 780.014908][T26394] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 [ 780.021570][T26394] RSP: 0018:ffffc900074cfb28 EFLAGS: 00010246 [ 780.023415][T26394] RAX: dffffc0000000000 RBX: ffff88802107cc00 RCX: ffffc90035a0d000 [ 780.025738][T26394] RDX: 0000000000000000 RSI: ffffffff87ce6aa7 RDI: ffff88802107d290 [ 780.028829][T26394] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000005 [ 780.031581][T26394] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888055e14050 [ 780.034665][T26394] R13: 0000000000000000 R14: ffff8880298c34f1 R15: ffff8880298c3008 [ 780.037876][T26394] FS: 0000000000000000(0000) GS:ffff888096de1000(0063) knlGS:00000000f53acb40 [ 780.040964][T26394] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 780.043036][T26394] CR2: 00000000f53a9edc CR3: 00000000768b2000 CR4: 0000000000352ef0 [ 780.045510][T26394] DR0: 000000006000003f DR1: 0000000000000000 DR2: 0000000000000000 [ 780.048022][T26394] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 780.050534][T26394] Call Trace: [ 780.051601][T26394] [ 780.052549][T26394] gadget_bind_driver+0x4ac/0xbf0 [ 780.054149][T26394] ? __pfx_gadget_bind_driver+0x10/0x10 [ 780.055879][T26394] really_probe+0x241/0xa60 [ 780.057320][T26394] __driver_probe_device+0x20e/0x450 [ 780.059045][T26394] driver_probe_device+0x4a/0x140 [ 780.061038][T26394] __driver_attach+0x21f/0x5b0 [ 780.062845][T26394] ? __pfx___driver_attach+0x10/0x10 [ 780.064488][T26394] bus_for_each_dev+0x13e/0x1d0 [ 780.066071][T26394] ? __pfx_bus_for_each_dev+0x10/0x10 [ 780.068237][T26394] ? bus_add_driver+0x2b5/0x5b0 [ 780.070223][T26394] bus_add_driver+0x305/0x5b0 [ 780.072216][T26394] driver_register+0x1e2/0x360 [ 780.073889][T26394] ? rcu_is_watching+0x12/0xc0 [ 780.075437][T26394] usb_gadget_register_driver_owner+0x132/0x210 [ 780.077546][T26394] raw_ioctl+0x1a85/0x2b80 [ 780.079499][T26394] ? __pfx_raw_ioctl+0x10/0x10 [ 780.081098][T26394] ? __pfx_raw_ioctl+0x10/0x10 [ 780.082615][T26394] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 780.084324][T26394] __do_fast_syscall_32+0xe7/0x970 [ 780.085929][T26394] do_fast_syscall_32+0x32/0x70 [ 780.087470][T26394] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 780.089506][T26394] RIP: 0023:0xf6fdefec [ 780.090804][T26394] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 780.092983][T26394] RSP: 002b:00000000f53aa424 EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 780.095610][T26394] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000005501 [ 780.098110][T26394] RDX: 0000000000000000 RSI: 00000000f73a7ff4 RDI: 00000000f53ab4c0 [ 780.100586][T26394] RBP: 00000000f73a7ff4 R08: 0000000000000000 R09: 0000000000000000 [ 780.103068][T26394] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 780.105537][T26394] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 780.108528][T26394] [ 780.109698][T26394] Modules linked in: [ 780.111739][T26394] ---[ end trace 0000000000000000 ]--- [ 780.116181][ T5103] Bluetooth: hci6: command tx timeout [ 780.186520][T26394] RIP: 0010:dummy_udc_start+0x91/0x1d0 [ 780.193587][T26394] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 28 01 00 00 4c 8b ab 90 06 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 10 01 00 00 83 ed 01 bf 02 00 00 00 49 8b 5d 00 [ 780.201049][T26394] RSP: 0018:ffffc900074cfb28 EFLAGS: 00010246 [ 780.203781][T26394] RAX: dffffc0000000000 RBX: ffff88802107cc00 RCX: ffffc90035a0d000 [ 780.206331][T26394] RDX: 0000000000000000 RSI: ffffffff87ce6aa7 RDI: ffff88802107d290 [ 780.209067][T26394] RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000005 [ 780.212341][T26394] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888055e14050 [ 780.214884][T26394] R13: 0000000000000000 R14: ffff8880298c34f1 R15: ffff8880298c3008 [ 780.217362][T26394] FS: 0000000000000000(0000) GS:ffff888096de1000(0063) knlGS:00000000f53acb40 [ 780.221095][T26394] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 780.223980][T26394] CR2: 0000000081000000 CR3: 00000000768b2000 CR4: 0000000000352ef0 [ 780.226945][T26394] DR0: 000000006000003f DR1: 0000000000000000 DR2: 0000000000000000 [ 780.230271][T26394] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 780.233022][T26394] Kernel panic - not syncing: Fatal exception [ 780.235562][T26394] Kernel Offset: disabled [ 780.237253][T26394] Rebooting in 86400 seconds..