last executing test programs: 2m37.842796572s ago: executing program 0 (id=280): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)={0x1c, r0, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2010}, 0xc009) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0x1f, 0x1f00c00e}, 0x0) r1 = fanotify_init(0x54, 0x101000) writev(r1, &(0x7f00000005c0)=[{&(0x7f00000001c0)="84", 0x8}, {0x0}], 0x2) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@rxrpc=@in4={0x21, 0x1, 0x2, 0xffffffffffffff7a, {0x2, 0x4e23, @multicast2}}, 0x80, 0x0}, 0x4004090) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0xfe33) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB="a40000000206010400000000000000000100000814000300686173683a69702c706f72742c686173683a69702c6d6163004000070c00028008000140ac1414bb05001500060000001800018014000240fe8000000000000000000000000000bb08000a40000000080500010007000000050005000300000011000300686173683a69702c706f727400000000050004000100"/164], 0xa4}, 0x1, 0x0, 0x0, 0x44800}, 0x4000000) 2m37.745890177s ago: executing program 0 (id=282): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0140ffffffff0000000001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000fffe14001f00000000000000e7ffffff000000000000060002"], 0x64}, 0x1, 0x620b}, 0x0) 2m37.620841459s ago: executing program 0 (id=283): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REJECT_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) (async) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r3, 0x402c542c, &(0x7f0000000040)={0xffdffff8, 0x401, 0xfffffffd, 0xc4d3, 0x7, "0441920887e87fcb367800000000080100", 0x4, 0x1fc}) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, 0x0, &(0x7f0000000040)) (async) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_CPUID(r7, 0x4008ae8a, 0x0) (async) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x1) (async) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000001c0)=0xc) setsockopt$inet6_int(r1, 0x29, 0x49, &(0x7f00000001c0)=0x8, 0x4) (async, rerun: 64) r8 = memfd_create(&(0x7f0000000280)='\x01\xfd\xae.+\xa6\x8c\xb6?2\x199\x94S,|x?Ue[\xbd\xe1!\x033\xbc\'#\xff\x17\x9b%\xf3[d \x97\xf5G\x97A\xc2\xd8\xf0Uq\xe6+\xa5l\x94\v\xb6\a\x17\\\xfb\x04!\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\x00\x19\x8d\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xcc\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\xa1\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xe9k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6\xbel\x9b.o\xbe\x80\x9dx\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00s\xaf\xa2\x14]p+\x96\x1ei|n\xda\xee\\\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\xf8\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\x03\xce\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xffY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\vi\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x15&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96\xb8\x02\x13pA\x19\tf\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcc\xcaXe\xe1\xa2\xaa\x02\x86\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01O\xd3r\xa2\xa9u\x93', 0x6) (rerun: 64) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xe, 0x12, r8, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r10 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x0, 0x0, 0x1, 0x1, 0x4}, 0x20) (async) getsockopt$bt_hci(r10, 0x0, 0x2, &(0x7f0000000140)=""/120, &(0x7f0000000080)=0x78) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f0000000100)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0xff, 0x9}, 0x20) (async, rerun: 64) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r10, 0x29, 0x20, &(0x7f0000000300)={@local, 0x0, 0x0, 0x1}, &(0x7f00000004c0)=0x20) (rerun: 64) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRESDEC=r10], 0xc4}}, 0x800) 2m37.210440586s ago: executing program 0 (id=286): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f0000000200)=0x1, 0x4) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x80}}, './file0\x00'}) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='gfs2meta\x00', 0x0, 0x0) (async) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='gfs2meta\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="050029bd7000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="9c000000060000000800178004000500"], 0x2c}, 0x1, 0x0, 0x0, 0x200008d5}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0xb2600, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x14) (async) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x14) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_DEBUGREGS(r7, 0x4080aea2, &(0x7f0000000000)={[0x25000, 0xf000, 0x3000, 0x4], 0x7, 0x14, 0xfffffffffffffff8}) (async) ioctl$KVM_SET_DEBUGREGS(r7, 0x4080aea2, &(0x7f0000000000)={[0x25000, 0xf000, 0x3000, 0x4], 0x7, 0x14, 0xfffffffffffffff8}) socket(0x10, 0x3, 0x0) (async) r8 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r11, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="3c0000000200"}) (async) ioctl$SIOCSIFHWADDR(r11, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="3c0000000200"}) ioctl$UI_SET_PROPBIT(r2, 0x4004556e, 0x8) (async) ioctl$UI_SET_PROPBIT(r2, 0x4004556e, 0x8) setregid(r10, r10) socket$inet(0x2, 0x2, 0x1) capset(&(0x7f0000000040)={0x20071026, r9}, &(0x7f0000000080)={0xc, 0x6, 0x2, 0x87, 0xffffffff, 0x1}) syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) (async) r12 = syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2000000035000900fffffffffddbdf25020000000c00018008001100", @ANYRES32=r13, @ANYBLOB="f8a83380ad8324bb0dc8cdec7581006172f8a0b68921a66afa4115f8f3d0"], 0x20}}, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r12, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="1b71bbe0c100000000000000"]) fanotify_init(0x8, 0x8000) (async) r14 = fanotify_init(0x8, 0x8000) write$binfmt_elf64(r14, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r10, @ANYRES16=r11], 0x40) 2m34.154349247s ago: executing program 0 (id=325): syz_io_uring_setup(0x4504, &(0x7f0000000240)={0x0, 0x0, 0x13290, 0x100002, 0xef}, 0x0, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000440)={0x28, 0x0, 0x0, @host}, 0x10) (async) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000880)="79bd2143e5238fdc16b46717468e3a8c319c8992cafd74fd9b31c7c196a222caae2554dc43af3c78d85be80565bb80e15edd299294aa32363790b0ad51108387687cc2db5e4337c70bec7d17a87cc769a2da9d12be572292745f7fb5d0d7f66a6e2772976e0172ed1a2d6a4ded9ccf75265c126a4c62a10056f604428887a9a836b7d37f4cdf285353a6630f9df834adf284ee90d2a028223cbfa9eaaaffb224f5511286f8485461184efddd464e6a1f4f4cd87f46ccf17222a3e525753cd014d2c7fb86b60f34f859a28100d6decb0c2ff805856e86ef606a2d47ccba8295272c1ed44bd95458fdbcc413b79af01723d9fc032917088ebf7aecae3f6af7c7c714f0e72d8ece9aaf09dfdcde39e65c3f69c15e225dfba643729ec64c9ed828b9185f888e470bd95426c676d49933c4c4e4e5740dfef81b3dc674dab912b85ebe708c49fc2b14ecdaf945d9f64f7cd4b1b99ba58aaee5a15cd9df4dc15a3d059158b80fe31753e594670bc7818866b6eea1abec3b0088ffc5034e8863eee8c29012b00704826e6767181ad11ce75149e0e8ae9063358d3b541de8b47791024ab70f0eaa3b6ae8bb7af1e124b40f1b1ca23dbf815bd9550e554ee75fefe8f10e9c37e4c600f319ab9c2c8b7c17efc34e5c7b81062895f235b015ae0fe5b578391f90ff60d087cb64b46526c3da2cc753b46c64f459e92a4df1f6b5ee279bf94421164ef68cd8d02bf0c4e53a02de0ccd8205221e8aa4540213b8e8ba03c9cdcc8e5d7fda98de0105762ed16cf67afe5c329193ce652077313ac94d364c6c5fc851e95aa4062d6aa90c19f9f5b94155af8ae9c1c72c817a2d2d5430b1df169fd94d6fdbdf8bad3ec2b81140f6944f95c9372de24ad9e18b5181c52ecd5e23aa306414f68830eb3d01d720ec54ee1f6ec9206e3c429cafb4a59ef7c9c7232d6ad9b25caa8aefa66c5547409aff5cf4586bed92ad2069928c7b2fd97197f48c06868acab057ef5c4c432982b9344d8bb86735f8494e12639419029330cd049e996c84144f015207bd46895678beaddee9252ba37e8f3271afeea1740f116ed9dfec48067febeda23e8c653ff49334760518946defcd3c58c9434d93a90ab03eae219f4a01a8d59ad84c5cb639e890e295d9fc876304481fce616fa3759d26781025895065dfa8ba7974edffdc04d03c8382a24eec84bb0fbc2a24f8c73960b1081cc47ad1ef56fa1b2a370c300eeac572df420ecdfd3c8753813556d78c956d784ee297b67092e5badf77473c036691e86f144a88048628077ac74bfba667a67d2d3aadb7386eb09b8f9ee3d0bf17a0011b934d023439d548c92e268e5b5a9afaeac3a5a19037bc7821e23ba0f21f5b42f42836b6ec57785c1147770a1c23354d497ae6004dd081cafb321c654db556e8795433a4b236e0431263710af04faf29a1353a4eb9f91a2c2ae08299c4208af5822a0887dbc443b093db4d9fe37c2685a14f7834f0c15504666fd910c1fa748d0b9c2150293ec8d088620ac61f9e081bb469fce7348c148382c7966750caeeccc492ee45bfc9d3076a6ba3ed049fc981a499f044785c8b3aadee0932ca176c7e8b22e6995c93aafd2fe21fc634d7b891003cc2e966dc3d8ccaaf06c2ce0793c9aadf76661b910916f5a8c47d896fc5593a586fee8f31f1d21393c141b4e7bc560816fc74e4b9e9dec8e3ce95afd5b7794f8a6e2d8de1779700da6e1d22abef633118a6f07b71c30ef9e71108fe15ca8ca7081fbee7d79479333234ccf83b92ff6eb7b7289cfc852668f3fbe4897b1f2f9ad6febd9459a3358b53fe7167e5a81a1633e25ab84b86965c04511a8e502611804cda5f77381086d9159481ec6f348eba9a99c74753566f06f9a0a7146093e0121feb22a331fc0e59dedbc873fd882e4658e88c19a53c0224f7d6a7d629aadb15cb11d93361085f6caa5f37227ba5e2151289be80d125ce88409814e309c68e1ed5238e6ff76bf659e61c0857166d928e87a0c73285aa9ffb6d25a4e84717b853fb45550ed50b7e04f585c94ec6f248fc8845f3a99eee1bf60c5bfaa165f0d91a83e8ebcadfd51315d514dd80744897bc5e586c691435f8cd57b2fbb290233d45c8ce1782602ca2864124146f8ffe39a1f19123450fdf0f407f2dda339fb9bf391b6fef974d9715c44cc4bafc297c3ac3e8d833f669a16c64b1e15acb01df92debbd4739275c4a87898a44339e9931b39b603c7b7ef9422ce5120b1a522bd7d09a09ae698c81e52a2235fee5c6a480c3445c49e5984750e72cbe9cc182326296480a7a18634d266e3a7909bc8611f2d051d52ed9e76129b3ab94a43b3480047328e47797fd6d68b3e6250590f5796d12a3f264dcd37c7f45864ad3ba7603121fb8a6fd45346092d6792d5756ed713dc4b4241041fe1dc76eaa8e28968174797e2ecccbe4f35d99b0aff3f25110ee37bfb001c447f75dc05f6359b48b5380648d37e48be49a7a1ffa8d41981024659cd1dbb2fe9a88c77224b4abfad8435e9389210df215536e1f2a302c0e2c1eff5c1d6359054a9802b60f893e17390b3a2ccc5321566156e01a247d2ce0405ba6511ab84ab50e55583bd8f8aa0a35904763a245874ea9e4c68c855021d18ec38222c35c0c937e21eee87459d07e8697c9ae3e2330358f7fcba0061703c50b1c03d3c5d46db5fed0dca2e6a34c11febef729f79e07dca25aefdebb1ce3b36b3e8d7bbe1cb558ecdd645dd85de0965baa238a9f11662ca7ec94521d3332d21382f8e777ae41688798f492d253e3aab9f19b228a75d1b7466274149204ae004040efa5daa6bab4d90750362dca214222fd89c02511f8f8b3bea6b36ec123ef35e22ca95d074467a43f4479d6dce7802c81affadc862113dbeb30b7c17d0140d73767de6c0d80389c04352d7fefffc6247b2c91045be215b337e9340350c7162e8d84a5f2b1d9e7f7b4a66cef9face819429f8abda799b2eb011f809ffb39e1033573e172cb57bbafa7e5ba94782dc51b8a6f75b47a5af60847a33b3d309580311e6b75dccbb66f9c299691eb243cb075291531bf832b96dd4b1b543c60f77fb087f0aab567da734b9b9d1cb3dd17fe1597166e05c7bb1ed56eb28e800e5cc66cf03af6ceeb5b4bb4ef4d7b8ecbcff46445f59f2f821859dbd4cf62cd5b5d9020cbe46b846fa4abaeb78c27b026a8e944d04552cebf1e52b23660041c42cfc2379c5aac741786c5cc303dfc49b994de5538f44c6203f489ac14c21ae2f4244e7d9dcf64aef0967301f9a29f624fa5a7d24ba0e60d38d9652be99df5cd73e250e712b2ec4106103a0d010838975d155269aef211ede73dce8271c4a0fa2137bd0c7eef61567096244bb27344354be6022451d8fd1270cd7d0f1dc70ffab08649e40ae68ce91d8f958e1afdb2b47b57de8b7b4b37c8fe2227b67c33cb1f08048d1c2b8a2fea0a4829fc3586f44cd67b3d0007eb92e04cb684680228126ce5bea6c197b9d9ba025b2940b45726d8508cd36e26ae692a0f20eacb808f43928290db106819cb739d38173aa877a616197d4c5f17e5ec098c3c46f69e864744a3ea1417c25c036f84080b30169438620ce92b6c5b26f9bdda442eb260924b2f7c9ba8614e207beaa37c8c22a0a7a46ec69eee4008c059ea70b7ece5761e34a4004ff5e8b1f17b8cc7eda26c7c2fbbbffec6054e60d2d7fe4a0ed3f8b3c476f9cb3c4b3496585f19324ed20dc6fb9b8de1b1543eac79cbf78794721f8c6a34b1368cbd499c30350a92b95971443b46ffea86bac500abead8db3342cd775f01138b81766c00213de9a2e619ec6ce9235abbe02ddfaba637d783cd333b0bb616ff86c78e7283f96e6e4808563c4dcccc9a9aaaca31311d7e4405086370f3ef84677dd0cdf1c99c8b34e06ebd0452226a67df43060425a9d94eaf34155245fcb4170d993dd44fc2ab43d3ff87e293ab4a246ca20fab2e2051cb2aa2ed69e2951446bec3461b9751e5d50926090dffdc1116ef70ffee56ed400e030d4850e203750fcc66cfaa246444b98f2c569461adce6b4cf984c63e04b03aab1a9fd8dc803c0e8fc0fda1a90d46ff751fdb0426a00e309e99918438d2ca531dbbeae6dfe1ee9fa2302ef20e1118bc9e0a967bc21bcc8456de5f08fa723d6de3f7e5431f4a08bad24b6dcd77fcecf0f9154043d5bff66e28ddfb255e221f151761789bb11de3448278fcacbf1d0cb86db818e5ae5feb62d598ebd04b710bef2bb50763f35dc78d20d49ed517be069bd3aa968e6ea6a3ffcf4c6c394cf1658957082539382d31727c5c5f318e4593e396c9204ae94a498a924aa935cfe2b2e7fa68679a0ab6182fd30373a76507ea642653e3a1c1197d64c392217cca007bf4f5f3e1899d337ea3a7ca8168081250ed361a37e0d898199e7d18b5d790107dc0f5d612e51ab8e272556111572231744442a64aa67d04f238e7ab2d58c892bb213393c23b9671cf8acc36fadfa4a4cd7ddf99ee8b9e8440a52e907037b2580b99747ae01c89f6cfdcd44cc710fa760ef55b86646162dafa0780e789cea05feb36ffcd0df4184cb9b1aa7412818dbd3b4163f96f3f875c9bd505e6a7a9167b04844cefc7955fe30121ff92d28800808baea875365baf3a4db203eba99f70f296e1cf16681ddd7fba3f8135b87c6a8adb087f70e492225b77ed62aa2bfae7c61d17b0ca043bf0f039c04210bd2d2f3e40fae05094b566d740a2caad44a4c4d35bef7c89c4d7914580fb458193fb1945355c63b2f843bc07ab4de6bdceb701d160f0115b7c8ddd8cbf2727aafcf5aa4b6441c07db8b69064dd4f14550c4f87740c9ee720103d4b815bb10c2dc6c4aabe77c4474ca1b217b788bf0bbc2541cce4a2c08b17fac09f13841d1bfe4aa4ac07018ab5cb0f41ba58621cc669130515baa0ba1ffb6f30f1aed989c87e8922dbe75f6046dad134a4167d484b3bf84b64580048fd4ee04f1165ec4e0524e8b5ca3f37a28ee35b89b11c7768005e9bdcfa4dfe6fa68db84595a7f52ffd61a9219c6de38ff70f6a4dcdc3dde31d7c6b169e799ff279e80ca5a015a00a666f46eb07e48e8acfc9afb28bec631f693df108ae3b1d6cbff7b488032e54718759825c62cb6f2f9a0308237e45454037b1cad0ec7ede9c6488fc2060ed8a17aa35ef5cfc95c4f7c941a655d827174171c0e0bce85d235eaa3807c36ca884b052980c714761e822e2cac1e156c8f61f533daa90d526a37dc838d64ef5865b30899d242d541dd1e8eab308c368b8a1f125c1c5dab519d7f760d8b02a0aaccac77dd7b035468a0ee3605aa1dc45e3e7b134f5c751c597189304191677a663a1498f461b9cf021c5dfe2ebda7ec3621b1ade755cab0dc5c8ac2d6effe58070f94bb4c76f9643093359f60aef2b109fbf76078730497177a4e35cf503728a778578673ffde8c3d9bb03ebe92793f23beaa5e10e086d661c78cb6a975f0f958d1e52a24bb6019939d9b5e1e65353c250e0685d20f9035f09ad3e45f220e5933874c685f02e255bc7874e0d592b2e8be8daecb1c630d72319bd75c1cd7da75611f769622efe1ffb295813bf4eed6eaabd4b5f5d974cc144935154aca7a26336d7b44ba0e728b3e61a730720b08c8246a0d431ee5844360ec51df3445740d65017efd9ac12c77016296ba875299f509ed7fbef1c8a1737b94328e6137097ed5d91a4f3eefbba72003d6b5fdfb5cb2e2f3f22ad05a497d881a2e240f7ddac6982477f27091919f8a20f508e772cb0ba3df28dcfa4c7dc7550e3b343455", 0x1000}, {&(0x7f0000000000)="9fa1977f490ba0c30c0e7ebc", 0xc}], 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x3, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x1ff, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xffffffff, 0xbc, 0x0, 0x71, 0x2, 0x6, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x7, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x5, 0x1000, 0xfffffffc, 0x0, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0xfff, 0x4, 0xfb, 0x5, 0x8000, 0x5f31, 0x4, 0x1, 0x2, 0x2, 0x20009, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x40000100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0xa, 0x5, 0x1005, 0x0, 0x1f0, 0xfffffffd, 0x2, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x800003, 0x200, 0x80, 0x2, 0xcc52, 0x950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0xfffffffe, 0x6, 0x5, 0x0, 0x3, 0x80ce7, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x2, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0x7, 0x4, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x8, 0x30b1d693, 0x5a2d, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2m34.049072033s ago: executing program 0 (id=328): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async) shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmget$private(0x0, 0x1000, 0x400, &(0x7f0000003000/0x1000)=nil) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r1, &(0x7f0000000800)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000280)='Q', 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e22, 0x3ff, @private0={0xfc, 0x0, '\x00', 0x1}, 0x414}, 0x1c, &(0x7f0000000040)=[{&(0x7f00000000c0)='T', 0x1}], 0x1}}], 0x2, 0x4000840) (async) syz_clone(0x880000, &(0x7f00000006c0)="487ca6aeafd8d66164ba87f957149d0694addedbe19c55a0470e53ce7c69a318a620c566e60f58e54249ae9fba28979c21f49690792b9770e8f0df66098219440b49174f335812c6ed10bc0acf137ac2d9ae760cd70cfc756c75039b2413712d57e880f81c50a54c95f337d6ba117cb1284b556607ba040d6795caf01f57538d849e449c8346c7ec3a331c615d99cd0264c2b70edb3ed8d8223b615c06d34b44ea93e07c6ba6", 0xa6, &(0x7f0000000380), &(0x7f0000000540), &(0x7f0000000600)="3e14a16ee149a2777c613d4801a06c701547954c507438641900477430f6c2c516b43b4bc0b664e06097c9b180805223697718be0512890e3ed5d18bdc833d7381122559c6b2dbc1d2a9269661ad0eaaf538") (async) setsockopt(r1, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) (async) unshare(0x28040680) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) (async) mprotect(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0xb) (async) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000003100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000"], 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000000140)=@abs, 0x6e, &(0x7f0000000080)=[{&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/97, 0x61}, {&(0x7f0000000480)=""/150, 0x96}], 0x3, &(0x7f0000000880)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}], 0x1, 0x40022040, &(0x7f0000000340)={0x77359400}) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000e00)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x5, 0x412, 0x8, {0x77359400}, {0x77359400}, {0x1, 0x1, 0x1}, 0x1, @can={{0x0, 0x0, 0x1, 0x1}, 0x0, 0x1, 0x0, 0x0, "faa41db9149f5809"}}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x648a1) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x2cb, 0x2) ioctl$vim2m_VIDIOC_TRY_FMT(r4, 0xc0d05640, &(0x7f00000003c0)={0x1, @pix={0x0, 0x0, 0x31384142}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r5, 0x80015b18, 0x0) rt_sigtimedwait(&(0x7f0000000440)={[0x40]}, 0x0, 0xfffffffffffffffe, 0x8) (async) syz_clone3(&(0x7f00000003c0)={0x101040000, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) 2m19.010120258s ago: executing program 32 (id=328): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async) shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmget$private(0x0, 0x1000, 0x400, &(0x7f0000003000/0x1000)=nil) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r1, &(0x7f0000000800)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000280)='Q', 0x1}], 0x1}}, {{&(0x7f0000000000)={0xa, 0x4e22, 0x3ff, @private0={0xfc, 0x0, '\x00', 0x1}, 0x414}, 0x1c, &(0x7f0000000040)=[{&(0x7f00000000c0)='T', 0x1}], 0x1}}], 0x2, 0x4000840) (async) syz_clone(0x880000, &(0x7f00000006c0)="487ca6aeafd8d66164ba87f957149d0694addedbe19c55a0470e53ce7c69a318a620c566e60f58e54249ae9fba28979c21f49690792b9770e8f0df66098219440b49174f335812c6ed10bc0acf137ac2d9ae760cd70cfc756c75039b2413712d57e880f81c50a54c95f337d6ba117cb1284b556607ba040d6795caf01f57538d849e449c8346c7ec3a331c615d99cd0264c2b70edb3ed8d8223b615c06d34b44ea93e07c6ba6", 0xa6, &(0x7f0000000380), &(0x7f0000000540), &(0x7f0000000600)="3e14a16ee149a2777c613d4801a06c701547954c507438641900477430f6c2c516b43b4bc0b664e06097c9b180805223697718be0512890e3ed5d18bdc833d7381122559c6b2dbc1d2a9269661ad0eaaf538") (async) setsockopt(r1, 0x84, 0x7f, &(0x7f00000001c0)="020000000980ffff", 0x8) (async) unshare(0x28040680) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) (async) mprotect(&(0x7f0000ff7000/0x1000)=nil, 0x1000, 0xb) (async) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f0000003100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000"], 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000200)=[{{&(0x7f0000000140)=@abs, 0x6e, &(0x7f0000000080)=[{&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/97, 0x61}, {&(0x7f0000000480)=""/150, 0x96}], 0x3, &(0x7f0000000880)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x150}}], 0x1, 0x40022040, &(0x7f0000000340)={0x77359400}) (async) syz_usb_control_io(r2, 0x0, &(0x7f0000000e00)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x5, 0x412, 0x8, {0x77359400}, {0x77359400}, {0x1, 0x1, 0x1}, 0x1, @can={{0x0, 0x0, 0x1, 0x1}, 0x0, 0x1, 0x0, 0x0, "faa41db9149f5809"}}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x648a1) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x2cb, 0x2) ioctl$vim2m_VIDIOC_TRY_FMT(r4, 0xc0d05640, &(0x7f00000003c0)={0x1, @pix={0x0, 0x0, 0x31384142}}) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r5, 0x80015b18, 0x0) rt_sigtimedwait(&(0x7f0000000440)={[0x40]}, 0x0, 0xfffffffffffffffe, 0x8) (async) syz_clone3(&(0x7f00000003c0)={0x101040000, 0x0, 0x0, 0x0, {0x24}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x80842111, 0x0, 0x0, 0x0, 0x0, 0x0) 38.86208871s ago: executing program 4 (id=1788): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000090100fffc0900010073797a300000000040000000030a01200000000000000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 38.861259442s ago: executing program 4 (id=1789): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3100000000080002400000000120000000000a02000000000000000000070000000900010073a27a310000000028000000000a030000000000000000000200000008000240000000000900010073797a31"], 0x98}, 0x1, 0x0, 0x20}, 0x0) 38.828707918s ago: executing program 4 (id=1790): r0 = socket$kcm(0x2d, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) socket(0x2, 0xa, 0x300) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="0c0100001000130726bd700000000000e0000002000000000000000000000000ac1414130000000000000000000000004e2300010000000b020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb000000002b00000064010100000000000000000000000000000000000000000000000000000000000c000000000000000a000000000000000600000000000000000000000000000000000000000000000300000000000000020000000000000000000000000000000200000000000000f8ffffffffffffff0a000000000000000200000029bd5500000000000200010008000000000000001c0004"], 0x10c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xffbf}], 0x1) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000340)={r0}) ioctl$NBD_PRINT_DEBUG(0xffffffffffffffff, 0xab06) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8, 0x1, 0x40) connect$can_bcm(r6, 0x0, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b0009058b", @ANYRES8, @ANYRES8], 0x0) 35.503786565s ago: executing program 4 (id=1820): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000003c0)='./file0\x00', 0x0, 0x2243005, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000005"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="5578c1"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r1, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000240)={0x0, 0xa, 0xf, "758b461b8a7a447d1bc5bc54481e8f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$bind(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010334bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000700)=""/4096, 0x1000}, {&(0x7f0000000300)=""/102, 0x66}], 0x2}, 0x2000) 32.17551669s ago: executing program 4 (id=1862): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000001c0)=@buf) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000580)={0x4c, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40046302, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="240000ee", @ANYRES16=r2, @ANYRES8=r4], 0x24}, 0x1, 0x0, 0x0, 0x24008841}, 0x30) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x4, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x7, 0x3, 0x0, 0x5, 0x24, 0x1, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x5, 0x5, 0xffffffff, 0xe661, 0x8004, 0x7, 0x5, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0x0, 0x80008071, 0x3, 0x17, 0x1, 0x407, 0x5, 0x9, 0x8f, 0x4006, 0x6, 0x0, 0x0, 0x4, 0x8, 0x400, 0x80, 0x0, 0x5, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x4005a7c, 0x420, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x80000004, 0xb, 0x4, 0x9, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x9, 0x1, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x2, 0x408, 0x8004, 0x5, 0x9, 0x100, 0x8d2, 0x9, 0x0, 0x7fff, 0x0, 0x5, 0x8, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1ff, 0x80, 0x3, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0xa, 0xac8, 0xbf, 0x2, 0x4, 0x7ff, 0x12b, 0x4, 0x1, 0xfffffffa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb30, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0xb, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x1, 0x16, 0xffffffff, 0x80000003, 0x5, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x9, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0x20000d7, 0x200, 0xffff3441, 0xfff]}, 0x45c) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1401, 0x1, 0x70bd28, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x16}]}, 0xc}, 0x1, 0x0, 0x0, 0x40001}, 0x10) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = socket$kcm(0x2, 0xa, 0x2) r10 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000000c0)={'syzkaller1\x00', 0x0}) bind$packet(r10, &(0x7f0000000080)={0x11, 0x0, r11, 0x1, 0x66, 0x6, @local}, 0x14) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f0000000240)=ANY=[], 0xfdef) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r12 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(r5, 0xc02054a5, &(0x7f0000000080)={0xf, r12, 'id1\x00'}) 31.877187089s ago: executing program 4 (id=1869): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0210000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000b42104802800018008000100666962001c000280080001400000001508000240000000030800034000000032882101800a0001006d6174636800000078210280090001006473637000000000041003009153a04709dd3ce609dff7ed79a6b495475de7fb1ab757cefa6702b550641f1bc0f33a205505b2569471224ab9523b742af6a2a799407d48bec685a43c9fa1d84b2263623a39fa7d2373a858b35457216ee91bd3e98f97181b6f0abca47a3e5db91f5a0059d45a24730bddc5915ad5fcd19265f5dfeea8638bc7f3fe0fbefe12776b861bc591b7543536ebd3cf666a7a6366a7bb51f1011cfc40d26ccb7d27cba7e3ba76c82ccf6cf21f62bdb5c1dc9ffb5512c0c7f263fc19577efd96e3f8ea7ac0ac6058e344d8b2260c3f70badd0035a121a24d3926c18cdbc7b4e397d2b9925b54f549aac05575be911f1b0bc0b09114366933dd498a989085f3021f1dd0541a533516d85ac8a617621fa0ad728e5e77147cdcd4b310860e522a3780c8a92fc2e58a97d1bb432ecefbb0c85518da22a1071df27d204aabf65b3fc1aa04a6903a07548b4a2ee8b033821e727959b52528ae4bb4b8a7b9626b898bf1265b92540c67c05b476d1b9d83b7e43343748755e11081fe2394c817fc4e1d5962e929a9a85b66da20a7a100a0fe3ace658286342838271e7ce0765240260d67a0ab7cf8c601743c68f0ab0406e1a3bafa7561bdb08bc2002ad33e1bc80c1cb0dd72b6ac3f7c93bbea95be309848ff5194e98ac171c7495623e773062affd7a1de1a86bc8827c5ea24d4dbe3cfc37eaddf1ffaeabf7cdcbd4795004f18d4caea50c2da08b71c9c5df1f8f15a9abb7a822ba57348d14a6d022c66d9e60bdc2809913e5a0408d0a6c80a29ee8968d0160a54d5374680f0326ff3a2f38eb16288a92680f4be3f78f999a65b12347903a7c2860b80d72bf27fee3d3cf7728fecccf6c737ea08c570b829f19fb19959580332a5bca3f03b088178b2166783a0390748525e347a8f016687b179293a3a47087094d714204c50f5a65868656786453bd9703dcea9978b736118fa03e9fb98da62bfc21965149aeb03d4800c1b0fc3861ef8582e8017b0e5965b4f474af98e9d7785d9434811345b82644e2086239657bd4fa7"], 0x2208}, 0x1, 0x0, 0x0, 0x20000884}, 0x8800) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000fbff00000000000000000000000000000000ffffffffffffffff000001000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c00000000000000ac1e00010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000ffffeb220001"], 0xfdef) 31.515190973s ago: executing program 33 (id=1869): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0210000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000b42104802800018008000100666962001c000280080001400000001508000240000000030800034000000032882101800a0001006d6174636800000078210280090001006473637000000000041003009153a04709dd3ce609dff7ed79a6b495475de7fb1ab757cefa6702b550641f1bc0f33a205505b2569471224ab9523b742af6a2a799407d48bec685a43c9fa1d84b2263623a39fa7d2373a858b35457216ee91bd3e98f97181b6f0abca47a3e5db91f5a0059d45a24730bddc5915ad5fcd19265f5dfeea8638bc7f3fe0fbefe12776b861bc591b7543536ebd3cf666a7a6366a7bb51f1011cfc40d26ccb7d27cba7e3ba76c82ccf6cf21f62bdb5c1dc9ffb5512c0c7f263fc19577efd96e3f8ea7ac0ac6058e344d8b2260c3f70badd0035a121a24d3926c18cdbc7b4e397d2b9925b54f549aac05575be911f1b0bc0b09114366933dd498a989085f3021f1dd0541a533516d85ac8a617621fa0ad728e5e77147cdcd4b310860e522a3780c8a92fc2e58a97d1bb432ecefbb0c85518da22a1071df27d204aabf65b3fc1aa04a6903a07548b4a2ee8b033821e727959b52528ae4bb4b8a7b9626b898bf1265b92540c67c05b476d1b9d83b7e43343748755e11081fe2394c817fc4e1d5962e929a9a85b66da20a7a100a0fe3ace658286342838271e7ce0765240260d67a0ab7cf8c601743c68f0ab0406e1a3bafa7561bdb08bc2002ad33e1bc80c1cb0dd72b6ac3f7c93bbea95be309848ff5194e98ac171c7495623e773062affd7a1de1a86bc8827c5ea24d4dbe3cfc37eaddf1ffaeabf7cdcbd4795004f18d4caea50c2da08b71c9c5df1f8f15a9abb7a822ba57348d14a6d022c66d9e60bdc2809913e5a0408d0a6c80a29ee8968d0160a54d5374680f0326ff3a2f38eb16288a92680f4be3f78f999a65b12347903a7c2860b80d72bf27fee3d3cf7728fecccf6c737ea08c570b829f19fb19959580332a5bca3f03b088178b2166783a0390748525e347a8f016687b179293a3a47087094d714204c50f5a65868656786453bd9703dcea9978b736118fa03e9fb98da62bfc21965149aeb03d4800c1b0fc3861ef8582e8017b0e5965b4f474af98e9d7785d9434811345b82644e2086239657bd4fa7"], 0x2208}, 0x1, 0x0, 0x0, 0x20000884}, 0x8800) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000fbff00000000000000000000000000000000ffffffffffffffff000001000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c00000000000000ac1e00010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000ffffeb220001"], 0xfdef) 2.71428675s ago: executing program 3 (id=2142): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0210000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000b42104802800018008000100666962001c000280080001400000001508000240000000030800034000000032882101800a0001006d6174636800000078210280090001006473637000000000041003009153a04709dd3ce609dff7ed79a6b495475de7fb1ab757cefa6702b550641f1bc0f33a205505b2569471224ab9523b742af6a2a799407d48bec685a43c9fa1d84b2263623a39fa7d2373a858b35457216ee91bd3e98f97181b6f0abca47a3e5db91f5a0059d45a24730bddc5915ad5fcd19265f5dfeea8638bc7f3fe0fbefe12776b861bc591b7543536ebd3cf666a7a6366a7bb51f1011cfc40d26ccb7d27cba7e3ba76c82ccf6cf21f62bdb5c1dc9ffb5512c0c7f263fc19577efd96e3f8ea7ac0ac6058e344d8b2260c3f70badd0035a121a24d3926c18cdbc7b4e397d2b9925b54f549aac05575be911f1b0bc0b09114366933dd498a989085f3021f1dd0541a533516d85ac8a617621fa0ad728e5e77147cdcd4b310860e522a3780c8a92fc2e58a97d1bb432ecefbb0c85518da22a1071df27d204aabf65b3fc1aa04a6903a07548b4a2ee8b033821e727959b52528ae4bb4b8a7b9626b898bf1265b92540c67c05b476d1b9d83b7e43343748755e11081fe2394c817fc4e1d5962e929a9a85b66da20a7a100a0fe3ace658286342838271e7ce0765240260d67a0ab7cf8c601743c68f0ab0406e1a3bafa7561bdb08bc2002ad33e1bc80c1cb0dd72b6ac3f7c93bbea95be309848ff5194e98ac171c7495623e773062affd7a1de1a86bc8827c5ea24d4dbe3cfc37eaddf1ffaeabf7cdcbd4795004f18d4caea50c2da08b71c9c5df1f8f15a9abb7a822ba57348d14a6d022c66d9e60bdc2809913e5a0408d0a6c80a29ee8968d0160a54d5374680f0326ff3a2f38eb16288a92680f4be3f78f999a65b12347903a7c2860b80d72bf27fee3d3cf7728fecccf6c737ea08c570b829f19fb19959580332a5bca3f03b088178b2166783a0390748525e347a8f016687b179293a3a47087094d714204c50f5a65868656786453bd9703dcea9978b736118fa03e9fb98da62bfc21965149aeb03d4800c1b0fc3861ef8582e8017b0e5965b4f474af98e9d7785d9434811345b82644e2086239657bd4fa7"], 0x2208}, 0x1, 0x0, 0x0, 0x20000884}, 0x8800) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000fbff00000000000000000000000000000000ffffffffffffffff000001000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c00000000000000ac1e00010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff0200000000000000000022eb000001"], 0xfdef) 2.496484072s ago: executing program 3 (id=2147): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000002c0)=""/243, 0xf3}], 0x3, 0x0, 0x8) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)="98bd80d1b51facd6bb49000000000000000100000000", 0x16}, 0x1, 0x0, 0x0, 0x2000c0c4}, 0x20040090) r2 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$unlink(0x9, r2, 0x0) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r2) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f0000000240)="0000000000000002ff6900000001000100000018f200000000861f4104bfeacdd5a9007d16dcdc2850b536f0", 0x2c, r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r7, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r5], 0x3c}}, 0x10) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001b61e308d016a91052300102030109021b0001000000000904000001ff"], 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRESHEX=r1], 0x34}, 0x1, 0x0, 0x0, 0x2404c000}, 0x40000) read$FUSE(r0, &(0x7f00000003c0)={0x2020}, 0x2020) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) preadv(r0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000002c0)=""/243, 0xf3}], 0x3, 0x0, 0x8) (async) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) (async) sendmsg$802154_raw(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)="98bd80d1b51facd6bb49000000000000000100000000", 0x16}, 0x1, 0x0, 0x0, 0x2000c0c4}, 0x20040090) (async) add_key$keyring(&(0x7f0000000100), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) (async) keyctl$unlink(0x9, r2, 0x0) (async) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r2) (async) add_key(&(0x7f0000000000)='rxrpc\x00', 0x0, &(0x7f0000000240)="0000000000000002ff6900000001000100000018f200000000861f4104bfeacdd5a9007d16dcdc2850b536f0", 0x2c, r3) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r7, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r5], 0x3c}}, 0x10) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001b61e308d016a91052300102030109021b0001000000000904000001ff"], 0x0) (async) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRESHEX=r1], 0x34}, 0x1, 0x0, 0x0, 0x2404c000}, 0x40000) (async) read$FUSE(r0, &(0x7f00000003c0)={0x2020}, 0x2020) (async) 2.361367105s ago: executing program 2 (id=2150): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8042, 0x0) lsm_set_self_attr(0x67, &(0x7f0000000180)=ANY=[], 0x20, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="94000000", @ANYRES16=r2, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r3, @ANYBLOB="5c000e008019d8916960693171901ad0b99cc053000000ffffffffffff080211000000080211000001000002000000fe440000040001000301b60406060603000800050332c0052d1a0080130200000000000000010006000b0000000003070000000f760601ff1f000500050018011400000008000c00647f447bcc8b44582ffbcd0cd607753b039cdafd5c8e91643b87f6751bc277ca691193b81f3482b9857bba7f2180d73c4f2bd0dc01a6826b5dca0816e530f3fcec4a32"], 0x94}, 0x1, 0x0, 0x0, 0x26000800}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) timer_create(0x5, &(0x7f0000000280)={0x0, 0x3b, 0x0, @thr={&(0x7f0000000040)="b4f4b85b77e68e972068db8ceb381f2d0e39415561e7b1b2f028912010e57f4c860cbd689962547933059a5c997f0f7b16dc1a0a8c2f741bfe3a36ccab7374dee886421839626fd67ad5c40e37046534ffcd8af569337b49e5a2ac5d9c6c52b9480ab6013a5a5ab861b4445706f437b87630299affb651c035b8160e8442f26e8f435d5693c9d24891dce528c3b353640b1a54d8dd0eae48a1ae475163a2264afbb9", &(0x7f0000000140)="5bfb45958050f965f616796bcf820a08b9958ac8c2191733ebe59a275c"}}, &(0x7f0000000300)=0x0) clock_gettime(0x0, &(0x7f0000000380)) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) timer_settime(r4, 0x1, &(0x7f00000004c0)={{0x77359400}, {r5, r6+10000000}}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000480)={0x2c, &(0x7f00000002c0)={0x40, 0x14, 0x4, "b4865713"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e40)=ANY=[@ANYBLOB="00036c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$rtl8150(0x6, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) r7 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) mount(&(0x7f00000030c0)=@nullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000140)='squashfs\x00', 0x200412, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000540)={0x40, 0x5, 0x2, "5603"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000007c0)={0x2c, &(0x7f0000000680)=ANY=[@ANYBLOB="4040c4ed000000000000"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000001c0)={0x1c, &(0x7f0000000340)=ANY=[@ANYBLOB=' \f\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000500)={0x40, 0x16, 0x4, "4e59aaf9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.635321623s ago: executing program 2 (id=2154): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, 0x0, 0x4000080) socket$inet6_udp(0xa, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000004000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r1], 0xc4}}, 0xc800) 1.613620336s ago: executing program 3 (id=2155): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0210000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000b42104802800018008000100666962001c000280080001400000001508000240000000030800034000000032882101800a0001006d6174636800000078210280090001006473637000000000041003009153a04709dd3ce609dff7ed79a6b495475de7fb1ab757cefa6702b550641f1bc0f33a205505b2569471224ab9523b742af6a2a799407d48bec685a43c9fa1d84b2263623a39fa7d2373a858b35457216ee91bd3e98f97181b6f0abca47a3e5db91f5a0059d45a24730bddc5915ad5fcd19265f5dfeea8638bc7f3fe0fbefe12776b861bc591b7543536ebd3cf666a7a6366a7bb51f1011cfc40d26ccb7d27cba7e3ba76c82ccf6cf21f62bdb5c1dc9ffb5512c0c7f263fc19577efd96e3f8ea7ac0ac6058e344d8b2260c3f70badd0035a121a24d3926c18cdbc7b4e397d2b9925b54f549aac05575be911f1b0bc0b09114366933dd498a989085f3021f1dd0541a533516d85ac8a617621fa0ad728e5e77147cdcd4b310860e522a3780c8a92fc2e58a97d1bb432ecefbb0c85518da22a1071df27d204aabf65b3fc1aa04a6903a07548b4a2ee8b033821e727959b52528ae4bb4b8a7b9626b898bf1265b92540c67c05b476d1b9d83b7e43343748755e11081fe2394c817fc4e1d5962e929a9a85b66da20a7a100a0fe3ace658286342838271e7ce0765240260d67a0ab7cf8c601743c68f0ab0406e1a3bafa7561bdb08bc2002ad33e1bc80c1cb0dd72b6ac3f7c93bbea95be309848ff5194e98ac171c7495623e773062affd7a1de1a86bc8827c5ea24d4dbe3cfc37eaddf1ffaeabf7cdcbd4795004f18d4caea50c2da08b71c9c5df1f8f15a9abb7a822ba57348d14a6d022c66d9e60bdc2809913e5a0408d0a6c80a29ee8968d0160a54d5374680f0326ff3a2f38eb16288a92680f4be3f78f999a65b12347903a7c2860b80d72bf27fee3d3cf7728fecccf6c737ea08c570b829f19fb19959580332a5bca3f03b088178b2166783a0390748525e347a8f016687b179293a3a47087094d714204c50f5a65868656786453bd9703dcea9978b736118fa03e9fb98da62bfc21965149aeb03d4800c1b0fc3861ef8582e8017b0e5965b4f474af98e9d7785d9434811345b82644e2086239657bd4fa7"], 0x2208}, 0x1, 0x0, 0x0, 0x20000884}, 0x8800) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000fbff00000000000000000000000000000000ffffffffffffffff000001000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c00000000000000ac1e00010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff02000000000000000000fffd000001"], 0xfdef) 1.478283622s ago: executing program 2 (id=2156): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r2, 0x6, 0xc, 0x0, &(0x7f0000000240)) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r3}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r4, 0x80000000000, {0x1, 0xff, 0x4}}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r5, 0x6b, 0x4, &(0x7f00000001c0)=0x1, 0x4) sendmmsg(r1, &(0x7f0000001380)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="38debf0b9fd5f3b038fe", 0xa}], 0x1}}], 0x1, 0xc000) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848160000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x80054) 1.41299093s ago: executing program 2 (id=2157): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xdd2fcb245114ab72}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$I2C(&(0x7f0000002680), 0x0, 0xa2d81) pwrite64(r2, 0x0, 0xfffffe38, 0x4) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b1889b90f105d66b3e5a7c94742"}, 0x4, 0x4}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, 0x0, 0x0) preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SIGNAL_MSI(r7, 0x4020aea5, &(0x7f0000000000)={0x58000, 0xa000, 0xa}) r8 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0), 0x444000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r8, 0xc018937c, &(0x7f0000000340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) r11 = openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_MIDI_INFO(r11, 0xc074510c, &(0x7f0000000040)={"1c383478d0ff5d0d87e411499b88e59b1baf5a5e3f5a373abf6f7174062b", 0x9}) r12 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r12, 0x104, 0x2, &(0x7f0000001bc0)=0xfffffffd, 0x4) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000200)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x34, r10, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8c7e8000}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1c7}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x84, r9, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @broadcast, @device_a, @from_mac, {0xf, 0x5}}, 0xffffffffffffffff, @default, 0x9280, @val, @val, @void, @void, @val={0x6, 0x2, 0x1fc}, @void, @val={0x25, 0x3, {0x1, 0x38, 0x9}}, @void, @val={0x3c, 0x4, {0x0, 0x1, 0x88, 0xc}}, @val={0x2d, 0x1a, {0x400, 0x2, 0x5, 0x0, {0x3, 0xb7b, 0x0, 0x347, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x300, 0x0, 0x1}}, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0x3, 0x0, 0x2f, 0x6}}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x84}, 0x0) ioctl$XFS_IOC_GETBMAP(r6, 0xc0205826, &(0x7f0000000240)={0x1ff, 0x5, 0x3ff, 0x5, 0xe}) 1.368572805s ago: executing program 3 (id=2158): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0140ffffffff0000000001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f00000000110000e7ffffff000000000000060002"], 0x64}, 0x1, 0x620b}, 0x0) 1.209669739s ago: executing program 1 (id=2159): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x190) (async) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f00000000c0)={[{@userxattr}, {@metacopy_on}]}) (async) read(r0, &(0x7f0000000000)=""/205, 0xcd) (async) ioctl$HIDIOCSFEATURE(r1, 0xc0404806, 0x0) 1.209519761s ago: executing program 3 (id=2160): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000c40000000000000100fffc0900010073797a300000000040000000030a01200000000000000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 1.067447529s ago: executing program 2 (id=2161): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$P9_RSTATu(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f000000000000005000000000000fffffffffffffffe000000000000000000000000000000000000001f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f7"], 0x232) 1.063870616s ago: executing program 3 (id=2162): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000010bd28710000000000000109022400010000000009040100010300000009210200000122050009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r2, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/82, 0x52}], 0x1}, 0x81}], 0x1, 0x2000, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x3ffffffffffffa2, 0x9200000000000000) syz_usb_control_io$uac1(0xffffffffffffffff, &(0x7f00000006c0)={0x14, &(0x7f00000005c0)=ANY=[@ANYBLOB="362182"], 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000940)={0x40, 0xa, 0x4, "a0e763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000200)={0x0, 0xc, 0x4, "ca258375"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="601004"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfa, 0x40, 0xb9, "", [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x7, 0x1, 0x1, 0x3d, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0xfb, 0x14, 0xa}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0xf7, 0xa, 0x4, 0x20, 0xbc}, 0x15c, &(0x7f0000000140)={0x5, 0xf, 0x15c, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0xe9, "660520a12e42062233cd0aeed49df3c6"}, @generic={0xea, 0x10, 0x3, "1f34b9c024821cdab73ebbc032b74ffc798a0961d5787a0cb52e2202bf1b4327ec63446cf3e5007f712dcecba2278d44abdbfcf1b0a39a51f778e784ab133a487b490ecba2b0d73716e5244e70932e0fa8b4a68c26f8ef1e5295842cf8817663a953d2b92a609f7898e1452ba3c3a232b94008ae200a6abe48d107338bb60aba48736e7793313b50bfafcc1e60b86f1bab74696e8c1198de728c0585c39721de939895084b76e010f4f2509f8c4ed935cd08d7327b2a981f71dea606786b486441bce72c05c4e7f193cc46f7010e0351013917462e512289ecc315c93a16df25ac5d51c439fac1"}, @ptm_cap={0x3}, @generic={0x56, 0x10, 0x1, "105a18d9ef18184c9afdc9be7af880f25405bbe17174c1efaad0e350cc5aa78d7557b97218387d90ada0b3f282cc104fbe09d64ea25b7d66e48074d193987bea34de7fba0dfb9d3f34d1d397e898127a75df2a"}]}, 0x3, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xf0ff}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x409}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x43f}}]}) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@nested={0x8, 0x1a, 0x0, 0x1, [@nested={0x4, 0x4}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 777.925876ms ago: executing program 5 (id=2164): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a010200000000000000000100ffff0900030073797a320000010128000480080002400000000008000140000000051400030076657468315f746f5f687372000000000900010073797a31000000004c000000050a05000000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d616376746107000000080001"], 0xe8}}, 0x0) 743.147468ms ago: executing program 2 (id=2165): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x1010c0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r3, &(0x7f0000000540)={&(0x7f0000000040)=@ethernet={0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000000c0)="3d57eadc87c79ffd8d7eb52fd543bea23367baa8a92746a05d690a954cf2c429fcd1bce7285b53ada358bad58a663012641cf29b63a0f9548b1d24f230df74a46a6614f9214f4c53e527797e555764680194873fe889e5289aefbbbc0bf835ab8f69290f5dc5f2b67a5138655c0f8653717a8f720e140e932e5068fdff0d59b9e0e419a8f2c00d39f4041c532045dd7da50055406e9cba3914722ac5", 0x9c}, {&(0x7f00000001c0)="ceb1f8f6dd8163e8a33e941de16c47a0c3c289c948f57b0ebe99f20423148d0db55bd76d0cc2d9b3756caeb95e7852839fb21e59e7640e6a7bd4ecebbe1c20413247a81465f7f882aac33883052f2ea9d61853fe025a94429990f27cada6ee42673869cb76fa1a1f66a90ab05bb760896a56254949bc851876543e422922310e145b7248d5a960d124ac14b426542d31ad39724d134d01c3039643f6eecf4bc3b8d45d3af6c0683a5d32b20cf2b83109eb4d70e085f8d158e94c15ce7c36dfddb548220d817c6f26cca9b86c99899241f2413b994ff11b2e8d0af2af066cd4c7bd206f3f81e80fb0aec9d1c61d", 0xed}, {&(0x7f00000002c0)="43ae27d7a88456f9de17e4d869bda21135868b7844c292922b9316bcce12d788efb59ab9f428df91a3d4e67a16ccb698064be394ce6febb14a3887a52742bfef73532b2c8b2ac20a79f4f325c08a32b6b9872f73d59db9342a6a02653bc5fa07442d8eab6e9167caf7df3bd9b405260a2cc4d6cd234286b3b37616703c8701f666565f37d14b4f7e2b89419c21266d5a0361101a0614f19b1302976f22a2aee6dd63b4e738ffa973f1fc5e7f0d55b39c0c66c483958e1e45408358a96eb280ae77ca", 0xc2}, {&(0x7f00000003c0)="13e688d803d8e0e3d560ce4742374d674c97cee5680144a3bff482101c03cab7a8c2108336b34eb88c4dbc3ec3fd23c2ab44c9d2e6c5c73a6d9de62bda130ba222e2643bccedc4f7fc7dfe2daac220f9f8d0a9de05", 0x55}], 0x4, &(0x7f0000000500)}, 0x5) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) write$cgroup_type(r4, &(0x7f0000000080), 0x11ffffce1) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000002c0)=0xf) ioctl$TCFLSH(r7, 0x400455c8, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={0x0, 0x6c}, 0x1, 0x0, 0x0, 0x4006044}, 0x4881) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe3000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000440)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900600000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000000ba00000000b9c50d0000b800c80000b8010000000f01d90f300fc79d53bf0000c4e16dd3010f2202", 0x61}], 0x1, 0x4f, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 729.475419ms ago: executing program 5 (id=2166): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, 0x0, 0x4000080) socket$inet6_udp(0xa, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000010000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r1], 0xc4}}, 0xc800) 613.487373ms ago: executing program 5 (id=2167): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ae0210000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000b42104802800018008000100666962001c000280080001400000001508000240000000030800034000000032882101800a0001006d6174636800000078210280090001006473637000000000041003009153a04709dd3ce609dff7ed79a6b495475de7fb1ab757cefa6702b550641f1bc0f33a205505b2569471224ab9523b742af6a2a799407d48bec685a43c9fa1d84b2263623a39fa7d2373a858b35457216ee91bd3e98f97181b6f0abca47a3e5db91f5a0059d45a24730bddc5915ad5fcd19265f5dfeea8638bc7f3fe0fbefe12776b861bc591b7543536ebd3cf666a7a6366a7bb51f1011cfc40d26ccb7d27cba7e3ba76c82ccf6cf21f62bdb5c1dc9ffb5512c0c7f263fc19577efd96e3f8ea7ac0ac6058e344d8b2260c3f70badd0035a121a24d3926c18cdbc7b4e397d2b9925b54f549aac05575be911f1b0bc0b09114366933dd498a989085f3021f1dd0541a533516d85ac8a617621fa0ad728e5e77147cdcd4b310860e522a3780c8a92fc2e58a97d1bb432ecefbb0c85518da22a1071df27d204aabf65b3fc1aa04a6903a07548b4a2ee8b033821e727959b52528ae4bb4b8a7b9626b898bf1265b92540c67c05b476d1b9d83b7e43343748755e11081fe2394c817fc4e1d5962e929a9a85b66da20a7a100a0fe3ace658286342838271e7ce0765240260d67a0ab7cf8c601743c68f0ab0406e1a3bafa7561bdb08bc2002ad33e1bc80c1cb0dd72b6ac3f7c93bbea95be309848ff5194e98ac171c7495623e773062affd7a1de1a86bc8827c5ea24d4dbe3cfc37eaddf1ffaeabf7cdcbd4795004f18d4caea50c2da08b71c9c5df1f8f15a9abb7a822ba57348d14a6d022c66d9e60bdc2809913e5a0408d0a6c80a29ee8968d0160a54d5374680f0326ff3a2f38eb16288a92680f4be3f78f999a65b12347903a7c2860b80d72bf27fee3d3cf7728fecccf6c737ea08c570b829f19fb19959580332a5bca3f03b088178b2166783a0390748525e347a8f016687b179293a3a47087094d714204c50f5a65868656786453bd9703dcea9978b736118fa03e9fb98da62bfc21965149aeb03d4800c1b0fc3861ef8582e8017b0e5965b4f474af98e9d7785d9434811345b82644e2086239657bd4fa7"], 0x2208}, 0x1, 0x0, 0x0, 0x20000884}, 0x8800) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000ff02000000000000000000000000000100000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000fbff00000000000000000000000000000000ffffffffffffffff000001000000000000000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c00000000000000ac1e00010000000000000000000000000200000004"], 0xfc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff02000000000000000000fdff000001"], 0xfdef) 494.747334ms ago: executing program 1 (id=2168): msgctl$MSG_STAT_ANY(0x0, 0xd, 0x0) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYRES8=0x0, @ANYRES16=r1, @ANYRESOCT=r1], 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) (async) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x442, 0x1ff) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x18e) write$binfmt_elf64(r5, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c460d04000c028000000000000003003e00ecffffff940200000000000040000000000000004d020000000000000000000000003800010001017f000800030000006400000005000000000000000a000000000000000101000000000000a1"], 0x78) (async, rerun: 32) r6 = inotify_init1(0x0) (rerun: 32) inotify_add_watch(r6, &(0x7f0000000040)='.\x00', 0x20000021) pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000040)='$f', 0x2}, {&(0x7f0000000080)="b31e12113e4b33f8241a460b45f53f4ea2ced007c940572187993893bba4197cac486f9a3d4c2a07", 0x28}, {&(0x7f00000000c0)="7f1b08c2", 0x4}], 0x3, 0x5, 0x178) (async) close(r5) (async) close(r4) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) 456.453588ms ago: executing program 5 (id=2169): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xdd2fcb245114ab72}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$I2C(&(0x7f0000002680), 0x0, 0xa2d81) pwrite64(r2, 0x0, 0xfffffe38, 0x4) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"2ac78e02ff04856af9fb71f0d3fe13be", "3dfab043e15fad27a639f105b5e9f977", "47eb0b1889b90f105d66b3e5a7c94742"}, 0x4, 0x4}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, 0x0, 0x0) preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SIGNAL_MSI(r7, 0x4020aea5, &(0x7f0000000000)={0x58000, 0xa000, 0xa}) r8 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0), 0x444000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r8, 0xc018937c, &(0x7f0000000340)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r1) r11 = openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_MIDI_INFO(r11, 0xc074510c, &(0x7f0000000040)={"1c383478d0ff5d0d87e411499b88e59b1baf5a5e3f5a373abf6f7174062b", 0x9}) r12 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r12, 0x104, 0x2, &(0x7f0000001bc0)=0xfffffffd, 0x4) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r1, &(0x7f0000000200)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x34, r10, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x8c7e8000}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1c7}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x84, r9, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME={0x67, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @broadcast, @device_a, @from_mac, {0xf, 0x5}}, 0xffffffffffffffff, @default, 0x9280, @val, @val, @void, @void, @val={0x6, 0x2, 0x1fc}, @void, @val={0x25, 0x3, {0x1, 0x38, 0x9}}, @void, @val={0x3c, 0x4, {0x0, 0x1, 0x88, 0xc}}, @val={0x2d, 0x1a, {0x400, 0x2, 0x5, 0x0, {0x3, 0xb7b, 0x0, 0x347, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x300, 0x0, 0x1}}, @val={0x72, 0x6}, @void, @val={0x76, 0x6, {0x3, 0x0, 0x2f, 0x6}}}}]}, 0x84}, 0x1, 0x0, 0x0, 0x84}, 0x0) ioctl$XFS_IOC_GETBMAP(r6, 0xc0205826, &(0x7f0000000240)={0x1ff, 0x5, 0x3ff, 0x5, 0xe}) 245.819035ms ago: executing program 1 (id=2170): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0140ffffffff0000000001000000050007000000000008000900000000101400200000000000000000000000ffff0000000008000a000000000014001f00000000120000e7ffffff000000000000060002"], 0x64}, 0x1, 0x620b}, 0x0) 182.530026ms ago: executing program 1 (id=2171): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000d80000000000000100fffc0900010073797a300000000040000000030a01200000000000000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 140.533636ms ago: executing program 1 (id=2172): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x80100, 0x0) write$sequencer(r0, &(0x7f0000000040)=[@l={0x92, 0xb, 0xd0, 0xb, 0x3, 0xea, 0x1}, @raw={0xfe, 0xb, "ff4b32d6ef84"}, @x={0x94, 0x0, "a5141277a1b5"}, @s={0x5, @generic=0xc, 0xc, 0x7}, @echo=0xfffffeff, @n={0x1, 0x2, @SEQ_NOTEON=@note=0x1d, 0xd}, @raw={0xc, 0xf, "4bcbabc602ed"}], 0x2c) (async) ioctl$XFS_IOC_FSGROWFSDATA(r0, 0x4010586e, &(0x7f0000000080)={0x2, 0x200}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000001c0)={'dvmrp1\x00', &(0x7f0000000180)=@ethtool_stats={0x1d, 0x3, [0x3, 0x4, 0xff]}}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000200)={r2, 0x0, 0x0, 0x9}) recvfrom(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x2020, &(0x7f0000000280)=@nl=@proc={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0x80) sendfile(r4, r0, &(0x7f0000000300)=0x9, 0x7e73f75f) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000340)={0x0, 0x80000001}, &(0x7f0000000380)=0x8) (async) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400), r3) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, r5, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x80}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x81) r6 = accept(r3, &(0x7f0000000540)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f00000005c0)=0x80) sendto$inet(r6, &(0x7f0000000600)="2473031e0ea44743896a926a07b2daf6c0d7f74a88244c0580ceb37c7d7f170c93342af433225423ff3289a2091033bf080a6526d41a6c630c1fe16652956b0955831daa07de834b444e3703d9fa7eaabdced4654a5135f5fa6748ea93c70b7dad6876d992791300554a92c55caa6a0f89f516361d6a0997c010d66d03d589c92f9ad6b0a05c1cc56151f3c996c6b747bcedb1b95e21141244357f42bcfb48ea7c7b83d7c4d702c95e37dc5bbb6d1e6c50cd10e30e54458e2b1a694fa1c0965ee64bb660579fe3a52b67a1e554654ab5e70d5471289aa069dd8b188f43c27df7ac13b7ab35e38a63a1a814c5", 0xec, 0x8001, &(0x7f0000000700)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) (async, rerun: 32) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000740)=0x1, 0x4) (async, rerun: 32) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000780)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) (async) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000800)={0x1, 0x7, "5b0e91", 0xb2, 0x5}) (async, rerun: 64) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000880), 0x100) (rerun: 64) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000840)='IPVS\x00', 0x0, r7) (async) setsockopt$RDS_RECVERR(r3, 0x114, 0x5, &(0x7f00000008c0)=0x1, 0x4) (async) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000900)={"6cee9791f4f93ff45d0ce82b4b611019a268dadd1e26e44ad0b5f3b0c9f498ba", r3, 0xffffffffffffffff}) fcntl$setlease(r8, 0x400, 0x2) (async, rerun: 64) read$dsp(r3, &(0x7f0000000940), 0x0) (rerun: 64) r9 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETMIFCNT_IN6(r9, 0x89e0, &(0x7f0000000980)={0x1}) (async) socket$inet(0x2, 0xa, 0x800) (async) ioctl$SCSI_IOCTL_DOORUNLOCK(r3, 0x5381) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f00000009c0), r10) 132.944894ms ago: executing program 5 (id=2173): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a01010000000000000000020000000900010073797a3100000000080002400000000120000000000a02000000000000000000070000000900010073a27a310000000028000000000a030000000000000000000200000008000240000000000900010073797a31"], 0x98}}, 0x500) 17.988413ms ago: executing program 5 (id=2174): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$P9_RSTATu(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f00000000000000500000000000080ffffffffffffff000000000000000000000000000000000000001f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f7"], 0x232) 0s ago: executing program 1 (id=2175): r0 = socket$kcm(0x2, 0x1, 0x84) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0) syz_io_uring_setup(0x3b48, &(0x7f0000000000)={0x0, 0xc5fa, 0x1, 0x1, 0xc3}, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000001580)={&(0x7f0000000dc0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000e00)="1731", 0x2}], 0x1}, 0xc000) r1 = syz_usb_connect(0x6, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d90f25771565d2000001090212000100000000aa58"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="2072dc"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) read(r2, 0x0, 0x0) kernel console output (not intermixed with test programs): z.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.706084][ T30] audit: type=1326 audit(1773825553.078:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.757353][ T30] audit: type=1326 audit(1773825553.078:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.803985][ T30] audit: type=1326 audit(1773825553.108:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.832662][ T30] audit: type=1326 audit(1773825553.108:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.855749][ T30] audit: type=1326 audit(1773825553.108:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.878771][ T30] audit: type=1326 audit(1773825553.108:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 149.902709][ T30] audit: type=1326 audit(1773825553.108:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8240 comm="syz.2.890" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7ffc0000 [ 150.055300][ T5913] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 150.211306][ T5913] usb 4-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 150.338827][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.350038][ T5913] usb 4-1: Product: syz [ 150.354248][ T5913] usb 4-1: Manufacturer: syz [ 150.358928][ T5913] usb 4-1: SerialNumber: syz [ 150.366216][ T5913] usb 4-1: config 0 descriptor?? [ 150.378606][ T5913] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 150.529262][ T8268] netlink: 8 bytes leftover after parsing attributes in process `syz.1.901'. [ 150.624028][ T8275] netlink: 328 bytes leftover after parsing attributes in process `syz.4.900'. [ 150.637262][ T8275] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 150.759192][ T8279] netlink: 40 bytes leftover after parsing attributes in process `syz.2.906'. [ 150.772872][ T8279] netlink: 40 bytes leftover after parsing attributes in process `syz.2.906'. [ 150.830634][ T5913] gspca_stk1135: reg_w 0x0 err -71 [ 150.866484][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.873640][ T5913] gspca_stk1135: Sensor write failed [ 150.883453][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.896978][ T5913] gspca_stk1135: Sensor write failed [ 150.902882][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.909500][ T5913] gspca_stk1135: Sensor read failed [ 150.914834][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.924519][ T5913] gspca_stk1135: Sensor read failed [ 150.930134][ T5913] gspca_stk1135: Detected sensor type unknown (0x0) [ 150.938455][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.944962][ T5913] gspca_stk1135: Sensor read failed [ 150.992474][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 150.999127][ T5913] gspca_stk1135: Sensor read failed [ 151.004463][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 151.011382][ T5913] gspca_stk1135: Sensor write failed [ 151.017028][ T5913] gspca_stk1135: serial bus timeout: status=0x00 [ 151.025971][ T5913] gspca_stk1135: Sensor write failed [ 151.031438][ T5913] stk1135 4-1:0.0: probe with driver stk1135 failed with error -71 [ 151.043626][ T5913] usb 4-1: USB disconnect, device number 28 [ 151.273288][ T8294] netlink: 8 bytes leftover after parsing attributes in process `syz.1.913'. [ 151.458448][ T8303] sg_write: data in/out 418268/96 bytes for SCSI command 0x0-- guessing data in; [ 151.458448][ T8303] program syz.1.915 not setting count and/or reply_len properly [ 151.512842][ T8303] netlink: 'syz.1.915': attribute type 3 has an invalid length. [ 151.565969][ T5913] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 151.694430][ T10] hid-generic 0009:0057:0770.0005: unknown main item tag 0x6 [ 151.702166][ T10] hid-generic 0009:0057:0770.0005: item fetching failed at offset 1/3 [ 151.716603][ T10] hid-generic 0009:0057:0770.0005: probe with driver hid-generic failed with error -22 [ 151.726463][ T5913] usb 3-1: Using ep0 maxpacket: 32 [ 151.739716][ T5913] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 151.755233][ T5913] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 151.773077][ T5913] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 151.791656][ T5913] usb 3-1: Product: syz [ 151.801052][ T5913] usb 3-1: Manufacturer: syz [ 151.807077][ T5913] usb 3-1: SerialNumber: syz [ 151.815697][ T5913] usb 3-1: config 0 descriptor?? [ 151.830361][ T8295] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 151.843963][ T5913] hub 3-1:0.0: bad descriptor, ignoring hub [ 151.885848][ T5913] hub 3-1:0.0: probe with driver hub failed with error -5 [ 152.052618][ T8295] use of bytesused == 0 is deprecated and will be removed in the future, [ 152.070581][ T8295] use the actual size instead. [ 152.076202][ T8295] warning: `syz.2.912' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 152.104651][ T8327] netlink: 'syz.4.924': attribute type 27 has an invalid length. [ 152.113912][ T8327] netlink: 'syz.4.924': attribute type 1 has an invalid length. [ 152.196191][ T5913] usb 3-1: USB disconnect, device number 26 [ 152.365181][ T29] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 152.495183][ T29] usb 5-1: device descriptor read/64, error -71 [ 152.735200][ T29] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 152.865195][ T29] usb 5-1: device descriptor read/64, error -71 [ 152.976329][ T29] usb usb5-port1: attempt power cycle [ 153.315248][ T29] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 153.335656][ T29] usb 5-1: device descriptor read/8, error -71 [ 153.575207][ T29] usb 5-1: new full-speed USB device number 15 using dummy_hcd [ 153.595644][ T29] usb 5-1: device descriptor read/8, error -71 [ 153.706697][ T29] usb usb5-port1: unable to enumerate USB device [ 155.181142][ T8338] netlink: 8 bytes leftover after parsing attributes in process `syz.1.926'. [ 155.251059][ T8337] netlink: 'syz.3.928': attribute type 39 has an invalid length. [ 155.281018][ T8337] hsr_slave_0 (unregistering): left promiscuous mode [ 155.515548][ T5195] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 155.663649][ T8363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.938'. [ 155.754217][ T5195] usb 5-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 155.769502][ T5195] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.778108][ T5195] usb 5-1: Product: syz [ 155.782565][ T5195] usb 5-1: Manufacturer: syz [ 155.787925][ T5195] usb 5-1: SerialNumber: syz [ 155.795885][ T5195] usb 5-1: config 0 descriptor?? [ 155.809728][ T5195] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 156.225976][ T5195] gspca_stk1135: reg_w 0x0 err -71 [ 156.235755][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.244417][ T5195] gspca_stk1135: Sensor write failed [ 156.249846][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.256283][ T5195] gspca_stk1135: Sensor write failed [ 156.261627][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.269113][ T5195] gspca_stk1135: Sensor read failed [ 156.274385][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.280789][ T5195] gspca_stk1135: Sensor read failed [ 156.287889][ T5195] gspca_stk1135: Detected sensor type unknown (0x0) [ 156.294604][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.301098][ T5195] gspca_stk1135: Sensor read failed [ 156.307091][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.313454][ T5195] gspca_stk1135: Sensor read failed [ 156.319501][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.325895][ T5195] gspca_stk1135: Sensor write failed [ 156.331202][ T5195] gspca_stk1135: serial bus timeout: status=0x00 [ 156.337569][ T5195] gspca_stk1135: Sensor write failed [ 156.342913][ T5195] stk1135 5-1:0.0: probe with driver stk1135 failed with error -71 [ 156.359217][ T5195] usb 5-1: USB disconnect, device number 16 [ 157.705191][ T8359] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 157.705221][ T5858] Bluetooth: hci2: command 0x0c1a tx timeout [ 158.562884][ T8359] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 158.576783][ T8359] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 158.585203][ T8359] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 158.591494][ T8359] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 158.601016][ T8359] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 158.608358][ T8359] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 158.614335][ T8359] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 158.623244][ T8359] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 158.632637][ T8359] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 158.638924][ T8359] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 158.646011][ T8359] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 158.652991][ T8359] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 158.659320][ T8359] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 158.670202][ T8359] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 158.819145][ T8387] netlink: 'syz.4.946': attribute type 1 has an invalid length. [ 158.916797][ T8394] tmpfs: Unknown parameter 'usrquopa_block_hardlimit' [ 158.925177][ T24] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 158.950967][ T8396] netlink: 8 bytes leftover after parsing attributes in process `syz.1.950'. [ 159.139699][ T5913] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 159.346580][ T5913] usb 5-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 159.356086][ T5913] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 159.369691][ T5913] usb 5-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 159.379249][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.389007][ T5913] usb 5-1: Product: syz [ 159.393260][ T5913] usb 5-1: Manufacturer: syz [ 159.398129][ T5913] usb 5-1: SerialNumber: syz [ 159.407132][ T5913] usb 5-1: config 0 descriptor?? [ 159.420622][ T5913] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 159.435830][ T24] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 159.608726][ T24] usb 3-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 159.617929][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.627796][ T24] usb 3-1: Product: syz [ 159.631973][ T24] usb 3-1: Manufacturer: syz [ 159.636798][ T24] usb 3-1: SerialNumber: syz [ 159.643313][ T24] usb 3-1: config 0 descriptor?? [ 159.656445][ T24] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 159.666206][ T10] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 159.721081][ T8426] netlink: 8 bytes leftover after parsing attributes in process `syz.3.963'. [ 159.785583][ T5858] Bluetooth: hci2: command 0x0c1a tx timeout [ 159.826386][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 159.840338][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 159.857731][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 159.867890][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 159.877708][ T10] usb 2-1: Product: syz [ 159.881914][ T10] usb 2-1: Manufacturer: syz [ 159.887094][ T10] usb 2-1: SerialNumber: syz [ 160.128814][ T10] usb 2-1: BAAD MICROPHONE c_chmask mismatch [ 160.182436][ T24] gspca_stk1135: reg_w 0x0 err -71 [ 160.190110][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.196719][ T24] gspca_stk1135: Sensor write failed [ 160.202075][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.209226][ T24] gspca_stk1135: Sensor write failed [ 160.214577][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.221125][ T24] gspca_stk1135: Sensor read failed [ 160.226526][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.232900][ T24] gspca_stk1135: Sensor read failed [ 160.239147][ T24] gspca_stk1135: Detected sensor type unknown (0x0) [ 160.246143][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.252507][ T24] gspca_stk1135: Sensor read failed [ 160.257956][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.264315][ T24] gspca_stk1135: Sensor read failed [ 160.269771][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.276298][ T24] gspca_stk1135: Sensor write failed [ 160.281634][ T24] gspca_stk1135: serial bus timeout: status=0x00 [ 160.288190][ T24] gspca_stk1135: Sensor write failed [ 160.293570][ T24] stk1135 3-1:0.0: probe with driver stk1135 failed with error -71 [ 160.305265][ T24] usb 3-1: USB disconnect, device number 28 [ 160.359689][ T10] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 160.392308][ T10] usb 2-1: USB disconnect, device number 28 [ 160.426570][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 160.495054][ T8439] overlayfs: missing 'lowerdir' [ 160.665240][ T5858] Bluetooth: hci3: command 0x0c1a tx timeout [ 160.667759][ T5851] Bluetooth: hci4: command 0x0c1a tx timeout [ 160.672893][ T5858] Bluetooth: hci0: command 0x0c1a tx timeout [ 160.677777][ T5860] Bluetooth: hci1: command 0x0c1a tx timeout [ 160.860227][ T8454] netlink: 8 bytes leftover after parsing attributes in process `syz.2.975'. [ 160.885164][ T10] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 161.049390][ T10] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 161.082172][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.101538][ T10] usb 2-1: Product: syz [ 161.110493][ T10] usb 2-1: Manufacturer: syz [ 161.120750][ T10] usb 2-1: SerialNumber: syz [ 161.162748][ T10] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 161.192923][ T5913] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 161.310026][ T8461] capability: warning: `syz.2.977' uses deprecated v2 capabilities in a way that may be insecure [ 161.771509][ T5195] usb 5-1: USB disconnect, device number 17 [ 161.835812][ T29] usb 2-1: USB disconnect, device number 29 [ 161.865217][ T5851] Bluetooth: hci2: command 0x0c1a tx timeout [ 161.899824][ T24] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 162.022509][ T8482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.987'. [ 162.075347][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 162.089540][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 162.110337][ T24] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 2031, setting to 1024 [ 162.133818][ T24] usb 4-1: New USB device found, idVendor=0582, idProduct=0089, bcdDevice= 0.40 [ 162.161643][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.185799][ T24] usb 4-1: Product: â ‰ [ 162.192051][ T24] usb 4-1: SerialNumber: syz [ 162.407402][ T5888] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 162.421422][ T24] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 162.425665][ T5913] usb 2-1: Service connection timeout for: 256 [ 162.435500][ T5913] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 162.444925][ T5913] ath9k_htc: Failed to initialize the device [ 162.453777][ T29] usb 2-1: ath9k_htc: USB layer deinitialized [ 162.463942][ T24] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 162.564848][ T24] usb 4-1: USB disconnect, device number 29 [ 162.611732][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 162.638302][ T5888] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 162.656547][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 162.674287][ T5888] usb 3-1: Product: syz [ 162.682537][ T5888] usb 3-1: Manufacturer: syz [ 162.688809][ T5888] usb 3-1: SerialNumber: syz [ 162.726013][ T5888] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 162.744036][ T29] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 162.754245][ T5851] Bluetooth: hci0: command 0x0c1a tx timeout [ 162.760361][ T5860] Bluetooth: hci3: command 0x0c1a tx timeout [ 162.760437][ T5859] Bluetooth: hci4: command 0x0c1a tx timeout [ 162.772543][ T5858] Bluetooth: hci1: command 0x0c1a tx timeout [ 162.910589][ T8517] netlink: 8 bytes leftover after parsing attributes in process `syz.1.999'. [ 162.947080][ T5913] usb 3-1: USB disconnect, device number 29 [ 163.029741][ T8525] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1001'. [ 163.050255][ T8528] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1001'. [ 163.086060][ T8518] pim6reg1: entered allmulticast mode [ 163.565250][ T5888] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 163.719707][ T8553] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1011'. [ 163.725675][ T24] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 163.742244][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 163.753266][ T5888] usb 4-1: New USB device found, idVendor=7104, idProduct=2202, bcdDevice= 0.40 [ 163.762688][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.771030][ T5888] usb 4-1: Product: syz [ 163.775867][ T5888] usb 4-1: Manufacturer: syz [ 163.785521][ T5888] usb 4-1: SerialNumber: syz [ 163.875770][ T29] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 163.885899][ T29] ath9k_htc: Failed to initialize the device [ 163.896114][ T5913] usb 3-1: ath9k_htc: USB layer deinitialized [ 163.915179][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 163.926586][ T24] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 163.945780][ T24] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 163.965166][ T24] usb 2-1: config 1 has no interface number 0 [ 163.975196][ T24] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 163.997320][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=00a3, bcdDevice= 0.40 [ 164.012455][ T8537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.015342][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.035235][ T8537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.042040][ T24] usb 2-1: Product: syz [ 164.047581][ T24] usb 2-1: Manufacturer: syz [ 164.060766][ T5888] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 164.071443][ T24] usb 2-1: SerialNumber: syz [ 164.080679][ T5888] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 164.108983][ T5888] usb 4-1: USB disconnect, device number 30 [ 164.484142][ T8566] syzkaller1: entered promiscuous mode [ 164.489743][ T8566] syzkaller1: entered allmulticast mode [ 164.825669][ T5859] Bluetooth: hci3: command 0x0c1a tx timeout [ 164.832166][ T5858] Bluetooth: hci0: command 0x0c1a tx timeout [ 164.832256][ T5860] Bluetooth: hci4: command 0x0c1a tx timeout [ 164.838916][ T5859] Bluetooth: hci1: command 0x0c1a tx timeout [ 164.874325][ T8584] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1023'. [ 165.085449][ T8592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 165.121581][ T8592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 165.499247][ T8610] QAT: failed to copy from user cfg_data. [ 165.648614][ T8614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1035'. [ 165.765551][ T996] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 166.068155][ T996] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 166.079493][ T996] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.091624][ T996] usb 4-1: config 0 descriptor?? [ 166.111933][ T996] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 166.309504][ T996] gspca_cpia1: usb_control_msg 05, error -71 [ 166.324419][ T996] gspca_cpia1: usb_control_msg 01, error -71 [ 166.358659][ T996] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 166.386327][ T996] usb 4-1: USB disconnect, device number 31 [ 166.443462][ C0] IPv4: Oversized IP packet from 172.20.20.24 [ 166.563045][ T8653] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1047'. [ 166.757835][ T8661] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 167.146450][ T8679] pim6reg1: entered allmulticast mode [ 167.179422][ T8683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1059'. [ 167.216029][ T8684] tipc: Enabling of bearer rejected, failed to enable media [ 167.230116][ T8684] raw_sendmsg: syz.2.1058 forgot to set AF_INET. Fix it! [ 167.475201][ T5888] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 167.615207][ T10] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 167.635427][ T5888] usb 3-1: device descriptor read/64, error -71 [ 167.827132][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.837457][ T10] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 167.847836][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.868942][ T10] usb 4-1: config 0 descriptor?? [ 167.885001][ T10] pwc: Askey VC010 type 2 USB webcam detected. [ 167.895725][ T5888] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 168.055624][ T5888] usb 3-1: device descriptor read/64, error -71 [ 168.081559][ T10] pwc: recv_control_msg error -32 req 02 val 2b00 [ 168.088782][ T10] pwc: recv_control_msg error -32 req 02 val 2700 [ 168.096786][ T10] pwc: recv_control_msg error -32 req 02 val 2c00 [ 168.123845][ T10] pwc: recv_control_msg error -71 req 04 val 1000 [ 168.134022][ T10] pwc: recv_control_msg error -71 req 04 val 1300 [ 168.150372][ T10] pwc: recv_control_msg error -71 req 04 val 1400 [ 168.167787][ T5888] usb usb3-port1: attempt power cycle [ 168.176491][ T10] pwc: recv_control_msg error -71 req 02 val 2000 [ 168.188351][ T8717] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1071'. [ 168.203955][ T10] pwc: recv_control_msg error -71 req 02 val 2100 [ 168.227637][ T10] pwc: recv_control_msg error -71 req 04 val 1500 [ 168.235743][ T10] pwc: recv_control_msg error -71 req 02 val 2500 [ 168.243967][ T10] pwc: recv_control_msg error -71 req 02 val 2400 [ 168.264097][ T10] pwc: recv_control_msg error -71 req 02 val 2600 [ 168.286723][ T10] pwc: recv_control_msg error -71 req 02 val 2900 [ 168.300025][ T10] pwc: recv_control_msg error -71 req 02 val 2800 [ 168.311266][ T10] pwc: recv_control_msg error -71 req 04 val 1100 [ 168.331714][ T10] pwc: recv_control_msg error -71 req 04 val 1200 [ 168.341449][ T10] pwc: Registered as video103. [ 168.371969][ T10] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input16 [ 168.412005][ T10] usb 4-1: USB disconnect, device number 32 [ 168.527874][ T5888] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 168.566385][ T5888] usb 3-1: device descriptor read/8, error -71 [ 168.611255][ T8730] netlink: 'syz.1.1076': attribute type 10 has an invalid length. [ 168.927983][ T5888] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 168.946348][ T8742] tmpfs: Unknown parameter 'nr_4<†ÿ–ÎÇ' [ 168.966102][ T5888] usb 3-1: device descriptor read/8, error -71 [ 169.031040][ T8744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1083'. [ 169.086285][ T5888] usb usb3-port1: unable to enumerate USB device [ 169.160162][ T24] usb 2-1: unknown sample rate [ 169.288025][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 169.667418][ T8775] netlink: 'syz.4.1097': attribute type 7 has an invalid length. [ 169.721152][ T8777] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1096'. [ 170.222691][ T8805] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1108'. [ 170.465231][ T29] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 170.627794][ T29] usb 5-1: config 2 has an invalid interface number: 184 but max is 0 [ 170.635356][ T10] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 170.643859][ T29] usb 5-1: config 2 has no interface number 0 [ 170.653780][ T29] usb 5-1: config 2 interface 184 has no altsetting 0 [ 170.668708][ T29] usb 5-1: New USB device found, idVendor=046d, idProduct=08c6, bcdDevice= c.2f [ 170.680735][ T29] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.695872][ T29] usb 5-1: Product: syz [ 170.705254][ T29] usb 5-1: Manufacturer: syz [ 170.711425][ T29] usb 5-1: SerialNumber: syz [ 170.763032][ T8836] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1120'. [ 170.795415][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 170.811430][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 170.842360][ T10] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 170.868210][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.898878][ T10] usb 4-1: Product: syz [ 170.913244][ T10] usb 4-1: Manufacturer: syz [ 170.922314][ T10] usb 4-1: SerialNumber: syz [ 170.943121][ T10] usb 4-1: config 0 descriptor?? [ 170.973797][ T10] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 171.002774][ T10] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 171.016986][ T29] usb 5-1: unknown interface protocol 0xd0, assuming v1 [ 171.029381][ T29] usb 5-1: cannot find UAC_HEADER [ 171.073860][ T29] snd-usb-audio 5-1:2.184: probe with driver snd-usb-audio failed with error -22 [ 171.087127][ T29] usb 5-1: USB disconnect, device number 18 [ 171.116027][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:2.184/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 171.415233][ T996] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 171.569631][ T996] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 171.583722][ T10] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 171.590154][ T996] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.599489][ T996] usb 3-1: Product: syz [ 171.607825][ T996] usb 3-1: Manufacturer: syz [ 171.613300][ T996] usb 3-1: SerialNumber: syz [ 171.633785][ T996] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 171.654653][ T5913] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 171.853726][ T8863] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1131'. [ 172.322085][ T8874] netlink: 348 bytes leftover after parsing attributes in process `syz.4.1136'. [ 172.493009][ T10] em28xx 4-1:0.0: write to i2c device at 0xa0 failed with unknown error (status=1) [ 172.517661][ T10] em28xx 4-1:0.0: failed to read eeprom (err=-5) [ 172.537117][ T10] em28xx 4-1:0.0: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 172.561243][ T8883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 172.573353][ T8883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.680028][ T8816] faux_driver vgem: [drm] Unknown color mode 135165; guessing buffer size. [ 172.750529][ T5913] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 172.763971][ T5913] ath9k_htc: Failed to initialize the device [ 172.812392][ T5913] usb 3-1: ath9k_htc: USB layer deinitialized [ 172.855046][ T996] usb 3-1: USB disconnect, device number 34 [ 173.019166][ T8897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1143'. [ 173.155176][ T10] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 173.164827][ T10] em28xx 4-1:0.0: dvb set to bulk mode. [ 173.177211][ T5913] em28xx 4-1:0.0: Binding DVB extension [ 173.221442][ T10] usb 4-1: USB disconnect, device number 33 [ 173.285951][ T10] em28xx 4-1:0.0: Disconnecting em28xx [ 173.353679][ T8903] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1145'. [ 173.382559][ T8903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 173.400728][ T5913] em28xx 4-1:0.0: Registering input extension [ 173.406952][ T8903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 173.426243][ T10] em28xx 4-1:0.0: Closing input extension [ 173.504742][ T10] em28xx 4-1:0.0: Freeing device [ 173.802307][ T8924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1155'. [ 173.855733][ T24] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 173.929067][ T8926] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 174.029823][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 174.046741][ T24] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 174.062467][ T24] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 174.073970][ T24] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 174.089996][ T24] usb 5-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 174.100658][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.111132][ T24] usb 5-1: Product: syz [ 174.115385][ T24] usb 5-1: Manufacturer: syz [ 174.120052][ T24] usb 5-1: SerialNumber: syz [ 174.133173][ T24] usb 5-1: config 0 descriptor?? [ 174.146108][ T24] ums-isd200 5-1:0.0: USB Mass Storage device detected [ 174.248198][ T29] usb 4-1: new full-speed USB device number 34 using dummy_hcd [ 174.350695][ T24] scsi host1: usb-storage 5-1:0.0 [ 174.417911][ T29] usb 4-1: unable to get BOS descriptor or descriptor too short [ 174.427360][ T29] usb 4-1: not running at top speed; connect to a high speed hub [ 174.436839][ T29] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 120, changing to 4 [ 174.451006][ T29] usb 4-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 174.461318][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.471146][ T29] usb 4-1: Product: syz [ 174.475638][ T29] usb 4-1: Manufacturer: syz [ 174.480274][ T29] usb 4-1: SerialNumber: syz [ 174.699281][ T8935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.708339][ T8935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.725292][ T24] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 174.733176][ T29] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 174.742473][ T29] usb 4-1: 2:1 : format type 0 is detected, processed as PCM [ 174.754029][ T29] usb 4-1: 2:1: cannot set freq 13115191 to ep 0x82 [ 174.818402][ T29] usb 4-1: USB disconnect, device number 34 [ 174.873023][ T7258] udevd[7258]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 174.915227][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 174.925132][ T24] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 174.935709][ T24] usb 3-1: config 0 interface 0 has no altsetting 0 [ 174.952011][ T24] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 174.961662][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 174.988062][ T24] usb 3-1: Product: syz [ 174.994745][ T24] usb 3-1: Manufacturer: syz [ 175.003531][ T24] usb 3-1: SerialNumber: syz [ 175.015657][ T24] usb 3-1: config 0 descriptor?? [ 175.024958][ T8951] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 175.138125][ T8965] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1167'. [ 175.414431][ T8972] netlink: 'syz.1.1170': attribute type 2 has an invalid length. [ 175.494310][ T24] gs_usb 3-1:0.0: Configuring for 14 interfaces [ 175.619228][ T8984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.628604][ T8984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.869700][ T8990] qnx4: unable to read the superblock [ 176.038204][ T8996] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1179'. [ 176.278211][ T9001] syz.1.1181 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 176.301656][ T9001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.318966][ T9001] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.368570][ T9003] netlink: 'syz.3.1182': attribute type 2 has an invalid length. [ 176.623108][ T5859] Bluetooth: hci1: unexpected event for opcode 0x0413 [ 176.637065][ T9015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.649654][ T9015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.747570][ T24] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-ETIMEDOUT) [ 176.798559][ T24] gs_usb 3-1:0.0: Couldn't get bit timing const for channel 1 (-EPIPE) [ 176.814538][ T29] usb 5-1: USB disconnect, device number 19 [ 176.918676][ T24] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -32 [ 177.021616][ T9026] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1191'. [ 177.600232][ T9058] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1203'. [ 177.688585][ T9062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.707156][ T9062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.736490][ T9062] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 177.748815][ T9062] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.888362][ T9070] program syz.1.1208 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 177.976897][ T996] usb 5-1: new full-speed USB device number 20 using dummy_hcd [ 178.060163][ T9077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.074007][ T9077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.158185][ T996] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 122, changing to 4 [ 178.172440][ T996] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0078, bcdDevice= 0.40 [ 178.182000][ T996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.191578][ T996] usb 5-1: Product: syz [ 178.196039][ T996] usb 5-1: Manufacturer: syz [ 178.200689][ T996] usb 5-1: SerialNumber: syz [ 178.295637][ T9083] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 178.306106][ T9083] overlayfs: missing 'lowerdir' [ 178.356780][ T9085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1215'. [ 178.425483][ T996] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 178.440708][ T996] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 178.478079][ T996] usb 5-1: USB disconnect, device number 20 [ 178.517686][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 178.545477][ T9089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.554527][ T9089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.565659][ T5913] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 178.735158][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 178.749108][ T5913] usb 4-1: config 6 has an invalid interface number: 220 but max is 0 [ 178.760740][ T5913] usb 4-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 178.777235][ T5913] usb 4-1: config 6 has no interface number 0 [ 178.787576][ T5913] usb 4-1: config 6 interface 220 has no altsetting 0 [ 178.816729][ T5913] usb 4-1: New USB device found, idVendor=174f, idProduct=5212, bcdDevice=40.10 [ 178.827784][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 178.836032][ T5913] usb 4-1: Product: syz [ 178.840377][ T5913] usb 4-1: Manufacturer: syz [ 178.845040][ T5913] usb 4-1: SerialNumber: syz [ 179.080422][ T5913] uvcvideo 4-1:6.220: probe with driver uvcvideo failed with error -22 [ 179.113147][ T5913] usb 4-1: USB disconnect, device number 35 [ 179.197528][ T9116] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1227'. [ 179.373776][ T9127] PKCS8: Unsupported PKCS#8 version [ 179.698224][ T9146] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1239'. [ 180.039970][ T9164] nbd: couldn't find a device at index 16 [ 180.171997][ T9172] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1251'. [ 180.576478][ T9193] netlink: 'syz.2.1259': attribute type 4 has an invalid length. [ 180.584403][ T9193] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.1259'. [ 180.655898][ T5913] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 180.676573][ T5859] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 180.693272][ T5859] Bluetooth: hci1: Injecting HCI hardware error event [ 180.702676][ T5858] Bluetooth: hci1: hardware error 0x00 [ 180.741351][ T9199] trusted_key: encrypted_key: keyword 'uew' not recognized [ 180.807818][ T9201] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1263'. [ 180.826231][ T5913] usb 5-1: Using ep0 maxpacket: 8 [ 180.840229][ T5913] usb 5-1: New USB device found, idVendor=0c45, idProduct=8003, bcdDevice=f9.64 [ 180.856038][ T5913] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=67 [ 180.867420][ T5913] usb 5-1: Product: syz [ 180.871626][ T5913] usb 5-1: Manufacturer: syz [ 180.876758][ T5913] usb 5-1: SerialNumber: syz [ 180.884058][ T5913] usb 5-1: config 0 descriptor?? [ 180.896862][ T5913] gspca_main: sn9c2028-2.14.0 probing 0c45:8003 [ 181.280192][ T9218] syzkaller1: entered promiscuous mode [ 181.286125][ T9218] syzkaller1: entered allmulticast mode [ 181.303376][ T5913] gspca_sn9c2028: read1 error -32 [ 181.319221][ T5913] gspca_sn9c2028: read1 error -32 [ 181.335791][ T5913] sn9c2028 5-1:0.0: probe with driver sn9c2028 failed with error -32 [ 181.468359][ T9229] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1275'. [ 181.494402][ T9230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 181.505762][ T9230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 181.585552][ T9234] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 0 out of range (51000000..2150000000) [ 181.925426][ T9250] syzkaller1: entered promiscuous mode [ 181.931381][ T9250] syzkaller1: entered allmulticast mode [ 181.999238][ T9254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1285'. [ 182.420198][ T9262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.433114][ T9262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.576804][ T9280] overlayfs: failed to resolve './file0': -2 [ 182.687333][ T9286] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1297'. [ 182.745407][ T5858] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 182.754958][ T9290] netlink: 'syz.1.1299': attribute type 2 has an invalid length. [ 183.354995][ T9311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1309'. [ 183.434788][ T9318] netlink: 'syz.1.1311': attribute type 2 has an invalid length. [ 183.444920][ T24] usb 5-1: USB disconnect, device number 21 [ 183.540492][ T9322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.557760][ T9322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.004487][ T9343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1321'. [ 184.295474][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 184.475952][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 184.481576][ T9364] netlink: 19 bytes leftover after parsing attributes in process `syz.1.1331'. [ 184.492585][ T10] usb 5-1: config 0 has an invalid interface number: 4 but max is 0 [ 184.518364][ T10] usb 5-1: config 0 has no interface number 0 [ 184.529348][ T10] usb 5-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 184.551762][ T10] usb 5-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 184.564507][ T10] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 184.574486][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.596902][ T10] usb 5-1: config 0 descriptor?? [ 184.607474][ T9368] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1333'. [ 184.679338][ T9370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.688347][ T9370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.014482][ T10] hid (null): invalid report_size 1937239736 [ 185.024426][ T10] hid (null): unknown global tag 0xc [ 185.030156][ T10] hid (null): report_id 1773941298 is invalid [ 185.036749][ T10] hid (null): unknown global tag 0xd [ 185.042175][ T10] hid (null): global environment stack underflow [ 185.270009][ T29] usb 5-1: USB disconnect, device number 22 [ 185.520409][ T9401] netlink: 'syz.2.1343': attribute type 10 has an invalid length. [ 185.529661][ T9401] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.537441][ T9401] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.550271][ T9404] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1344'. [ 185.555128][ T9401] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.566366][ T9401] bridge0: port 2(bridge_slave_1) entered forwarding state [ 185.573853][ T9401] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.581053][ T9401] bridge0: port 1(bridge_slave_0) entered forwarding state [ 185.592958][ T9401] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 185.759873][ T9412] tipc: Started in network mode [ 185.764768][ T9412] tipc: Node identity aaaaaaaaaa38, cluster identity 4711 [ 185.772123][ T9412] tipc: Enabled bearer , priority 0 [ 185.905165][ T29] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 186.027594][ T9424] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.089682][ T29] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 186.133882][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.148669][ T29] usb 4-1: Product: syz [ 186.164592][ T29] usb 4-1: Manufacturer: syz [ 186.184317][ T29] usb 4-1: SerialNumber: syz [ 186.261207][ T9437] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1356'. [ 186.312703][ T9441] Invalid source name [ 186.486523][ T9446] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.502735][ T9446] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.522382][ T9446] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.535054][ T9446] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 186.759057][ T29] usb 4-1: unit 4 not found! [ 186.766048][ T29] usb 4-1: unit 36 not found! [ 186.780389][ T29] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 186.803778][ T29] usb 4-1: unit 4 not found! [ 186.808816][ T29] usb 4-1: unit 36 not found! [ 186.819418][ T29] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 186.840059][ T29] usb 4-1: unit 4 not found! [ 186.844963][ T29] usb 4-1: unit 36 not found! [ 186.965474][ T9457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.989130][ T9457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.006456][ T29] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 187.023443][ T29] usb 4-1: USB disconnect, device number 36 [ 187.078780][ T6302] udevd[6302]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 187.189650][ T9467] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1368'. [ 187.299646][ T9471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.308534][ T9471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.503141][ T9472] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 187.511975][ T9472] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.516516][ T82] wlan1: Trigger new scan to find an IBSS to join [ 188.568422][ T996] tipc: Node number set to 9611946 [ 188.766781][ T9493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.781970][ T9493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.799963][ T9493] netlink: 'syz.2.1376': attribute type 2 has an invalid length. [ 188.813735][ T9493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1376'. [ 188.847509][ T9493] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.866577][ T9493] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 188.970850][ T9499] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 189.062295][ T9503] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1380'. [ 189.136804][ T9507] netlink: 128124 bytes leftover after parsing attributes in process `syz.1.1382'. [ 189.141407][ T9508] Bluetooth: MGMT ver 1.23 [ 189.153046][ T9507] x_tables: duplicate entry at hook 1 [ 189.510172][ T9524] tipc: Can't bind to reserved service type 0 [ 189.717957][ T9531] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 189.794821][ T9534] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1392'. [ 189.961247][ T9549] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0) [ 190.466316][ T9570] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1405'. [ 190.559335][ T9574] tmpfs: Unknown parameter 'grpquota' [ 190.972899][ T9598] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1417'. [ 191.020773][ T9600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.058550][ T9600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.197729][ T9606] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3918892086 (125404546752 ns) > initial count (95458267904 ns). Using initial count to start timer. [ 191.333930][ T9620] x_tables: ip_tables: TCPMSS target: only valid for protocol 6 [ 191.354906][ T9620] netlink: 'syz.4.1425': attribute type 1 has an invalid length. [ 191.465790][ T12] wlan1: Trigger new scan to find an IBSS to join [ 191.669202][ T9632] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1429'. [ 191.716639][ T996] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 191.729240][ T9636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.742552][ T9636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.864834][ T9644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.874105][ T9644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.886956][ T996] usb 4-1: Using ep0 maxpacket: 8 [ 191.893551][ T996] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 191.907070][ T996] usb 4-1: New USB device found, idVendor=0421, idProduct=798f, bcdDevice=86.54 [ 191.917300][ T996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 191.925522][ T996] usb 4-1: Product: syz [ 191.929695][ T996] usb 4-1: Manufacturer: syz [ 191.934296][ T996] usb 4-1: SerialNumber: syz [ 191.940973][ T996] usb 4-1: config 0 descriptor?? [ 191.949988][ T996] cdc_phonet 4-1:0.0: probe with driver cdc_phonet failed with error -22 [ 192.158138][ T9624] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1426'. [ 192.172616][ T9624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.184452][ T9624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.196574][ T9624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 192.205883][ T9624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 192.216169][ T5930] usb 4-1: USB disconnect, device number 37 [ 192.707192][ T9666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1441'. [ 192.755543][ T809] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 192.935154][ T809] usb 5-1: Using ep0 maxpacket: 8 [ 192.948669][ T809] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 192.960655][ T809] usb 5-1: config 179 has no interface number 0 [ 192.968505][ T809] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 192.990802][ T809] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 193.005361][ T809] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 193.018144][ T809] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 193.031194][ T809] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 193.046592][ T809] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 193.056512][ T809] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.063852][ T9687] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.1448'. [ 193.097052][ T9687] bridge_slave_1: default FDB implementation only supports local addresses [ 193.108198][ T9660] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 193.408144][ T809] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input19 [ 193.524783][ T9702] 9p: Bad value for 'rfdno' [ 193.531899][ T9660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 193.545645][ T9660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 193.772421][ T5930] usb 5-1: USB disconnect, device number 23 [ 193.772439][ C0] xpad 5-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 193.786688][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 193.845057][ T9708] netdevsim netdevsim3: Firmware load for '..' refused, path contains '..' component [ 193.881314][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 193.887730][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 193.905248][ T5858] Bluetooth: hci2: unexpected event 0x0f length: 97 > 4 [ 193.905291][ T5858] Bluetooth: hci2: unexpected event for opcode 0x200d [ 193.925912][ T9709] netdevsim netdevsim3: Firmware load for '..' refused, path contains '..' component [ 193.938228][ T5858] Bluetooth: hci2: unexpected event 0x0f length: 97 > 4 [ 193.938259][ T5858] Bluetooth: hci2: unexpected event for opcode 0x200d [ 193.939765][ T9708] binder: BINDER_SET_CONTEXT_MGR already set [ 193.974103][ T9708] binder: 9707:9708 ioctl 4018620d 200000000080 returned -16 [ 194.079159][ T9716] __nla_validate_parse: 1 callbacks suppressed [ 194.079176][ T9716] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1460'. [ 194.270912][ T9725] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1464'. [ 194.378794][ T9724] syzkaller1: entered promiscuous mode [ 194.409597][ T9724] syzkaller1: entered allmulticast mode [ 194.507630][ T12] wlan1: Trigger new scan to find an IBSS to join [ 194.719346][ T9747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1474'. [ 194.795481][ T996] usb 5-1: new full-speed USB device number 24 using dummy_hcd [ 194.986636][ T996] usb 5-1: config 201 has an invalid interface number: 249 but max is 0 [ 194.995162][ T996] usb 5-1: config 201 has an invalid descriptor of length 0, skipping remainder of the config [ 195.005689][ T996] usb 5-1: config 201 has no interface number 0 [ 195.012004][ T996] usb 5-1: config 201 interface 249 altsetting 4 has an endpoint descriptor with address 0xF1, changing to 0x81 [ 195.024710][ T996] usb 5-1: config 201 interface 249 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 195.036916][ T996] usb 5-1: config 201 interface 249 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 195.051506][ T996] usb 5-1: config 201 interface 249 has no altsetting 0 [ 195.061408][ T996] usb 5-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=fa.df [ 195.072325][ T996] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.081985][ T996] usb 5-1: Product: syz [ 195.086343][ T996] usb 5-1: Manufacturer: syz [ 195.090978][ T996] usb 5-1: SerialNumber: syz [ 195.137364][ T9756] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1478'. [ 195.343164][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1481'. [ 195.353445][ T9764] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1481'. [ 195.372234][ T9764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 195.381841][ T9764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.437530][ T82] wlan1: Creating new IBSS network, BSSID 00:00:00:8d:00:00 [ 195.519556][ T996] ath6kl: Failed to submit usb control message: -71 [ 195.530529][ T996] ath6kl: unable to send the bmi data to the device: -71 [ 195.537646][ T996] ath6kl: Unable to send get target info: -71 [ 195.551390][ T996] ath6kl: Failed to init ath6kl core: -71 [ 195.558546][ T996] ath6kl_usb 5-1:201.249: probe with driver ath6kl_usb failed with error -71 [ 195.574428][ T996] usb 5-1: USB disconnect, device number 24 [ 196.090185][ T9776] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1486'. [ 196.770911][ T9801] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1496'. [ 196.781728][ T9797] can: request_module (can-proto-0) failed. [ 196.795327][ T809] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 196.843468][ T9803] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1498'. [ 196.900001][ T9795] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1490'. [ 196.922530][ T9807] ADFS-fs (loop1): error: unable to read block 3, try 0 [ 196.965911][ T809] usb 5-1: Using ep0 maxpacket: 8 [ 196.997922][ T809] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 197.019232][ T809] usb 5-1: New USB device found, idVendor=0421, idProduct=798f, bcdDevice=86.54 [ 197.036361][ T809] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.054559][ T809] usb 5-1: Product: syz [ 197.059363][ T809] usb 5-1: Manufacturer: syz [ 197.085817][ T809] usb 5-1: SerialNumber: syz [ 197.149229][ T809] usb 5-1: config 0 descriptor?? [ 197.176696][ T809] cdc_phonet 5-1:0.0: probe with driver cdc_phonet failed with error -22 [ 197.390419][ T5888] usb 5-1: USB disconnect, device number 25 [ 197.486086][ T9829] netlink: 'syz.2.1508': attribute type 3 has an invalid length. [ 197.493968][ T9829] netlink: 'syz.2.1508': attribute type 1 has an invalid length. [ 197.504228][ T9829] NCSI netlink: No device for ifindex 0 [ 197.567567][ T996] usb 4-1: new full-speed USB device number 38 using dummy_hcd [ 197.577208][ T9835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 197.588289][ T9835] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 197.879060][ T996] usb 4-1: config 0 has an invalid interface number: 172 but max is 0 [ 197.887321][ T996] usb 4-1: config 0 has no interface number 0 [ 197.893432][ T996] usb 4-1: config 0 interface 172 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 197.906640][ T996] usb 4-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 197.925153][ T996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.934017][ T996] usb 4-1: Product: syz [ 197.938570][ T996] usb 4-1: Manufacturer: syz [ 197.943187][ T996] usb 4-1: SerialNumber: syz [ 197.950410][ T996] usb 4-1: config 0 descriptor?? [ 197.968253][ T996] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 198.193223][ T996] gspca_pac7302: reg_w() failed i: ff v: 01 error -71 [ 198.211373][ T996] gspca_pac7302 4-1:0.172: probe with driver gspca_pac7302 failed with error -71 [ 198.256127][ T996] usb 4-1: USB disconnect, device number 38 [ 198.745794][ T996] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 198.928861][ T996] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 198.937168][ T996] usb 4-1: config 1 has no interface number 0 [ 198.959212][ T996] usb 4-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 198.979185][ T996] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 199.013900][ T809] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 199.026106][ T996] usb 4-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 199.042036][ T996] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 199.053974][ T996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 199.063233][ T996] usb 4-1: Product: syz [ 199.067708][ T996] usb 4-1: Manufacturer: syz [ 199.072365][ T996] usb 4-1: SerialNumber: syz [ 199.081568][ T9871] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 199.166600][ T809] usb 5-1: device descriptor read/64, error -71 [ 199.291017][ T9912] netlink: 'syz.2.1541': attribute type 1 has an invalid length. [ 199.303655][ T9871] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 199.318643][ T9912] virtiofs: Unknown parameter 'always 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 18 nlmon0 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 20 batadv0 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 21 vxcan0 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 22 vxcan1 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 23 veth0 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 24 veth1 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 25 wg0 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 26 wg1 : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 27 ªªªªªª : 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 28 veth0_to_bridge: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 29 bridge_slave_0: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 30 veth1_to_bridge: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 31 bridge_slave_1: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 32 veth0_to_bond: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:00000000 0 [ 199.318643][ T9912] 33 bond_slave_0: 1 V3 [ 199.318643][ T9912] 010000E0 1 0:0 [ 199.319317][ T9912] overlay: ./bus is not a directory [ 199.519390][ T996] usb 4-1: Incompatible driver and firmware versions [ 199.537508][ T809] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 199.565689][ T996] usb 4-1: USB disconnect, device number 39 [ 199.674772][ T9921] __nla_validate_parse: 5 callbacks suppressed [ 199.674787][ T9921] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1545'. [ 199.694987][ T9922] IPVS: Unknown mcast interface: wg2 [ 199.705417][ T809] usb 5-1: device descriptor read/64, error -71 [ 199.759468][ T9926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 199.771059][ T9926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 199.828023][ T809] usb usb5-port1: attempt power cycle [ 200.175335][ T9950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1557'. [ 200.245334][ T809] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 200.286815][ T809] usb 5-1: device descriptor read/8, error -71 [ 200.338212][ T9957] kAFS: unable to lookup cell '@mTsyz0' [ 200.384994][ T9957] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1559'. [ 200.535167][ T809] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 200.538795][ T9969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 200.552802][ T9969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 200.577357][ T809] usb 5-1: device descriptor read/8, error -71 [ 200.623059][ T9973] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1567'. [ 200.695829][ T809] usb usb5-port1: unable to enumerate USB device [ 200.868405][ T9982] mmap: syz.1.1571 (9982) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 200.938501][ T9985] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 201.228697][ T9999] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1579'. [ 201.295215][T10003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.317694][T10003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.539437][T10010] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1583'. [ 201.846123][T10016] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1585'. [ 202.007030][ T30] kauditd_printk_skb: 322 callbacks suppressed [ 202.007048][ T30] audit: type=1326 audit(1773825605.518:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9994 comm="syz.3.1577" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f443999c799 code=0x7fc00000 [ 202.103868][T10025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1591'. [ 202.201965][T10032] netlink: 'syz.1.1592': attribute type 10 has an invalid length. [ 202.219421][T10032] netlink: 55 bytes leftover after parsing attributes in process `syz.1.1592'. [ 202.813115][T10051] netlink: 'syz.4.1598': attribute type 1 has an invalid length. [ 202.840757][T10051] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1598'. [ 202.859479][T10051] netlink: 'syz.4.1598': attribute type 1 has an invalid length. [ 202.876162][T10052] IPv6: NLM_F_CREATE should be specified when creating new route [ 202.884369][T10051] IPv6: NLM_F_CREATE should be specified when creating new route [ 203.206069][ T809] usb 5-1: new low-speed USB device number 30 using dummy_hcd [ 203.348562][ T809] usb 5-1: device descriptor read/64, error -71 [ 203.605246][ T809] usb 5-1: new low-speed USB device number 31 using dummy_hcd [ 203.642844][T10089] syzkaller1: entered promiscuous mode [ 203.650249][T10089] syzkaller1: entered allmulticast mode [ 203.745377][ T809] usb 5-1: device descriptor read/64, error -71 [ 203.875579][ T809] usb usb5-port1: attempt power cycle [ 204.035582][ T5888] usb 4-1: new full-speed USB device number 40 using dummy_hcd [ 204.227305][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 204.239182][ T5888] usb 4-1: not running at top speed; connect to a high speed hub [ 204.258972][ T5888] usb 4-1: config index 0 descriptor too short (expected 8192, got 149) [ 204.278254][ T5888] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 204.307586][ T5888] usb 4-1: config 0 has no interfaces? [ 204.320920][ T5888] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 204.337492][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.338765][ T809] usb 5-1: new low-speed USB device number 32 using dummy_hcd [ 204.355323][ T5888] usb 4-1: Product: syz [ 204.365448][ T5888] usb 4-1: Manufacturer: syz [ 204.376952][ T5888] usb 4-1: SerialNumber: syz [ 204.385694][ T809] usb 5-1: device descriptor read/8, error -71 [ 204.408179][ T5888] usb 4-1: config 0 descriptor?? [ 204.629981][T10098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.643078][T10098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.646181][ T809] usb 5-1: new low-speed USB device number 33 using dummy_hcd [ 204.668469][ T5888] usb 4-1: USB disconnect, device number 40 [ 204.686326][ T809] usb 5-1: device descriptor read/8, error -71 [ 204.693512][T10140] __nla_validate_parse: 6 callbacks suppressed [ 204.693523][T10140] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1628'. [ 204.738872][T10138] random: crng reseeded on system resumption [ 204.819311][T10147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 204.835627][ T809] usb usb5-port1: unable to enumerate USB device [ 204.875636][T10147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.899000][T10147] program syz.1.1631 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 205.166456][ T5913] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 205.228058][T10161] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1636'. [ 205.325450][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 205.331900][ T5913] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 205.343024][ T5913] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 205.354053][ T5913] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 205.368758][ T5913] usb 4-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 205.378082][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.386221][ T5913] usb 4-1: Product: syz [ 205.390408][ T5913] usb 4-1: Manufacturer: syz [ 205.396579][ T5913] usb 4-1: SerialNumber: syz [ 205.403454][ T5913] usb 4-1: config 0 descriptor?? [ 205.419096][ T5913] input: KB Gear Tablet as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input20 [ 205.616062][ T5913] usb 4-1: USB disconnect, device number 41 [ 205.682602][T10172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 205.691524][T10172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 206.401566][T10190] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1648'. [ 206.908657][T10216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1659'. [ 207.276224][T10244] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1668'. [ 207.336927][T10245] fuse: Unknown parameter 'loup_id' [ 207.793855][T10269] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1676'. [ 207.909110][T10278] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1678'. [ 207.974104][T10280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 207.984379][T10280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.003479][T10280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 208.022150][T10280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 208.473283][T10302] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 208.493421][T10301] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1689'. [ 208.589951][ T24] IPVS: starting estimator thread 0... [ 208.595714][T10306] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 208.695335][T10307] IPVS: using max 32 ests per chain, 76800 per kthread [ 209.051078][T10329] netlink: 'syz.1.1700': attribute type 2 has an invalid length. [ 209.059931][T10329] netlink: 'syz.1.1700': attribute type 1 has an invalid length. [ 209.077564][T10330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1701'. [ 209.127405][T10332] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 209.167013][T10332] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 209.199172][T10337] netlink: 'syz.1.1700': attribute type 2 has an invalid length. [ 209.222065][T10337] netlink: 'syz.1.1700': attribute type 1 has an invalid length. [ 209.693430][T10364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1714'. [ 209.695968][ T30] audit: type=1326 audit(1773825613.175:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.779625][ T30] audit: type=1326 audit(1773825613.175:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=451 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.807414][ T30] audit: type=1326 audit(1773825613.175:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.833189][ T30] audit: type=1326 audit(1773825613.175:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.863656][ T30] audit: type=1326 audit(1773825613.175:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.886499][ T30] audit: type=1326 audit(1773825613.175:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.909857][ T30] audit: type=1326 audit(1773825613.175:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.934531][ T30] audit: type=1326 audit(1773825613.175:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.958796][ T30] audit: type=1326 audit(1773825613.175:350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 209.984308][ T30] audit: type=1326 audit(1773825613.175:351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10362 comm="syz.2.1712" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x7fc00000 [ 210.393039][T10397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1726'. [ 210.437113][T10399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 210.445901][T10399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 210.455350][ T5913] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 210.596598][ T5913] usb 4-1: device descriptor read/64, error -71 [ 210.632677][T10405] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1730'. [ 210.864303][ T5913] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 211.024488][ T5913] usb 4-1: device descriptor read/64, error -71 [ 211.066098][T10422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1738'. [ 211.166749][ T5913] usb usb4-port1: attempt power cycle [ 211.182191][T10431] netlink: 'syz.1.1742': attribute type 3 has an invalid length. [ 211.347413][T10443] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1745'. [ 211.499652][T10450] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1749'. [ 211.600036][ T5913] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 211.623315][ T5913] usb 4-1: device descriptor read/8, error -71 [ 211.859774][T10468] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 211.870260][T10468] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 211.890340][ T5913] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 211.911888][ T5913] usb 4-1: device descriptor read/8, error -71 [ 212.007625][ T5888] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 212.038514][T10472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1759'. [ 212.040956][ T5913] usb usb4-port1: unable to enumerate USB device [ 212.091360][T10476] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 212.100610][T10476] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 212.169361][ T5888] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 212.179725][ T5888] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 212.190847][ T5888] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 212.205594][ T5888] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 212.214718][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.226676][ T5888] usb 5-1: Product: syz [ 212.230851][ T5888] usb 5-1: Manufacturer: syz [ 212.235564][ T5888] usb 5-1: SerialNumber: syz [ 212.247798][ T5888] cdc_mbim 5-1:1.0: skipping garbage [ 212.895061][ T5888] cdc_mbim 5-1:1.0: failed GET_NTB_PARAMETERS [ 212.902387][ T5888] cdc_mbim 5-1:1.0: bind() failure [ 212.911838][ T5888] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 212.918856][ T5888] cdc_ncm 5-1:1.1: bind() failure [ 212.929352][ T5888] usb 5-1: USB disconnect, device number 34 [ 212.982751][T10491] tmpfs: Bad value for 'mpol' [ 213.529766][T10497] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:19999 [ 213.539921][T10497] netlink: 'syz.4.1769': attribute type 27 has an invalid length. [ 213.577116][T10497] IPVS: set_ctl: invalid protocol: 32 58.0.0.0:56354 [ 213.670872][T10505] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1771'. [ 213.735775][T10507] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 213.742438][T10507] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 213.756466][T10507] vhci_hcd vhci_hcd.0: Device attached [ 213.778888][T10508] vhci_hcd: cannot find a urb of seqnum 49 max seqnum 0 [ 213.795063][T10507] netlink: 'syz.3.1772': attribute type 6 has an invalid length. [ 213.805677][ T82] vhci_hcd vhci_hcd.3: stop threads [ 213.820333][ T82] vhci_hcd vhci_hcd.3: release socket [ 213.838708][ T82] vhci_hcd vhci_hcd.3: disconnect device [ 214.160905][T10525] netlink: 'syz.4.1778': attribute type 10 has an invalid length. [ 214.189355][T10525] batman_adv: batadv0: Adding interface: netdevsim0 [ 214.196359][T10525] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.237995][T10525] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 214.321172][T10532] (syz.4.1781,10532,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 214.330436][T10532] (syz.4.1781,10532,0):ocfs2_sb_probe:753 ERROR: status = -5 [ 214.341410][T10532] (syz.4.1781,10532,0):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 214.360437][T10532] (syz.4.1781,10532,0):ocfs2_fill_super:1177 ERROR: status = -5 [ 214.398211][T10533] (syz.4.1781,10533,1):ocfs2_get_sector:1714 ERROR: status = -5 [ 214.409769][T10533] (syz.4.1781,10533,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 214.412107][T10537] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1782'. [ 214.419045][T10533] (syz.4.1781,10533,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 214.444161][T10533] (syz.4.1781,10533,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 214.529770][T10543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.546516][T10543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.568326][T10542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 214.579055][T10542] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 214.930698][T10555] tipc: Started in network mode [ 214.935669][T10555] tipc: Node identity 6e03036c8485, cluster identity 4711 [ 214.944091][T10555] tipc: Enabled bearer , priority 0 [ 215.001859][T10555] syzkaller0: entered promiscuous mode [ 215.007341][T10555] syzkaller0: entered allmulticast mode [ 215.014070][T10555] tipc: Resetting bearer [ 215.065479][ T5888] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 215.076622][ T1156] tipc: Resetting bearer [ 215.225070][ T5888] usb 4-1: Using ep0 maxpacket: 8 [ 215.232216][ T5888] usb 4-1: unable to get BOS descriptor or descriptor too short [ 215.244182][ T5888] usb 4-1: New USB device found, idVendor=041e, idProduct=3042, bcdDevice= 0.40 [ 215.253547][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 215.262482][ T5888] usb 4-1: Product: syz [ 215.266727][ T5888] usb 4-1: Manufacturer: syz [ 215.272571][ T5888] usb 4-1: SerialNumber: syz [ 215.289303][ T809] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 215.441509][T10563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1794'. [ 215.458391][ T809] usb 5-1: config 17 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 215.480285][ T809] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 215.500373][ T809] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.509379][ T5888] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 215.616820][ T5888] usb 4-1: USB disconnect, device number 46 [ 215.637459][T10570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.674812][T10570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.702530][T10570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 215.725191][T10570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 215.754700][ T809] aiptek 5-1:17.0: Aiptek using 400 ms programming speed [ 215.769438][T10554] tipc: Resetting bearer [ 215.777801][ T809] input: Aiptek as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:17.0/input/input21 [ 215.860465][ T809] usb 5-1: USB disconnect, device number 35 [ 215.866444][ C0] aiptek 5-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 216.496912][T10589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 216.506825][T10589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 217.328794][T10605] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1806'. [ 217.476656][T10609] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1808'. [ 217.603946][T10554] tipc: Disabling bearer [ 217.616738][ T5913] tipc: Node number set to 3934651244 [ 218.044785][T10629] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1815'. [ 218.117812][T10633] cgroup2: Unknown parameter 'm%mory_r' [ 218.134722][T10633] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.1817'. [ 218.381493][T10646] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 218.407634][T10646] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 218.438519][T10646] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 218.518411][ T5888] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 218.618376][T10658] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1827'. [ 218.690559][ T5888] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 218.712678][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.729446][ T5888] usb 5-1: config 0 descriptor?? [ 218.739426][ T5888] cp210x 5-1:0.0: cp210x converter detected [ 219.168493][ T5888] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 219.222038][ T5888] cp210x 5-1:0.0: failed to get vendor val 0x3711 size 2: -121 [ 219.233313][ T5888] cp210x 5-1:0.0: GPIO initialisation failed: -121 [ 219.250158][ T5888] usb 5-1: cp210x converter now attached to ttyUSB0 [ 219.411203][T10694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.428233][T10694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.443730][T10694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.454441][T10695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.466095][T10694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.475184][T10695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.489372][T10694] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 219.499760][T10694] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 219.508184][T10697] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1839'. [ 220.572658][T10727] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1850'. [ 220.650901][T10731] netlink: 'syz.1.1850': attribute type 10 has an invalid length. [ 220.720890][T10731] team0 (unregistering): Port device team_slave_0 removed [ 220.730865][T10735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1851'. [ 220.753201][T10731] team0 (unregistering): Port device team_slave_1 removed [ 220.875670][T10739] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1853'. [ 220.917279][T10739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1853'. [ 220.949148][T10739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 220.975104][T10739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.000010][T10739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 221.024135][T10739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 221.532646][ T809] usb 5-1: USB disconnect, device number 36 [ 221.556474][ T809] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 221.569234][ T809] cp210x 5-1:0.0: device disconnected [ 221.997243][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.152488][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.267791][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.358592][ T5859] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 222.373345][ T5859] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 222.381690][ T5859] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 222.394042][ T5859] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 222.402378][ T5859] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 222.424452][ T13] batman_adv: batadv0: Removing interface: netdevsim0 [ 222.453180][ T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 222.586806][T10798] netlink: 'syz.1.1877': attribute type 4 has an invalid length. [ 222.618824][T10798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 222.641280][T10798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 222.675042][ T13] bridge_slave_1: left allmulticast mode [ 222.680988][ T13] bridge_slave_1: left promiscuous mode [ 222.688813][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 222.697778][ T5888] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 222.709953][ T13] bridge_slave_0: left allmulticast mode [ 222.715588][ T13] bridge_slave_0: left promiscuous mode [ 222.721502][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 222.867861][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 222.874690][ T5888] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 222.882844][ T5888] usb 4-1: config 0 has no interface number 0 [ 222.890741][ T5888] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 222.899801][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 222.909024][ T5888] usb 4-1: Product: syz [ 222.913380][ T5888] usb 4-1: Manufacturer: syz [ 222.918005][ T5888] usb 4-1: SerialNumber: syz [ 222.933231][ T5888] usb 4-1: config 0 descriptor?? [ 222.935161][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 222.946345][ T5888] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 222.961045][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 222.973760][ T13] bond0 (unregistering): Released all slaves [ 223.052529][ T13] : left promiscuous mode [ 223.134572][T10789] chnl_net:caif_netlink_parms(): no params data found [ 223.161857][ T13] tipc: Left network mode [ 223.200324][ T5888] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 223.216683][ T5888] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 223.603877][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 223.606306][ T809] usb 4-1: USB disconnect, device number 47 [ 223.634386][ T809] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 223.696191][ T809] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 223.722366][ T809] quatech2 4-1:0.51: device disconnected [ 223.789885][T10789] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.797247][T10789] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.811644][T10789] bridge_slave_0: entered allmulticast mode [ 223.820374][T10789] bridge_slave_0: entered promiscuous mode [ 223.829545][T10789] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.844852][T10789] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.852765][T10789] bridge_slave_1: entered allmulticast mode [ 223.861125][T10789] bridge_slave_1: entered promiscuous mode [ 223.914529][ T13] hsr_slave_0: left promiscuous mode [ 223.924411][ T13] hsr_slave_1: left promiscuous mode [ 223.930748][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 223.940646][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 223.950892][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 223.958507][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 223.974579][ T13] veth1_macvtap: left promiscuous mode [ 223.980842][ T13] veth0_macvtap: left promiscuous mode [ 223.986518][ T13] veth1_vlan: left allmulticast mode [ 223.992545][ T13] veth1_vlan: left promiscuous mode [ 223.997792][ T13] veth0_vlan: left promiscuous mode [ 224.405155][ T13] team0 (unregistering): Port device team_slave_1 removed [ 224.426709][ T13] team0 (unregistering): Port device team_slave_0 removed [ 224.502636][T10836] __nla_validate_parse: 3 callbacks suppressed [ 224.502650][T10836] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1883'. [ 224.519561][T10836] netlink: 'syz.3.1883': attribute type 6 has an invalid length. [ 224.528422][T10836] netlink: 'syz.3.1883': attribute type 5 has an invalid length. [ 224.536423][T10836] netlink: 'syz.3.1883': attribute type 4 has an invalid length. [ 224.622269][ T5858] Bluetooth: hci4: command tx timeout [ 224.636832][T10839] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1884'. [ 224.746777][T10789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.806942][T10845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1887'. [ 224.829148][T10789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.956156][T10789] team0: Port device team_slave_0 added [ 224.970246][T10789] team0: Port device team_slave_1 added [ 225.045661][T10789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 225.068528][T10789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.105572][T10789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 225.119659][T10789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 225.127119][T10789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.185239][T10789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 225.304569][T10789] hsr_slave_0: entered promiscuous mode [ 225.312054][T10789] hsr_slave_1: entered promiscuous mode [ 225.338248][T10789] debugfs: 'hsr0' already exists in 'hsr' [ 225.366874][T10789] Cannot create hsr debugfs directory [ 225.511115][T10871] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1894'. [ 225.634552][T10877] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1897'. [ 225.693052][T10875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.713728][T10875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.972026][T10891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.022504][T10891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 226.168097][T10789] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 226.209990][T10789] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 226.250102][T10789] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 226.311872][T10789] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 226.454677][T10910] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1905'. [ 226.491074][T10789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 226.550296][T10789] 8021q: adding VLAN 0 to HW filter on device team0 [ 226.575823][ T1181] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 226.587423][ T1009] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.594639][ T1009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.630491][ T1009] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.637710][ T1009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.701494][T10918] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1908'. [ 226.767731][T10920] overlayfs: missing 'workdir' [ 226.834055][ T5858] Bluetooth: hci4: command tx timeout [ 227.188124][T10789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 227.770537][T10968] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1917'. [ 227.877216][T10974] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1920'. [ 227.924251][T10789] veth0_vlan: entered promiscuous mode [ 227.977014][T10789] veth1_vlan: entered promiscuous mode [ 228.024518][T10982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.035795][T10982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.054655][T10982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 228.074381][T10982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 228.136890][T10789] veth0_macvtap: entered promiscuous mode [ 228.154038][T10789] veth1_macvtap: entered promiscuous mode [ 228.188758][T10789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 228.208419][T10789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 228.258303][ T82] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.285394][ T82] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.301876][ T48] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.324721][ T48] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 228.536816][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.560489][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 228.606403][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 228.627715][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 229.057186][ T5858] Bluetooth: hci4: command tx timeout [ 229.096328][ T10] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 229.216645][T11019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1932'. [ 229.295238][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 229.341084][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 229.364718][ T10] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 229.380026][ T10] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 229.390760][ T10] usb 4-1: Manufacturer: syz [ 229.404696][ T10] usb 4-1: config 0 descriptor?? [ 229.404962][T11026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.442966][T11026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.761644][T11045] random: crng reseeded on system resumption [ 229.857420][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.866041][T11049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.875824][T11049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.885212][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.903575][T11049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 229.908836][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.912697][T11049] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 229.940419][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.948486][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.956614][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.963608][ T10] pyra 0003:1E7D:2CF6.0007: unknown main item tag 0x0 [ 229.979268][ T10] pyra 0003:1E7D:2CF6.0007: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 230.499760][ T10] pyra 0003:1E7D:2CF6.0007: couldn't init struct pyra_device [ 230.512485][ T10] pyra 0003:1E7D:2CF6.0007: couldn't install mouse [ 230.527951][ T10] pyra 0003:1E7D:2CF6.0007: probe with driver pyra failed with error -71 [ 230.553100][ T10] usb 4-1: USB disconnect, device number 48 [ 230.669588][T11069] fido_id[11069]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 230.836575][T11076] __nla_validate_parse: 1 callbacks suppressed [ 230.836590][T11076] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1954'. [ 230.954644][T11080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.963745][T11080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.145739][T11087] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 231.175893][T11087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.202193][T11087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.281215][ T5858] Bluetooth: hci4: command tx timeout [ 231.297740][T11095] netlink: 'syz.2.1961': attribute type 4 has an invalid length. [ 231.321676][T11095] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1961'. [ 231.372615][T11095] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 231.415768][T11095] program syz.2.1961 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 231.536237][T11105] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1965'. [ 231.790187][ T10] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 231.844305][ T10] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 232.289682][T11138] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1976'. [ 232.426326][T11141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1977'. [ 232.897175][T11158] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.925441][T11158] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.075074][T11169] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1987'. [ 233.289887][ T996] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 233.771454][ T5855] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 233.952579][ T5855] usb 4-1: Using ep0 maxpacket: 16 [ 233.964649][ T5855] usb 4-1: unable to get BOS descriptor or descriptor too short [ 233.973618][ T5855] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 233.994477][ T5855] usb 4-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 234.010756][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 234.023098][ T5855] usb 4-1: Product: syz [ 234.028290][ T5855] usb 4-1: Manufacturer: syz [ 234.034232][ T5855] usb 4-1: SerialNumber: syz [ 234.261348][T11175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.283096][T11175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.315143][ T5855] usb 4-1: failed waiting for Axe-Fx III to boot: -71 [ 234.324367][ T5855] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 234.350230][ T5855] usb 4-1: USB disconnect, device number 49 [ 234.539277][T11193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1998'. [ 234.549788][T11190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.558787][T11190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.077000][ T5859] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 235.092363][ T5859] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 235.102568][ T5859] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 235.114863][ T5859] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 235.129665][ T5859] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 235.437071][T11225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2008'. [ 235.560435][T11231] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.573005][T11231] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.683016][ T8562] bridge0: port 3(syz_tun) entered disabled state [ 235.756790][ T8562] syz_tun (unregistering): left allmulticast mode [ 235.763675][ T8562] syz_tun (unregistering): left promiscuous mode [ 235.772269][ T8562] bridge0: port 3(syz_tun) entered disabled state [ 236.003608][ T996] usb 2-1: USB disconnect, device number 30 [ 236.012357][T11245] random: crng reseeded on system resumption [ 236.046328][T11212] chnl_net:caif_netlink_parms(): no params data found [ 236.228582][ T82] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.282690][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2019'. [ 236.304343][ T5855] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 236.362756][T11261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.373677][T11261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 236.402591][ T82] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.476740][ T5855] usb 6-1: Using ep0 maxpacket: 32 [ 236.493024][ T5855] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 236.508834][ T5855] usb 6-1: config 0 has no interface number 0 [ 236.534272][ T5855] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 236.550712][ T82] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.603493][ T5855] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.612099][T11212] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.619586][ T5855] usb 6-1: Product: syz [ 236.626643][ T5855] usb 6-1: Manufacturer: syz [ 236.631552][T11212] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.638998][ T5855] usb 6-1: SerialNumber: syz [ 236.639151][T11212] bridge_slave_0: entered allmulticast mode [ 236.655756][T11212] bridge_slave_0: entered promiscuous mode [ 236.666613][ T5855] usb 6-1: config 0 descriptor?? [ 236.679258][T11212] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.695826][T11212] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.703380][T11212] bridge_slave_1: entered allmulticast mode [ 236.716755][T11212] bridge_slave_1: entered promiscuous mode [ 236.739191][ T82] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 236.824340][T11212] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 236.838445][T11212] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 236.895379][T11212] team0: Port device team_slave_0 added [ 236.911776][T11212] team0: Port device team_slave_1 added [ 236.964198][T11271] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 236.987784][ T30] kauditd_printk_skb: 127 callbacks suppressed [ 236.987797][ T30] audit: type=1326 audit(1773825638.706:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11270 comm="syz.3.2024" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f443999c799 code=0x0 [ 237.058837][T11212] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 237.068642][T11212] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 237.108613][T11212] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 237.122139][ T5855] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 237.132784][T11212] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 237.132884][T11212] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 237.132909][T11212] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 237.183721][ T5855] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 237.323676][T11212] hsr_slave_0: entered promiscuous mode [ 237.331572][T11212] hsr_slave_1: entered promiscuous mode [ 237.338706][T11212] debugfs: 'hsr0' already exists in 'hsr' [ 237.345582][T11212] Cannot create hsr debugfs directory [ 237.352678][ T5858] Bluetooth: hci5: command tx timeout [ 237.383245][ T82] bridge_slave_1: left allmulticast mode [ 237.389656][ T82] bridge_slave_1: left promiscuous mode [ 237.396444][ T82] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.410987][ T82] bridge_slave_0: left allmulticast mode [ 237.424997][ T82] bridge_slave_0: left promiscuous mode [ 237.436890][ T82] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.482174][T11287] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2029'. [ 237.548162][T11291] netlink: 'syz.2.2030': attribute type 37 has an invalid length. [ 237.639301][T11245] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 237.703272][T11245] CIFS mount error: No usable UNC path provided in device string! [ 237.703272][T11245] [ 237.717863][T11245] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 237.755812][ T5855] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 237.784229][ T5855] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 237.816301][ T5855] usb 6-1: USB disconnect, device number 3 [ 237.838858][ T82] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 237.940622][ T82] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 237.968836][ T82] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 238.006236][ T82] bond0 (unregistering): Released all slaves [ 238.560247][ T5855] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 238.599002][ T82] hsr_slave_0: left promiscuous mode [ 238.606732][ T82] hsr_slave_1: left promiscuous mode [ 238.613449][ T82] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.622756][ T82] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 238.633456][ T82] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 238.642132][ T82] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 238.683999][ T82] veth1_macvtap: left promiscuous mode [ 238.689918][T11323] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2038'. [ 238.696441][ T82] veth0_macvtap: left promiscuous mode [ 238.744215][ T5855] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 238.768894][ T5855] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 238.817522][ T5855] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 238.830589][ T5855] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 238.842149][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.855204][ T5855] usb 4-1: config 0 descriptor?? [ 239.117208][T11334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.146078][T11334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.178754][T11334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 239.193310][T11334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 239.351281][ T5855] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 239.575129][ T5858] Bluetooth: hci5: command tx timeout [ 240.209582][T11212] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 240.225257][T11212] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 240.240630][T11212] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 240.268185][T11212] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 240.551023][T11212] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.596658][T11212] 8021q: adding VLAN 0 to HW filter on device team0 [ 240.613698][ T82] bridge0: port 1(bridge_slave_0) entered blocking state [ 240.620910][ T82] bridge0: port 1(bridge_slave_0) entered forwarding state [ 240.655743][ T82] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.662940][ T82] bridge0: port 2(bridge_slave_1) entered forwarding state [ 240.721419][ C0] plantronics 0003:047F:FFFF.0009: usb_submit_urb(ctrl) failed: -1 [ 240.876254][T11391] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2048'. [ 241.035274][T11212] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 241.111703][T11399] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2049'. [ 241.158009][T11212] veth0_vlan: entered promiscuous mode [ 241.180621][T11212] veth1_vlan: entered promiscuous mode [ 241.287169][T11212] veth0_macvtap: entered promiscuous mode [ 241.315202][T11212] veth1_macvtap: entered promiscuous mode [ 241.434457][T11212] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 241.482832][T11212] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 241.526087][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.547267][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.565459][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.577879][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 241.721512][ T1181] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 241.753522][ T1181] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 241.805321][ T5858] Bluetooth: hci5: command tx timeout [ 241.853270][ T809] usb 4-1: reset high-speed USB device number 50 using dummy_hcd [ 241.881477][ T1181] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 241.900454][ T1181] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 241.945054][T11424] netlink: 'syz.5.2054': attribute type 10 has an invalid length. [ 241.967726][T11424] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2054'. [ 241.990138][T11424] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 242.035505][ T809] usb 4-1: device firmware changed [ 242.044972][ T5913] usb 4-1: USB disconnect, device number 50 [ 242.300978][ T5913] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 242.349340][T11440] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2058'. [ 242.473885][ T30] audit: type=1326 audit(1773825643.842:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11447 comm="syz.2.2060" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0d01d9c799 code=0x0 [ 242.510014][ T5913] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 242.526054][ T5913] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 242.554874][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 242.587410][ T5913] usb 4-1: config 0 descriptor?? [ 242.609477][T11452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 242.639584][ T5913] pwc: Askey VC010 type 2 USB webcam detected. [ 242.663988][T11452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.717741][ T5888] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 242.889061][ T5888] usb 6-1: Using ep0 maxpacket: 8 [ 242.901388][ T5888] usb 6-1: unable to get BOS descriptor or descriptor too short [ 242.922385][ T5888] usb 6-1: config 1 has an invalid interface number: 96 but max is 2 [ 242.936312][ T5888] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 242.959559][ T5888] usb 6-1: config 1 has 4 interfaces, different from the descriptor's value: 3 [ 242.985563][ T5888] usb 6-1: config 1 has no interface number 3 [ 242.992714][ T5888] usb 6-1: too many endpoints for config 1 interface 96 altsetting 137: 244, using maximum allowed: 30 [ 243.026917][ T5888] usb 6-1: config 1 interface 96 altsetting 137 has 0 endpoint descriptors, different from the interface descriptor's value: 244 [ 243.042730][ T5888] usb 6-1: config 1 interface 96 has no altsetting 0 [ 243.063504][ T5888] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice= 0.40 [ 243.081127][ T5888] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 243.102554][ T5888] usb 6-1: Product: syz [ 243.107996][ T5888] usb 6-1: Manufacturer: syz [ 243.117104][ T5888] usb 6-1: SerialNumber: syz [ 243.382109][ T5913] pwc: send_video_command error -71 [ 243.396362][ T5913] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 243.419254][ T5913] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 243.448306][ T9] hid (null): unknown global tag 0xe [ 243.463272][ T5913] usb 4-1: USB disconnect, device number 51 [ 243.473105][ T9] hid (null): report_id 40584 is invalid [ 243.481607][ T9] hid (null): global environment stack underflow [ 243.498757][ T9] hid (null): global environment stack underflow [ 243.525813][ T9] hid-generic 0007:0100:0001.000A: unknown global tag 0xe [ 243.535423][ T9] hid-generic 0007:0100:0001.000A: item 0 1 1 14 parsing failed [ 243.547217][ T9] hid-generic 0007:0100:0001.000A: probe with driver hid-generic failed with error -22 [ 243.807637][ T5888] usb 6-1: USB disconnect, device number 4 [ 243.937788][ T7257] udevd[7257]: setting owner of /dev/bus/usb/006/004 to uid=0, gid=0 failed: No such file or directory [ 244.021812][ T5858] Bluetooth: hci5: command tx timeout [ 244.057123][ T6302] udevd[6302]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.1/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 244.082163][ T7257] udevd[7257]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 244.093092][ T6581] udevd[6581]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.96/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 244.161813][ T7262] udevd[7262]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.2/sound/card6/controlC6/../uevent} for writing: No such file or directory [ 244.380674][T11508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2070'. [ 244.568064][ T24] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 244.771465][ T24] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 244.795074][ T24] usb 6-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 244.822923][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 244.839857][ T24] usb 6-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 244.851568][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 244.868242][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 244.882466][ T24] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 244.894387][ T24] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 244.904713][ T24] usb 6-1: Product: syz [ 244.909095][ T24] usb 6-1: Manufacturer: syz [ 244.921421][T11505] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 244.932859][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 244.938285][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 244.946698][ T24] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 244.956288][ T24] cdc_wdm 6-1:1.0: Unknown control protocol [ 244.989026][T11529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 245.152537][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.159343][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.166018][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.172636][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.179189][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.185800][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.192915][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.199543][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.206398][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.213047][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.219486][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.226099][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.233636][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.240254][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.247126][T11537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.255542][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.255561][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.262613][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.262632][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.269085][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 245.269103][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 245.309155][T11537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.326050][T11505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.341295][T11505] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.524319][ T9] usb 6-1: USB disconnect, device number 5 [ 245.526830][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 245.544152][T11505] cdc_wdm 6-1:1.0: Tx URB error: -19 [ 245.555412][T11545] cdc_wdm 6-1:1.0: Tx URB error: -19 [ 245.711451][ T24] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 245.784742][T11558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2080'. [ 245.893045][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 245.915313][ T24] usb 2-1: config 0 has no interfaces? [ 245.929767][ T24] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 245.963015][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.996276][ T24] usb 2-1: Product: syz [ 246.016660][ T24] usb 2-1: Manufacturer: syz [ 246.031940][ T24] usb 2-1: SerialNumber: syz [ 246.062063][ T24] usb 2-1: config 0 descriptor?? [ 246.345238][ T24] usb 2-1: USB disconnect, device number 31 [ 246.470877][T11587] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2087'. [ 246.664469][T11594] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2090'. [ 246.767698][T11597] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2091'. [ 246.969646][T11601] netlink: 'syz.5.2093': attribute type 1 has an invalid length. [ 247.371551][T11625] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2103'. [ 247.485210][ T24] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 247.730969][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 247.738143][ T24] usb 2-1: config 6 has an invalid interface number: 130 but max is 0 [ 247.748159][ T24] usb 2-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 247.758997][ T24] usb 2-1: config 6 has no interface number 0 [ 247.765157][ T24] usb 2-1: config 6 interface 130 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 247.781435][ T24] usb 2-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 247.791250][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.799320][ T24] usb 2-1: Product: syz [ 247.803486][ T24] usb 2-1: Manufacturer: syz [ 247.808523][ T24] usb 2-1: SerialNumber: syz [ 247.870115][ T5888] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 248.052385][ T5888] usb 4-1: Using ep0 maxpacket: 32 [ 248.058939][ T5888] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 248.070578][ T5888] usb 4-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 248.081569][ T5888] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.089660][ T5888] usb 4-1: Product: syz [ 248.093982][ T5888] usb 4-1: Manufacturer: syz [ 248.098817][ T5888] usb 4-1: SerialNumber: syz [ 248.335848][ T5888] usb 4-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 248.362080][ T5888] usb 4-1: unit 4 not found! [ 248.366740][ T5888] usb 4-1: unit 85 not found! [ 248.424269][ T5888] usb 4-1: USB disconnect, device number 52 [ 248.474051][ T5861] udevd[5861]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 248.929078][ T5888] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 248.969459][T11648] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2113'. [ 249.090931][ T5888] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 249.104698][ T5888] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 249.126461][ T5888] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 249.139841][ T5888] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 249.157698][ T5888] usb 6-1: Manufacturer: syz [ 249.208528][ T5888] usb 6-1: config 0 descriptor?? [ 249.293451][ T5888] rc_core: IR keymap rc-hauppauge not found [ 249.301809][ T5888] Registered IR keymap rc-empty [ 249.309963][ T5888] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 249.323040][ T5888] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input24 [ 249.888912][T11681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2124'. [ 249.958376][ T9] usb 6-1: USB disconnect, device number 6 [ 250.259609][T10119] usb 2-1: USB disconnect, device number 32 [ 250.613009][T11712] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2134'. [ 251.089013][T11730] ieee802154 phy0 wpan0: encryption failed: -22 [ 251.279093][T11742] ieee802154 phy0 wpan0: encryption failed: -22 [ 251.310114][T11744] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2146'. [ 251.388723][ T9] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 251.404108][T11750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.415845][T11750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.447955][T11750] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.464758][T11750] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.491289][T11750] Can't find a SQUASHFS superblock on nullb0 [ 251.557851][ T996] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 251.571511][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 251.583181][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 251.600546][ T9] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b1, bcdDevice= 0.40 [ 251.609995][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.619876][ T9] usb 2-1: Product: syz [ 251.638823][ T9] usb 2-1: Manufacturer: syz [ 251.652343][ T9] usb 2-1: SerialNumber: syz [ 251.739506][ T996] usb 4-1: Using ep0 maxpacket: 8 [ 251.755725][ T996] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 251.773029][ T996] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 251.789533][ T996] usb 4-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 251.800075][ T996] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 251.808846][ T996] usb 4-1: Product: syz [ 251.813163][ T996] usb 4-1: Manufacturer: syz [ 251.818153][ T996] usb 4-1: SerialNumber: syz [ 251.830797][ T996] usb 4-1: config 0 descriptor?? [ 251.894972][ T9] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 251.918498][ T9] usb 2-1: USB disconnect, device number 33 [ 252.095636][ T996] usb 4-1: USB disconnect, device number 53 [ 252.266419][T11769] netlink: 'syz.2.2156': attribute type 10 has an invalid length. [ 252.280599][T11769] team0: Device vxcan1 is of different type [ 252.426479][T11773] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2158'. [ 252.528471][ T5913] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 252.565216][ T5913] hid-generic 0000:0000:0000.000B: hidraw0: HID v0.00 Device [syz1] on syz0 [ 253.003190][ T5913] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 253.217242][ T5913] usb 4-1: Using ep0 maxpacket: 16 [ 253.238618][ T1181] Bluetooth: hci3: Frame reassembly failed (-84) [ 253.250249][ T5913] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 253.268771][ T5913] usb 4-1: config 0 has no interface number 0 [ 253.284131][ T5913] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 253.295246][ T5913] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 253.305941][ T5913] usb 4-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 253.316208][ T5913] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 253.336278][ T5913] usb 4-1: config 0 descriptor?? [ 253.483885][T11806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2170'. [ 253.685290][ T31] INFO: task syz.0.328:6730 blocked for more than 143 seconds. [ 253.713194][ T31] Tainted: G L syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 253.734880][ T31] Blocked by coredump. [ 253.739729][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 253.749349][ T31] task:syz.0.328 state:D stack:28704 pid:6730 tgid:6729 ppid:5846 task_flags:0x40054c flags:0x00080000 [ 253.761566][ T31] Call Trace: [ 253.764905][ T31] [ 253.767889][ T31] __schedule+0x1665/0x5590 [ 253.774075][ T31] ? __pfx___schedule+0x10/0x10 [ 253.779161][ T31] ? schedule+0x90/0x360 [ 253.783552][ T31] schedule+0x164/0x360 [ 253.790343][ T31] schedule_preempt_disabled+0x13/0x30 [ 253.799953][ T31] rwsem_down_read_slowpath+0x6d9/0x940 [ 253.812126][ T31] ? rwsem_down_read_slowpath+0x596/0x940 [ 254.006572][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 254.016683][ T31] ? do_futex+0x395/0x420 [ 254.021107][ T31] down_read+0x99/0x2e0 [ 254.025314][ T31] ? exit_mm+0x64/0x250 [ 254.029693][ T31] exit_mm+0x73/0x250 [ 254.033733][ T31] ? unwind_deferred_task_exit+0x67/0xa0 [ 254.039421][ T31] do_exit+0x8b9/0x2490 [ 254.043629][ T31] ? __pfx_do_exit+0x10/0x10 [ 254.048277][ T31] do_group_exit+0x21b/0x2d0 [ 254.053789][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 254.059106][ T31] get_signal+0x1284/0x1330 [ 254.063681][ T31] arch_do_signal_or_restart+0xbc/0x830 [ 254.069279][ T31] ? __pfx_aa_sk_perm+0x10/0x10 [ 254.074217][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 254.080520][ T31] exit_to_user_mode_loop+0x86/0x480 [ 254.085856][ T31] ? rcu_is_watching+0x15/0xb0 [ 254.090666][ T31] do_syscall_64+0x32d/0xf80 [ 254.095323][ T31] ? trace_irq_disable+0x3b/0x150 [ 254.100392][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.106530][ T31] ? clear_bhb_loop+0x40/0x90 [ 254.111259][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.118029][ T31] RIP: 0033:0x7f23dc19c799 [ 254.122520][ T31] RSP: 002b:00007f23dd00a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 254.131122][ T31] RAX: 0000000000000000 RBX: 00007f23dc415fa0 RCX: 00007f23dc19c799 [ 254.139160][ T31] RDX: 000000000000000d RSI: 0000000000000107 RDI: 0000000000000003 [ 254.155229][ T31] RBP: 00007f23dc232c99 R08: 000000000000001c R09: 0000000000000000 [ 254.167502][ T31] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000000 [ 254.197984][ T31] R13: 00007f23dc416038 R14: 00007f23dc415fa0 R15: 00007fff4a0aecf8 [ 254.206057][ T31] [ 254.210063][ T31] INFO: task syz.0.328:6731 blocked for more than 143 seconds. [ 254.231914][ T31] Tainted: G L syzkaller #0 [ 254.246704][ T31] Blocked by coredump. [ 254.256293][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 254.267099][ T24] usb 3-1: USB disconnect, device number 35 [ 254.275760][ T31] task:syz.0.328 state:D stack:21248 pid:6731 tgid:6729 ppid:5846 task_flags:0x40044c flags:0x00080000 [ 254.299314][ T31] Call Trace: [ 254.308882][ T31] [ 254.313588][ T31] __schedule+0x1665/0x5590 [ 254.319253][ T31] ? __pfx___schedule+0x10/0x10 [ 254.324220][ T31] ? schedule+0x90/0x360 [ 254.328905][ T31] schedule+0x164/0x360 [ 254.333137][ T31] schedule_preempt_disabled+0x13/0x30 [ 254.340125][ T31] rwsem_down_read_slowpath+0x6d9/0x940 [ 254.346067][ T31] ? rwsem_down_read_slowpath+0x596/0x940 [ 254.361683][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 254.367830][ T31] ? do_futex+0x395/0x420 [ 254.380033][ T31] down_read+0x99/0x2e0 [ 254.384263][ T31] ? exit_mm+0x64/0x250 [ 254.388468][ T31] exit_mm+0x73/0x250 [ 254.393031][ T31] ? unwind_deferred_task_exit+0x67/0xa0 [ 254.398731][ T31] do_exit+0x8b9/0x2490 [ 254.403320][ T31] ? do_user_addr_fault+0xf26/0x1340 [ 254.408676][ T31] ? irqentry_exit+0x61a/0x700 [ 254.415047][ T31] ? __pfx_do_exit+0x10/0x10 [ 254.419703][ T31] ? irqentry_exit+0x61a/0x700 [ 254.425911][ T31] do_group_exit+0x21b/0x2d0 [ 254.430568][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 254.436060][ T31] get_signal+0x1284/0x1330 [ 254.440948][ T31] arch_do_signal_or_restart+0xbc/0x830 [ 254.446789][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 254.453020][ T31] exit_to_user_mode_loop+0x86/0x480 [ 254.459646][ T31] ? rcu_is_watching+0x15/0xb0 [ 254.464508][ T31] do_syscall_64+0x32d/0xf80 [ 254.469328][ T31] ? trace_irq_disable+0x3b/0x150 [ 254.474711][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.481627][ T31] ? clear_bhb_loop+0x40/0x90 [ 254.486362][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.494563][ T31] RIP: 0033:0x7f23dc19c799 [ 254.499288][ T31] RSP: 002b:00007f23dcfe9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 254.507761][ T31] RAX: fffffffffffffff2 RBX: 00007f23dc416090 RCX: 00007f23dc19c799 [ 254.516195][ T31] RDX: 0000000000000002 RSI: 0000200000000800 RDI: 0000000000000004 [ 254.524595][ T31] RBP: 00007f23dc232c99 R08: 0000000000000000 R09: 0000000000000000 [ 254.533930][ T31] R10: 0000000004000840 R11: 0000000000000246 R12: 0000000000000000 [ 254.543529][ T31] R13: 00007f23dc416128 R14: 00007f23dc416090 R15: 00007fff4a0aecf8 [ 254.552444][ T31] [ 254.556123][ T31] INFO: task syz.0.328:6733 blocked for more than 144 seconds. [ 254.582810][ T31] Tainted: G L syzkaller #0 [ 254.594298][ T31] Blocked by coredump. [ 254.605248][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 254.626030][ T31] task:syz.0.328 state:D stack:29328 pid:6733 tgid:6729 ppid:5846 task_flags:0x40044c flags:0x00080000 [ 254.657578][ T31] Call Trace: [ 254.661036][ T31] [ 254.664010][ T31] __schedule+0x1665/0x5590 [ 254.669902][ T31] ? __pfx___schedule+0x10/0x10 [ 254.674848][ T31] ? schedule+0x90/0x360 [ 254.679534][ T31] schedule+0x164/0x360 [ 254.683752][ T31] schedule_preempt_disabled+0x13/0x30 [ 254.689263][ T31] rwsem_down_read_slowpath+0x6d9/0x940 [ 254.697181][ T31] ? rwsem_down_read_slowpath+0x596/0x940 [ 254.703269][ T31] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [ 254.712631][ T31] ? do_futex+0x395/0x420 [ 254.717049][ T31] down_read+0x99/0x2e0 [ 254.721246][ T31] ? exit_mm+0x64/0x250 [ 254.726857][ T31] exit_mm+0x73/0x250 [ 254.730949][ T31] ? unwind_deferred_task_exit+0x67/0xa0 [ 254.736998][ T31] do_exit+0x8b9/0x2490 [ 254.741217][ T31] ? __pfx_do_exit+0x10/0x10 [ 254.746243][ T31] do_group_exit+0x21b/0x2d0 [ 254.750893][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 254.756519][ T31] get_signal+0x1284/0x1330 [ 254.761096][ T31] arch_do_signal_or_restart+0xbc/0x830 [ 254.768052][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 254.774280][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 254.780626][ T31] ? lock_acquire+0xf0/0x2e0 [ 254.785285][ T31] exit_to_user_mode_loop+0x86/0x480 [ 254.790974][ T31] ? rcu_is_watching+0x15/0xb0 [ 254.795817][ T31] ret_from_fork+0x59d/0xb90 [ 254.800979][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 254.806155][ T31] ? __switch_to+0xc7d/0x1450 [ 254.812540][ T31] ret_from_fork_asm+0x1a/0x30 [ 254.819353][ T31] [ 254.822532][ T31] [ 254.822532][ T31] Showing all locks held in the system: [ 254.834885][ T31] 1 lock held by rcu_exp_gp_kthr/18: [ 254.861867][ T31] #0: ffff8880b853ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 254.882019][ T31] 6 locks held by kworker/1:0/24: [ 254.888878][ T31] 1 lock held by khungtaskd/31: [ 254.903383][ T31] #0: ffffffff8eb5d6a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 254.926204][ T31] 3 locks held by kworker/0:3/996: [ 254.935704][ T31] #0: ffff88813fe03140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x894/0x1780 [ 254.957207][ T31] #1: ffffc9000520fc40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1780 [ 254.973565][ T31] #2: ffffffff8eb638e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 254.984691][ T31] 2 locks held by getty/5606: [ 254.989546][ T31] #0: ffff88803742a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 254.999349][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 255.009673][ T31] 3 locks held by kworker/u9:3/5858: [ 255.018269][ T31] #0: ffff88802072b140 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x894/0x1780 [ 255.029842][ T31] #1: ffffc90004417c40 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1780 [ 255.043112][ T31] #2: ffff888035890ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_power_on+0x1ac/0x710 [ 255.052582][ T31] 6 locks held by kworker/0:5/5913: [ 255.060909][ T31] #0: ffff888021efb940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x894/0x1780 [ 255.071844][ T31] #1: ffffc90004737c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1780 [ 255.083970][ T31] #2: ffff88802a1f0190 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 255.094400][ T31] #3: ffff88807a17d190 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 255.103859][ T31] #4: ffff888078f21158 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 255.113349][ T31] #5: ffff8880767cda10 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 255.122786][ T31] 1 lock held by syz.0.328/6730: [ 255.127777][ T31] #0: ffff88807dd7dab8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 [ 255.138353][ T31] 1 lock held by syz.0.328/6731: [ 255.146618][ T31] #0: ffff88807dd7dab8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 [ 255.155625][ T31] 1 lock held by syz.0.328/6733: [ 255.160722][ T31] #0: ffff88807dd7dab8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 [ 255.169578][ T31] 2 locks held by syz.2.2165/11792: [ 255.177335][ T31] #0: ffff888075cfb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_release+0xb8/0x520 [ 255.187586][ T31] #1: ffff888075cfc0a0 (&tty->ldisc_sem/1){+.+.}-{0:0}, at: tty_ldisc_release+0xdc/0x520 [ 255.197741][ T31] 5 locks held by syz.5.2174/11823: [ 255.204898][ T31] #0: ffff888034108ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 255.215025][ T31] #1: ffff8880341080b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 255.225058][ T31] #2: ffffffff90182a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 255.235311][ T31] #3: ffff8880571f1af0 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 [ 255.244685][ T31] #4: ffffffff8eb638e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 255.259670][ T31] 1 lock held by syz.1.2175/11821: [ 255.274653][ T31] [ 255.283916][ T31] ============================================= [ 255.283916][ T31] [ 255.315182][ T31] NMI backtrace for cpu 1 [ 255.315202][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 255.315231][ T31] Tainted: [L]=SOFTLOCKUP [ 255.315237][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 255.315247][ T31] Call Trace: [ 255.315254][ T31] [ 255.315261][ T31] dump_stack_lvl+0xe8/0x150 [ 255.315289][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 255.315312][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 255.315337][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 255.315361][ T31] sys_info+0x135/0x170 [ 255.315378][ T31] watchdog+0x1002/0x1060 [ 255.315412][ T31] ? watchdog+0x1da/0x1060 [ 255.315437][ T31] kthread+0x388/0x470 [ 255.315456][ T31] ? __pfx_watchdog+0x10/0x10 [ 255.315473][ T31] ? __pfx_kthread+0x10/0x10 [ 255.315493][ T31] ret_from_fork+0x51e/0xb90 [ 255.315520][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 255.315543][ T31] ? __switch_to+0xc7d/0x1450 [ 255.315568][ T31] ? __pfx_kthread+0x10/0x10 [ 255.315588][ T31] ret_from_fork_asm+0x1a/0x30 [ 255.315616][ T31] [ 255.315622][ T31] Sending NMI from CPU 1 to CPUs 0: [ 255.406236][ T5859] Bluetooth: hci3: command 0x1003 tx timeout [ 255.410764][ C0] NMI backtrace for cpu 0 [ 255.410779][ C0] CPU: 0 UID: 0 PID: 5859 Comm: kworker/u9:4 Tainted: G L syzkaller #0 PREEMPT(full) [ 255.410800][ C0] Tainted: [L]=SOFTLOCKUP [ 255.410805][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 255.410814][ C0] Workqueue: hci3 hci_cmd_timeout [ 255.410832][ C0] RIP: 0010:__lock_acquire+0x17a8/0x2cf0 [ 255.410861][ C0] Code: 00 00 00 01 00 00 00 48 89 05 c4 ca c9 14 48 8d 84 24 90 00 00 00 48 89 05 b5 4a c9 14 31 ff 45 31 e4 4d 85 e4 4c 8b 6c 24 10 <74> 30 49 8b 44 24 30 48 85 c0 74 26 48 8b 40 10 48 83 c0 30 49 8b [ 255.410874][ C0] RSP: 0018:ffffc900044274a0 EFLAGS: 00000082 [ 255.410886][ C0] RAX: 0000000000000144 RBX: 0000000000000144 RCX: 0000000000000008 [ 255.410895][ C0] RDX: ffffffff940ee640 RSI: ffff88807c04c8c8 RDI: 0000000000000144 [ 255.410905][ C0] RBP: a30774b0a4053c4b R08: ffffc90004427468 R09: 0000000000000020 [ 255.410915][ C0] R10: dffffc0000000000 R11: ffffffff81a35030 R12: ffffffff96f26bc8 [ 255.410926][ C0] R13: ffff88807c04c8f0 R14: ffff88807c04bd00 R15: 0000000000000002 [ 255.410936][ C0] FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 [ 255.410948][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 255.410957][ C0] CR2: 00007ffd0061af18 CR3: 000000000e94a000 CR4: 00000000003526f0 [ 255.410971][ C0] Call Trace: [ 255.410976][ C0] [ 255.410991][ C0] lock_acquire+0xf0/0x2e0 [ 255.411011][ C0] ? console_flush_all+0x123/0xb20 [ 255.411030][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 255.411048][ C0] ? console_flush_all+0x123/0xb20 [ 255.411064][ C0] console_flush_all+0x6c1/0xb20 [ 255.411081][ C0] ? console_flush_all+0x123/0xb20 [ 255.411098][ C0] ? console_flush_all+0x123/0xb20 [ 255.411117][ C0] ? __pfx_console_flush_all+0x10/0x10 [ 255.411135][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 255.411156][ C0] console_unlock+0xd1/0x1c0 [ 255.411171][ C0] ? __pfx_console_unlock+0x10/0x10 [ 255.411187][ C0] ? vprintk_emit+0x455/0x560 [ 255.411201][ C0] ? vprintk_emit+0x2cf/0x560 [ 255.411214][ C0] ? vprintk_emit+0x2cf/0x560 [ 255.411235][ C0] vprintk_emit+0x485/0x560 [ 255.411250][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 255.411266][ C0] ? stack_trace_save+0xa9/0x100 [ 255.411285][ C0] _printk+0xdd/0x130 [ 255.411303][ C0] ? __pfx__printk+0x10/0x10 [ 255.411319][ C0] ? __lock_acquire+0x146e/0x2cf0 [ 255.411343][ C0] bt_err+0x121/0x180 [ 255.411361][ C0] ? __pfx_bt_err+0x10/0x10 [ 255.411383][ C0] hci_cmd_timeout+0xd8/0x1e0 [ 255.411396][ C0] ? process_one_work+0x8bb/0x1780 [ 255.411416][ C0] process_one_work+0x9ab/0x1780 [ 255.411444][ C0] ? __pfx_process_one_work+0x10/0x10 [ 255.411463][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 255.411486][ C0] worker_thread+0xba8/0x11e0 [ 255.411508][ C0] kthread+0x388/0x470 [ 255.411524][ C0] ? __pfx_worker_thread+0x10/0x10 [ 255.411535][ C0] ? __pfx_kthread+0x10/0x10 [ 255.411551][ C0] ret_from_fork+0x51e/0xb90 [ 255.411572][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 255.411591][ C0] ? __switch_to+0xc7d/0x1450 [ 255.411609][ C0] ? __pfx_kthread+0x10/0x10 [ 255.411625][ C0] ret_from_fork_asm+0x1a/0x30 [ 255.411644][ C0] [ 255.427550][ T5858] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 255.534443][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 255.534489][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 255.534556][ T31] Tainted: [L]=SOFTLOCKUP [ 255.534568][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 255.534595][ T31] Call Trace: [ 255.534620][ T31] [ 255.534633][ T31] vpanic+0x56c/0xa60 [ 255.534688][ T31] ? __pfx_vpanic+0x10/0x10 [ 255.534742][ T31] ? irqentry_exit+0x61a/0x700 [ 255.534785][ T31] panic+0xc5/0xd0 [ 255.534822][ T31] ? __pfx_panic+0x10/0x10 [ 255.534895][ T31] ? __pfx_panic+0x10/0x10 [ 255.534940][ T31] watchdog+0x105b/0x1060 [ 255.535010][ T31] ? watchdog+0x1da/0x1060 [ 255.535071][ T31] kthread+0x388/0x470 [ 255.535122][ T31] ? __pfx_watchdog+0x10/0x10 [ 255.535173][ T31] ? __pfx_kthread+0x10/0x10 [ 255.535232][ T31] ret_from_fork+0x51e/0xb90 [ 255.535295][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 255.535357][ T31] ? __switch_to+0xc7d/0x1450 [ 255.535418][ T31] ? __pfx_kthread+0x10/0x10 [ 255.535475][ T31] ret_from_fork_asm+0x1a/0x30 [ 255.535577][ T31] [ 255.541463][ T31] Kernel Offset: disabled