last executing test programs: 5m53.251955504s ago: executing program 0 (id=54): r0 = socket(0x10, 0x803, 0x0) r1 = msgget$private(0x0, 0x428) msgrcv(r1, 0x0, 0x0, 0x3, 0x0) msgrcv(r1, 0x0, 0x0, 0x2, 0x2000) msgsnd(r1, &(0x7f0000000500)={0x1}, 0x8, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x20800001, 0x4) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000480)=0x1, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) setsockopt$sock_int(r2, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) listen(r2, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$SNDCTL_SYNTH_MEMAVL(r4, 0xc004510e, &(0x7f0000000400)=0x7f) read(r0, &(0x7f0000000440)=""/4096, 0x1000) 5m50.812794861s ago: executing program 0 (id=58): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007500000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1c0000000000000, 0x4, &(0x7f0000006680)) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6000, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000002080)={r1, 0xe0, &(0x7f00000020c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000100)=[0x0], &(0x7f0000000300), 0x0, 0xc3, &(0x7f0000000340)=[{}], 0x8, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0xe0, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff00"], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x5, 0xe, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 5m46.750983589s ago: executing program 0 (id=67): openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() getpeername$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000000) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_SECCOMP(0x15) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setxattr$security_ima(&(0x7f0000000480)='./file7\x00', 0x0, 0x0, 0x0, 0x1) r3 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 5m45.415662064s ago: executing program 0 (id=70): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) io_uring_setup(0x6258, &(0x7f0000004180)={0x0, 0x7, 0x80}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_io_uring_setup(0x3b87, &(0x7f0000000240)={0x0, 0x9b5, 0x40, 0x23, 0x2bc}, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) memfd_create(0x0, 0x0) socket(0x2, 0x3, 0xff) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010029bd7000ffdbdf250800000008000600", @ANYRES32, @ANYBLOB="060000008455000088102b7e0004000005003500061f000006002800000000003b0006000000"], 0x5c}, 0x1, 0x0, 0x0, 0x20010000}, 0x20040041) r2 = socket$unix(0x1, 0x5, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x80, @empty, 0xa09b}, {0xa, 0x4ea1, 0x9, @mcast1, 0x4}, r3, 0x8001}}, 0x48) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 5m44.507617558s ago: executing program 0 (id=75): r0 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000040)={0x0, 0xf019, 0x200, 0x0, 0x2000}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r4 = syz_open_dev$swradio(0x0, 0x0, 0x2) fcntl$notify(0xffffffffffffffff, 0x402, 0x8000003d) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000002480)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b33e0f32f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3cd3cedd01fdc59589ea6bacde1e40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8b0100010000000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7a7216f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe00000000000000000000000000fdba1133066c4a21a7149f32"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/net/sctp/assocs\x00', 0x0, 0x0) read(r6, &(0x7f0000000200), 0x1000) read$FUSE(r6, &(0x7f0000000280)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) write(r8, &(0x7f0000000340)="65486d795fe26defde837dda726561645f74b9ff9be37786fe66e431205f2e76", 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000010000"], 0x48) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r10}, 0xc) ioctl$VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000400)=@multiplanar_fd={0x5000, 0xd, 0x4, 0xe000, 0x2, {0x0, 0xea60}, {0x3, 0x1, 0x8, 0x50, 0x9e, 0x7, "4fabeb4b"}, 0x3, 0x4, {0x0}, 0x9}) r11 = gettid() syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000340)={0x2e, 0x39, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@any_dev={0x4, 0xed, 0x0, 0x0, 0x1000, 0x10000, r11, 0x0, 0x100}}}, 0xfffffffffffffffe) syz_ublk_setup_io_uring(0x76e3, &(0x7f0000000180)={0x0, 0x5223, 0x2000, 0x3, 0x105, 0x0, r6}, &(0x7f00000022c0), &(0x7f0000002300), &(0x7f0000002340)=0x0) syz_ublk_add_dev(r0, r1, r2, r13, &(0x7f00000023c0)={0x2e, 0x10, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, r12, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000002380)=@any_dev={0x3, 0xa26, 0x0, 0x0, 0x1000, 0x6, r7, 0x0, 0x20}}}, &(0x7f0000002440)) 5m42.113329378s ago: executing program 0 (id=79): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) connect(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x4}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() getpeername$unix(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) 5m34.440319975s ago: executing program 2 (id=88): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0xaf, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) (fail_nth: 3) 5m34.059725478s ago: executing program 2 (id=91): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./binfmt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./binfmt\x00', &(0x7f0000000100)='binfmt_misc\x00', 0x0, 0x0) r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000001240)='./binfmt/status\x00', &(0x7f0000001280)=@FILEID_INO32_GEN={0x8, 0x1, {0x9, 0x8}}, 0x0, 0x1200) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000040000000000000000000000850000002c000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007500000095"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYRESHEX], 0x18}}, 0x0) recvmmsg(r2, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)=""/197, 0xc5}], 0x1}, 0x2}], 0x1, 0x100, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000100)=0x1c, 0x80000) sendto$inet6(r4, &(0x7f0000000300)="da7c52bbca9222bfb609a2978b44d4b32a1b94d766991ded7f325a28470f466b665300be371cc4c95ef59109720863eb545cf1c9383f5dfeb28b6f538c3b397614cba1f0e157f9fc2eb500a0bc65690b5e5a5c4bea70f948601a5400491d1e77cffddb39cd1678883d5460f6e3616ba730fbaa173bf2b227f80a30704bb3282d6896d7a3ffd7b5e452ca255245840604704e2c334c58abceda6358aaec086ec20a32fb5099e1bc270e6f45d1613b527254faa3cca6db906887ec7b345a6118537a2c03ae2d6176f4fa9fab5ebb4964d9f6a818a6f7b4374ea181c0eaec095b69d8a2bbe91a1ccd22b806ea9c78d2ac6bf45a1a048568411439850b3f", 0xfc, 0x20008840, &(0x7f0000000400)={0xa, 0x4e24, 0x4, @loopback, 0x7fff}, 0x1c) sendmsg$nl_generic(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4800000041000501010000000000000003010000000000001c0001000600060086dd0000100007"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x2c}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x359}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r5, 0x0, 0xe, 0x0, &(0x7f0000000140)="410c49bc3c388e38d0da5a20564e", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0xe, 0x0, &(0x7f0000000140)="259a00f271a76d1708fff74588a8", 0x0, 0xd11, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 5m31.500488165s ago: executing program 2 (id=94): bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) 5m31.243756878s ago: executing program 2 (id=95): ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) connect(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x4}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() getpeername$unix(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000100)={0x200000000000001}, 0x8) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_SECCOMP(0x15) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 5m30.203491061s ago: executing program 2 (id=97): syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x402) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0xfff, 0x4000000007}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@private0={0xfc, 0x0, '\x00', 0xfe}, 0x800, 0x0, 0x1, 0x1, 0x0, 0xffff}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x23) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000300)={@dev={0xfe, 0x80, '\x00', 0x2c}, 0x3ff, 0x0, 0x3, 0xb, 0x0, 0x5}, &(0x7f00000000c0)=0x20) r2 = syz_usb_connect(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12014101175129205705092006c70102010109022400010200100009045819028ab53800090506020001000006090582020002"], 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x2, &(0x7f0000000000)=ANY=[@ANYBLOB="18200000", @ANYRES32=0x1, @ANYBLOB='\x00\x00\x00\x00\x00'], &(0x7f0000000040)='GPL\x00', 0x40, 0xe8, &(0x7f0000000080)=""/232, 0x40f00, 0x66, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000180)={0x1, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000200)=[0x1], &(0x7f0000000280)=[{0x6, 0x4, 0x0, 0xc}, {0x5, 0x2, 0x9, 0x6}, {0x3, 0x2, 0x5, 0xc}, {0x2, 0x2, 0x2, 0xb}], 0x10, 0x1}, 0x94) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x185042, 0x1ef) fchmodat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xfffffffb) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c5a00, 0x0) sendfile(r4, r5, 0x0, 0x20fffe82) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_delrule={0x1c, 0x21, 0x1, 0x70bd2b, 0x25dfdbdb, {0x2, 0x0, 0x0, 0xdd, 0x0, 0x0, 0x0, 0x1, 0x10008}}, 0x1c}}, 0x8810) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde180000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) rseq(&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6}, 0x46, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001900010000"], 0x1c}}, 0x18040) r8 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000000)=0x1000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) 5m24.068808567s ago: executing program 32 (id=79): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) connect(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @rand_addr=0x64010101, 0x4}, 0x80) mkdirat(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() getpeername$unix(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xff00000000000000}, 0x2000400}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x176}}], 0x400000000000172, 0x4000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) 5m21.547899583s ago: executing program 2 (id=106): syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, 0x0, 0x4000000) socket$key(0xf, 0x3, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) readahead(r1, 0x8, 0x9c9) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x49940, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x28, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xc5, &(0x7f00000005c0)=""/197, 0x41100, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) ioctl$EXT4_IOC_CLEAR_ES_CACHE(0xffffffffffffffff, 0x6628) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000446000/0x2000)=nil, 0x2000, 0x6, 0x110, r0, 0x44d79000) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0100001000130700000000000000a0e8ba4e22c252eb3842ec61f9f10be700fc020000000000000000000000000001fe8000000000000000000000000000aaf97f4fba66605a91c1f34afe9606f1d04af0707d1b5be40cfd054dbb652fc1cbe2ec777237ea8fe7daa06ab40d6301e94cf85d9fb0adba688cda0ab3cf112eeb19af092201b7f2af01695d11252059eac942b10cdb29e57cbb505ed7a17a01b94153f99adf9a1c2f12350647f8b8304b9557d7e1e3a181828ffbd5a83be039bea76f640e5448e4009d48d6b6a300c667a5a994", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000027bd7000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e53"], 0x14c}}, 0x0) 5m5.52864216s ago: executing program 33 (id=106): syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, 0x0, 0x4000000) socket$key(0xf, 0x3, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) readahead(r1, 0x8, 0x9c9) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x49940, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x28, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xc5, &(0x7f00000005c0)=""/197, 0x41100, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) ioctl$EXT4_IOC_CLEAR_ES_CACHE(0xffffffffffffffff, 0x6628) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000446000/0x2000)=nil, 0x2000, 0x6, 0x110, r0, 0x44d79000) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0100001000130700000000000000a0e8ba4e22c252eb3842ec61f9f10be700fc020000000000000000000000000001fe8000000000000000000000000000aaf97f4fba66605a91c1f34afe9606f1d04af0707d1b5be40cfd054dbb652fc1cbe2ec777237ea8fe7daa06ab40d6301e94cf85d9fb0adba688cda0ab3cf112eeb19af092201b7f2af01695d11252059eac942b10cdb29e57cbb505ed7a17a01b94153f99adf9a1c2f12350647f8b8304b9557d7e1e3a181828ffbd5a83be039bea76f640e5448e4009d48d6b6a300c667a5a994", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000027bd7000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e53"], 0x14c}}, 0x0) 19.630667935s ago: executing program 1 (id=578): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r1, 0x10) bind$inet(r1, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, 0x0, &(0x7f0000000400), &(0x7f0000000200), 0x400) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) getegid() sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c00000037000701f3fffffffedbd72501"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0x40008090) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) 18.175577025s ago: executing program 3 (id=580): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007"], 0x84}, 0x1, 0x0, 0x0, 0x20008840}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, 0x0, 0x20000000) 14.806213307s ago: executing program 1 (id=581): openat$fuse(0xffffffffffffff9c, &(0x7f0000002d80), 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x25) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffa) landlock_create_ruleset(0x0, 0x0, 0x1) syz_emit_vhci(0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(0xffffffffffffffff, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, r8, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 11.748157693s ago: executing program 1 (id=584): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 11.513460351s ago: executing program 3 (id=585): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, 0x0, 0x1000, 0x0) landlock_create_ruleset(&(0x7f0000000240)={0x2001}, 0x18, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x202000, 0x13b) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x1ed) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 8.31711561s ago: executing program 1 (id=586): r0 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) close_range(r0, 0xffffffffffffffff, 0x0) 8.127893956s ago: executing program 1 (id=588): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x759e, 0x4) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x45, 0x0, &(0x7f0000000040)) bind$inet(r0, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x1, 0x5, 0x0) setreuid(0x0, 0x0) ioctl$vim2m_VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) listns(&(0x7f00000000c0)={0x20, 0x0, 0x7, 0x0, 0x0, 0x8000000000000001}, &(0x7f0000000100)=[0x0, 0x0], 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x9fe, 0x4) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) epoll_create1(0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x400885d) 7.008418093s ago: executing program 4 (id=589): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) msgsnd(0x0, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2000, 0x0) msgrcv(0x0, 0x0, 0x0, 0x2, 0x3000) 4.750194018s ago: executing program 4 (id=590): r0 = openat(0xffffffffffffff9c, 0x0, 0x101, 0x0) writev(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000180)=0x4000000000009) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r5, 0x402c542b, &(0x7f0000000080)={0xfffffe01, 0x9, 0xbf3ffe01, 0x8001, 0x2, "202b9809007d0000cd681ec267a000", 0x6, 0xd}) ioctl$TIOCL_PASTESEL(r5, 0x541c, &(0x7f00000002c0)) 4.744479234s ago: executing program 4 (id=591): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$MRT6_INIT(0xffffffffffffffff, 0x29, 0xc8, &(0x7f0000000340), 0x4) setsockopt$MRT6_DONE(0xffffffffffffffff, 0x29, 0xc9, 0x12, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000010000000c0000000000000000000000000000000104000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad94e2100000073fe8000"], 0x610) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x71228}, [@IFLA_MTU={0x8, 0x4, 0x81}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x4004090) 2.842658769s ago: executing program 3 (id=592): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, 0x0, 0x1000c080) connect$can_bcm(r1, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="050000000400000005000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="020000b901"], 0x48}, 0x1, 0x0, 0x0, 0x8008}, 0x40) sendmsg$can_bcm(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4004844) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x100003, {0x0, 0x0, 0x0, r3, {0xb, 0x3}, {0xfff3, 0x5}, {0xffe0, 0xe}}}, 0x24}}, 0x800) 1.636250353s ago: executing program 4 (id=593): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e27, 0x4, @dev={0xfe, 0x80, '\x00', 0x40}, 0x9}]}, &(0x7f0000000040)=0x10) shutdown(r0, 0x2) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={r1, 0x1}, 0x8) 1.444207607s ago: executing program 1 (id=594): syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000980)=0xd) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x1, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x4, 0x80003e, 0x8f, 0x6, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0xe, 0x312, 0x74, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x7], [0x400, 0xdd, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x4, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x4, 0x6, 0xac8, 0x7, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x4, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x8, 0x8aaed, 0x4, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0xfffe, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x1d, 0xf, &(0x7f0000000980)=ANY=[], 0x0, 0x720, 0x0, 0x0, 0x41100, 0x46, '\x00', 0x0, 0x1b, r0, 0x8, &(0x7f0000000180)={0x7, 0x5}, 0x8, 0x10, &(0x7f00000001c0)={0x2, 0x2, 0x4, 0x4}, 0x10, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000200), &(0x7f0000000240)=[{0x5, 0x4, 0xb, 0x1}], 0x10, 0x2}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044000}, 0x48002) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4841) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[], 0x64}}, 0x4800) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) sendmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x20000040) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r3 = syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_ep_read(r3, 0x4, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000c00)=ANY=[@ANYBLOB="020000000000000002004e1fe00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000001"], 0x110) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r4, 0x80286722, &(0x7f0000000040)={0x0, 0x0, 0x800, 0x4}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) socket$kcm(0x21, 0x2, 0xa) 1.151871827s ago: executing program 3 (id=595): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000140)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a0001000000ff7f0000000080", @ANYRES32=r0], 0x24}}, 0x0) 1.151670283s ago: executing program 4 (id=596): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x840000000002, 0x3, 0x100) connect$inet(r1, 0x0, 0x0) sendmmsg$inet(r1, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 1.102028919s ago: executing program 3 (id=597): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) read$FUSE(r0, &(0x7f0000002740)={0x2020}, 0x2020) 134.252893ms ago: executing program 3 (id=598): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/module/dvb_as102/parameters/fw_upload\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vidtv/unbind\x00', 0x1, 0x0) syz_usb_connect$uac1(0x3, 0xba, 0x0, 0x0) write(r1, &(0x7f0000000300)='vidtv.0', 0x7) 0s ago: executing program 4 (id=599): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_UNLINK(r0, 0x40044160, 0x3) kernel console output (not intermixed with test programs): atman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.048008][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.048030][ T5583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.102249][ T5581] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.102264][ T5581] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.102289][ T5581] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.111001][ T5583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.111015][ T5583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.111039][ T5583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.273951][ T5584] hsr_slave_0: entered promiscuous mode [ 85.275657][ T5584] hsr_slave_1: entered promiscuous mode [ 85.375707][ T5580] hsr_slave_0: entered promiscuous mode [ 85.377296][ T5580] hsr_slave_1: entered promiscuous mode [ 85.378306][ T5580] debugfs: 'hsr0' already exists in 'hsr' [ 85.378423][ T5580] Cannot create hsr debugfs directory [ 85.391167][ T5582] hsr_slave_0: entered promiscuous mode [ 85.392415][ T5582] hsr_slave_1: entered promiscuous mode [ 85.393265][ T5582] debugfs: 'hsr0' already exists in 'hsr' [ 85.393286][ T5582] Cannot create hsr debugfs directory [ 85.441798][ T5581] hsr_slave_0: entered promiscuous mode [ 85.442543][ T5581] hsr_slave_1: entered promiscuous mode [ 85.443227][ T5581] debugfs: 'hsr0' already exists in 'hsr' [ 85.443281][ T5581] Cannot create hsr debugfs directory [ 85.473181][ T5583] hsr_slave_0: entered promiscuous mode [ 85.473931][ T5583] hsr_slave_1: entered promiscuous mode [ 85.474432][ T5583] debugfs: 'hsr0' already exists in 'hsr' [ 85.474454][ T5583] Cannot create hsr debugfs directory [ 85.599109][ T60] Bluetooth: hci4: command tx timeout [ 85.678796][ T4898] Bluetooth: hci3: command tx timeout [ 85.678829][ T4898] Bluetooth: hci0: command tx timeout [ 85.678946][ T60] Bluetooth: hci2: command tx timeout [ 85.758817][ T60] Bluetooth: hci1: command tx timeout [ 86.663447][ T5584] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.746796][ T201] cfg80211: failed to load regulatory.db [ 86.752768][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.786572][ T5584] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.813558][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.839264][ T5584] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.876817][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.897579][ T5584] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.937583][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.087599][ T5582] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.112485][ T5582] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.118291][ T5582] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.152823][ T5582] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.171499][ T5582] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.214769][ T5582] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.237261][ T5582] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.272255][ T5582] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.420906][ T5581] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.454487][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.470640][ T5581] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.505809][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.516070][ T5581] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.542297][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.569800][ T5581] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.605182][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.678907][ T60] Bluetooth: hci4: command tx timeout [ 87.757669][ T5583] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.759434][ T60] Bluetooth: hci2: command tx timeout [ 87.768693][ T60] Bluetooth: hci0: command tx timeout [ 87.768722][ T60] Bluetooth: hci3: command tx timeout [ 87.787342][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.810134][ T5583] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.838944][ T60] Bluetooth: hci1: command tx timeout [ 87.858256][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.876054][ T5583] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.913600][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.936913][ T5583] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.971646][ T5583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.121552][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.132580][ T5580] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.176424][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.190126][ T5580] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.224925][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.230562][ T5580] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.276334][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.295349][ T5580] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.332006][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.401593][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.427472][ T5582] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.467327][ T3346] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.467479][ T3346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.517344][ T3346] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.517472][ T3346] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.597436][ T5582] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.640008][ T5581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.664485][ T3346] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.665075][ T3346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.714084][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.714207][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.824059][ T5581] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.880845][ T5583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.913930][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.914261][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.966865][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.966998][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.062650][ T5583] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.153302][ T216] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.153408][ T216] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.195155][ T5580] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.284350][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.286526][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.391112][ T5580] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.450731][ T3346] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.452521][ T3346] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.569137][ T181] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.569258][ T181] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.760714][ T60] Bluetooth: hci4: command tx timeout [ 89.838718][ T60] Bluetooth: hci3: command tx timeout [ 89.838752][ T60] Bluetooth: hci0: command tx timeout [ 89.838786][ T60] Bluetooth: hci2: command tx timeout [ 89.918964][ T5600] Bluetooth: hci1: command tx timeout [ 90.284896][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.521941][ T5582] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.027238][ T5581] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.060179][ T5582] veth0_vlan: entered promiscuous mode [ 91.160883][ T5582] veth1_vlan: entered promiscuous mode [ 91.321301][ T5583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.376225][ T5581] veth0_vlan: entered promiscuous mode [ 91.424878][ T5582] veth0_macvtap: entered promiscuous mode [ 91.449998][ T5581] veth1_vlan: entered promiscuous mode [ 91.465914][ T5582] veth1_macvtap: entered promiscuous mode [ 91.501957][ T5580] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.575086][ T5584] veth0_vlan: entered promiscuous mode [ 91.595290][ T5582] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.644185][ T5582] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.646489][ T5583] veth0_vlan: entered promiscuous mode [ 91.664916][ T5584] veth1_vlan: entered promiscuous mode [ 91.713649][ T5581] veth0_macvtap: entered promiscuous mode [ 91.735506][ T5583] veth1_vlan: entered promiscuous mode [ 91.754695][ T5581] veth1_macvtap: entered promiscuous mode [ 92.111416][ T5580] veth0_vlan: entered promiscuous mode [ 92.277186][ T5581] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.310512][ T5584] veth0_macvtap: entered promiscuous mode [ 92.337770][ T5581] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.380087][ T5580] veth1_vlan: entered promiscuous mode [ 92.402498][ T5584] veth1_macvtap: entered promiscuous mode [ 92.436161][ T5583] veth0_macvtap: entered promiscuous mode [ 92.494395][ T5583] veth1_macvtap: entered promiscuous mode [ 92.510785][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.510807][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.648335][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.742182][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.742202][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.760971][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.899210][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.052120][ T5580] veth0_macvtap: entered promiscuous mode [ 93.141198][ T5583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.252977][ T5580] veth1_macvtap: entered promiscuous mode [ 93.295892][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.295913][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.901770][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.901789][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.010842][ T5580] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.846274][ T5782] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3'. [ 94.883060][ T5580] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.529383][ T181] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.529403][ T181] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.533831][ T5784] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 95.683200][ T216] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.683220][ T216] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.701531][ T3346] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.114776][ T216] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.114797][ T216] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.448549][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.468566][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.478551][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.488567][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.498552][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.508574][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.518574][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.528578][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.538557][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 96.548546][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.072915][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 98.359558][ T10] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 8.00 [ 98.400726][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 98.400759][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 98.400798][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.837715][ T181] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.837911][ T1131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.837926][ T1131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.153751][ T10] usb 3-1: can't set config #1, error -71 [ 99.394012][ T3382] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.394029][ T3382] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.457923][ T3382] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.459067][ T57] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.482654][ T10] usb 3-1: USB disconnect, device number 2 [ 101.253770][ T68] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.963927][ T5827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10'. [ 102.091973][ T216] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.091993][ T216] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.879217][ T5830] syz.4.5 (5830): drop_caches: 2 [ 104.354093][ T5837] syz.4.11 (5837): drop_caches: 2 [ 104.532101][ T68] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.838929][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.839952][ T3382] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.840184][ T3382] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.840358][ T3382] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.840522][ T3382] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.840850][ T3382] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.921361][ T3382] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.954612][ T216] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.955120][ T216] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.353088][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.459405][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.588393][ T3346] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.720075][ T3346] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.224813][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.847057][ T5864] syz.1.14 (5864): drop_caches: 2 [ 110.420623][ T5869] syz.1.15 (5869): drop_caches: 2 [ 110.988117][ T5879] comedi comedi0: No hardware detected at I/O base 0x294 [ 111.282371][ T5884] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 111.459475][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.459910][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.500903][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 111.840434][ T5855] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 112.769816][ T5894] syz.1.22 (5894): drop_caches: 2 [ 115.048629][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 116.625737][ T5922] netlink: 8 bytes leftover after parsing attributes in process `syz.2.28'. [ 116.844200][ T10] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 117.266443][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 117.266516][ T10] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 117.266748][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.617347][ T10] usb 4-1: config 0 descriptor?? [ 119.686640][ T10] usb 4-1: can't set config #0, error -71 [ 120.510205][ T5932] ======================================================= [ 120.510205][ T5932] WARNING: The mand mount option has been deprecated and [ 120.510205][ T5932] and is ignored by this kernel. Remove the mand [ 120.510205][ T5932] option from the mount to silence this warning. [ 120.510205][ T5932] ======================================================= [ 120.767356][ T10] usb 4-1: USB disconnect, device number 2 [ 120.793366][ T5936] netlink: 88 bytes leftover after parsing attributes in process `syz.4.30'. [ 120.793550][ T5936] Zero length message leads to an empty skb [ 121.690494][ T5941] syz.1.31 (5941): drop_caches: 2 [ 122.381225][ T5719] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 122.564880][ T5719] usb 1-1: New USB device found, idVendor=1532, idProduct=010d, bcdDevice= 0.40 [ 122.566374][ T5719] usb 1-1: config 1 interface 0 has no altsetting 0 [ 122.590768][ T5719] usb 1-1: string descriptor 0 read error: -22 [ 122.590932][ T5719] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.694285][ T5959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.35'. [ 122.711808][ T5959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.35'. [ 123.153393][ T5945] process 'syz.0.32' launched './file0' with NULL argv: empty string added [ 123.992667][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992708][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992734][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992759][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992784][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992809][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992832][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992856][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992879][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.992901][ T5719] razer 0003:1532:010D.0001: unknown main item tag 0x0 [ 123.995383][ T5719] razer 0003:1532:010D.0001: unexpected long global item [ 123.996356][ T5719] razer 0003:1532:010D.0001: probe with driver razer failed with error -22 [ 124.349881][ T5719] usb 1-1: USB disconnect, device number 2 [ 125.463454][ T5984] FAULT_INJECTION: forcing a failure. [ 125.463454][ T5984] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 125.463513][ T5984] CPU: 1 UID: 0 PID: 5984 Comm: syz.4.43 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 125.463539][ T5984] Tainted: [L]=SOFTLOCKUP [ 125.463545][ T5984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.463563][ T5984] Call Trace: [ 125.463570][ T5984] [ 125.463578][ T5984] dump_stack_lvl+0xe8/0x150 [ 125.463616][ T5984] should_fail_ex+0x46b/0x600 [ 125.463650][ T5984] _copy_from_user+0x2d/0xb0 [ 125.463670][ T5984] bpf_test_init+0xd8/0x150 [ 125.463701][ T5984] bpf_prog_test_run_skb+0x31e/0x2230 [ 125.463748][ T5984] ? __fget_files+0x3a8/0x420 [ 125.463768][ T5984] ? __fget_files+0x2a/0x420 [ 125.463793][ T5984] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 125.463821][ T5984] bpf_prog_test_run+0x2cb/0x340 [ 125.463848][ T5984] __sys_bpf+0xa22/0xd90 [ 125.463877][ T5984] ? __pfx___sys_bpf+0x10/0x10 [ 125.463909][ T5984] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 125.463935][ T5984] ? rt_mutex_slowunlock+0x219/0x460 [ 125.463979][ T5984] ? ksys_write+0x248/0x270 [ 125.464004][ T5984] ? __pfx_ksys_write+0x10/0x10 [ 125.464030][ T5984] __x64_sys_bpf+0xba/0xd0 [ 125.464050][ T5984] do_syscall_64+0x166/0x520 [ 125.464067][ T5984] ? trace_irq_disable+0x3b/0x140 [ 125.464083][ T5984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.464099][ T5984] ? clear_bhb_loop+0x70/0xc0 [ 125.464121][ T5984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 125.464137][ T5984] RIP: 0033:0x7fc67fc0e0d9 [ 125.464159][ T5984] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 125.464171][ T5984] RSP: 002b:00007fc67de66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 125.464194][ T5984] RAX: ffffffffffffffda RBX: 00007fc67fe95fa0 RCX: 00007fc67fc0e0d9 [ 125.464208][ T5984] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 125.464220][ T5984] RBP: 00007fc67de66090 R08: 0000000000000000 R09: 0000000000000000 [ 125.464231][ T5984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 125.464241][ T5984] R13: 00007fc67fe96038 R14: 00007fc67fe95fa0 R15: 00007ffcd0f197e8 [ 125.464271][ T5984] [ 126.048817][ T5998] FAULT_INJECTION: forcing a failure. [ 126.048817][ T5998] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 126.048846][ T5998] CPU: 0 UID: 0 PID: 5998 Comm: syz.4.46 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 126.048866][ T5998] Tainted: [L]=SOFTLOCKUP [ 126.048871][ T5998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.048878][ T5998] Call Trace: [ 126.048884][ T5998] [ 126.048889][ T5998] dump_stack_lvl+0xe8/0x150 [ 126.048915][ T5998] should_fail_ex+0x46b/0x600 [ 126.048939][ T5998] _copy_from_user+0x2d/0xb0 [ 126.048954][ T5998] ____sys_sendmsg+0x31b/0x870 [ 126.048992][ T5998] ? __pfx_____sys_sendmsg+0x10/0x10 [ 126.049017][ T5998] ? import_iovec+0x73/0xa0 [ 126.049034][ T5998] ___sys_sendmsg+0x2a5/0x360 [ 126.049052][ T5998] ? __lock_acquire+0x683/0x2ce0 [ 126.049071][ T5998] ? __pfx____sys_sendmsg+0x10/0x10 [ 126.049113][ T5998] ? __fget_files+0x2a/0x420 [ 126.049127][ T5998] ? __fget_files+0x3a8/0x420 [ 126.049148][ T5998] __x64_sys_sendmsg+0x1b7/0x290 [ 126.049172][ T5998] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 126.049205][ T5998] do_syscall_64+0x166/0x520 [ 126.049219][ T5998] ? trace_irq_disable+0x3b/0x140 [ 126.049233][ T5998] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.049246][ T5998] ? clear_bhb_loop+0x70/0xc0 [ 126.049263][ T5998] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.049276][ T5998] RIP: 0033:0x7fc67fc0e0d9 [ 126.049290][ T5998] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.049302][ T5998] RSP: 002b:00007fc67de66028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 126.049318][ T5998] RAX: ffffffffffffffda RBX: 00007fc67fe95fa0 RCX: 00007fc67fc0e0d9 [ 126.049328][ T5998] RDX: 0000000024000052 RSI: 0000200000000140 RDI: 0000000000000003 [ 126.049336][ T5998] RBP: 00007fc67de66090 R08: 0000000000000000 R09: 0000000000000000 [ 126.049344][ T5998] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 126.049351][ T5998] R13: 00007fc67fe96038 R14: 00007fc67fe95fa0 R15: 00007ffcd0f197e8 [ 126.049372][ T5998] [ 126.614636][ T5990] netlink: 28 bytes leftover after parsing attributes in process `syz.2.44'. [ 127.919596][ T6026] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 130.153111][ T6047] syz.3.55 (6047): drop_caches: 2 [ 131.121987][ T6060] Illegal XDP return value 4294967274 on prog (id 6) dev N/A, expect packet loss! [ 131.269557][ T6064] netlink: 12 bytes leftover after parsing attributes in process `syz.2.61'. [ 132.604634][ T6071] netlink: 8 bytes leftover after parsing attributes in process `syz.3.62'. [ 133.317499][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.327308][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.457748][ T6082] FAULT_INJECTION: forcing a failure. [ 134.457748][ T6082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 134.457782][ T6082] CPU: 1 UID: 0 PID: 6082 Comm: syz.2.65 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 134.457808][ T6082] Tainted: [L]=SOFTLOCKUP [ 134.457815][ T6082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 134.457825][ T6082] Call Trace: [ 134.457832][ T6082] [ 134.457840][ T6082] dump_stack_lvl+0xe8/0x150 [ 134.457871][ T6082] should_fail_ex+0x46b/0x600 [ 134.457903][ T6082] _copy_to_user+0x31/0xb0 [ 134.457925][ T6082] simple_read_from_buffer+0xe1/0x170 [ 134.457951][ T6082] proc_fail_nth_read+0x1be/0x230 [ 134.457979][ T6082] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 134.458006][ T6082] ? rw_verify_area+0x250/0x4d0 [ 134.458026][ T6082] ? __fget_files+0x2a/0x420 [ 134.458047][ T6082] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 134.458069][ T6082] vfs_read+0x219/0xa90 [ 134.458099][ T6082] ? __pfx_vfs_read+0x10/0x10 [ 134.458124][ T6082] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 134.458148][ T6082] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 134.458167][ T6082] ? mutex_lock_nested+0x152/0x1d0 [ 134.458191][ T6082] ? fdget_pos+0x252/0x320 [ 134.458220][ T6082] ksys_read+0x156/0x270 [ 134.458244][ T6082] ? __pfx_ksys_read+0x10/0x10 [ 134.458284][ T6082] do_syscall_64+0x166/0x520 [ 134.458304][ T6082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.458324][ T6082] ? clear_bhb_loop+0x70/0xc0 [ 134.458347][ T6082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.458366][ T6082] RIP: 0033:0x7f21a6e9e90e [ 134.458384][ T6082] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 134.458399][ T6082] RSP: 002b:00007f21a5114fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 134.458418][ T6082] RAX: ffffffffffffffda RBX: 00007f21a51156c0 RCX: 00007f21a6e9e90e [ 134.458432][ T6082] RDX: 000000000000000f RSI: 00007f21a51150a0 RDI: 0000000000000004 [ 134.458444][ T6082] RBP: 00007f21a5115090 R08: 0000000000000000 R09: 0000000000000000 [ 134.458457][ T6082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.458466][ T6082] R13: 00007f21a7166128 R14: 00007f21a7166090 R15: 00007fffc16cb1d8 [ 134.458496][ T6082] [ 136.459925][ T6088] ip6erspan0: entered promiscuous mode [ 136.459950][ T6088] ip6erspan0: entered allmulticast mode [ 136.543186][ T6092] input: syz1 as /devices/virtual/input/input11 [ 136.603749][ T6104] netlink: 16 bytes leftover after parsing attributes in process `syz.2.66'. [ 136.793397][ T6110] syz.1.72 (6110) used greatest stack depth: 18672 bytes left [ 141.487397][ T6131] netlink: 8 bytes leftover after parsing attributes in process `syz.2.78'. [ 142.115307][ T5720] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 149.276258][ T6181] netlink: 20 bytes leftover after parsing attributes in process `syz.2.91'. [ 149.276364][ T6181] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 150.782326][ T6197] syz.2.95 (6197): drop_caches: 2 [ 152.784999][ T6205] syz.3.98 (6205): drop_caches: 2 [ 152.861525][ T5719] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 153.025932][ T5719] usb 3-1: Using ep0 maxpacket: 32 [ 153.026586][ T5719] usb 3-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 153.027517][ T5719] usb 3-1: config 2 has an invalid interface number: 88 but max is 0 [ 153.027531][ T5719] usb 3-1: config 2 has no interface number 0 [ 153.027555][ T5719] usb 3-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 153.027568][ T5719] usb 3-1: config 2 interface 88 has no altsetting 0 [ 153.030873][ T5719] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 153.030896][ T5719] usb 3-1: Product: syz [ 153.030911][ T5719] usb 3-1: Manufacturer: syz [ 153.030924][ T5719] usb 3-1: SerialNumber: syz [ 153.200146][ T6200] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 153.448200][ T6200] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 158.946496][ T5719] asix 3-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -110 [ 159.044905][ T5719] asix 3-1:2.88: probe with driver asix failed with error -110 [ 160.144726][ T5719] usb 3-1: USB disconnect, device number 3 [ 161.397711][ T6237] netlink: 48 bytes leftover after parsing attributes in process `syz.4.108'. [ 162.245805][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 162.345027][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 162.363138][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 162.381763][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 162.387498][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 163.176613][ T6253] netlink: 104 bytes leftover after parsing attributes in process `syz.3.112'. [ 165.161261][ T60] Bluetooth: hci5: command tx timeout [ 166.286637][ T6273] syz.1.116 (6273): drop_caches: 2 [ 167.198752][ T60] Bluetooth: hci5: command tx timeout [ 168.024771][ T6282] netlink: 48 bytes leftover after parsing attributes in process `syz.4.118'. [ 169.278740][ T60] Bluetooth: hci5: command tx timeout [ 169.862944][ T6304] syz.1.121 (6304): drop_caches: 2 [ 170.620791][ T6305] netlink: 92 bytes leftover after parsing attributes in process `syz.2.106'. [ 172.077241][ T5817] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.238013][ T60] Bluetooth: hci5: command tx timeout [ 173.512271][ T6324] syz.4.128 (6324): drop_caches: 2 [ 174.505074][ T6332] netlink: 48 bytes leftover after parsing attributes in process `syz.4.129'. [ 174.509928][ T5817] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.599252][ T6336] syz.3.130 (6336): drop_caches: 2 [ 176.078992][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 176.311784][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 176.317876][ T9] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 176.332365][ T9] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 176.332393][ T9] usb 2-1: config 2 has no interface number 0 [ 176.332440][ T9] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 176.332465][ T9] usb 2-1: config 2 interface 88 has no altsetting 0 [ 177.648101][ T9] usb 2-1: string descriptor 0 read error: -71 [ 177.648237][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 177.821336][ T5600] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 177.865840][ T9] usb 2-1: can't set config #2, error -71 [ 177.980608][ T5600] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 178.008524][ T9] usb 2-1: USB disconnect, device number 2 [ 178.057946][ T5600] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 178.091062][ T5600] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 178.091955][ T5600] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 178.793146][ T5817] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 180.462076][ T5600] Bluetooth: hci3: command tx timeout [ 180.693383][ T6388] syz.4.141 (6388): drop_caches: 2 [ 181.902274][ T6403] netlink: 12 bytes leftover after parsing attributes in process `syz.4.143'. [ 181.936810][ T6403] netlink: 104 bytes leftover after parsing attributes in process `syz.4.143'. [ 182.567642][ T5600] Bluetooth: hci3: command tx timeout [ 183.860791][ T5817] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.984923][ T6428] FAULT_INJECTION: forcing a failure. [ 183.984923][ T6428] name failslab, interval 1, probability 0, space 0, times 0 [ 183.984960][ T6428] CPU: 0 UID: 0 PID: 6428 Comm: syz.4.149 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 183.984986][ T6428] Tainted: [L]=SOFTLOCKUP [ 183.984993][ T6428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 183.985004][ T6428] Call Trace: [ 183.985011][ T6428] [ 183.985019][ T6428] dump_stack_lvl+0xe8/0x150 [ 183.985052][ T6428] should_fail_ex+0x46b/0x600 [ 183.985082][ T6428] should_failslab+0xa8/0x100 [ 183.985106][ T6428] __kmalloc_noprof+0xfe/0x780 [ 183.985126][ T6428] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 183.985150][ T6428] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 183.985180][ T6428] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 183.985213][ T6428] genl_family_rcv_msg_doit+0xda/0x340 [ 183.985242][ T6428] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 183.985337][ T6428] ? rcu_is_watching+0x16/0xb0 [ 183.985366][ T6428] ? rcu_is_watching+0x16/0xb0 [ 183.985388][ T6428] ? cap_capable+0x123/0x460 [ 183.985409][ T6428] ? safesetid_security_capable+0xa9/0x1a0 [ 183.985433][ T6428] ? bpf_lsm_capable+0x9/0x20 [ 183.985449][ T6428] ? security_capable+0x7e/0x2c0 [ 183.985479][ T6428] genl_rcv_msg+0x614/0x7a0 [ 183.985510][ T6428] ? __pfx_genl_rcv_msg+0x10/0x10 [ 183.985530][ T6428] ? ref_tracker_free+0x668/0x820 [ 183.985551][ T6428] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 183.985589][ T6428] ? __pfx_ref_tracker_free+0x10/0x10 [ 183.985608][ T6428] ? __asan_memcpy+0x40/0x70 [ 183.985634][ T6428] ? __skb_clone+0x5c/0x6c0 [ 183.985668][ T6428] netlink_rcv_skb+0x226/0x4a0 [ 183.985698][ T6428] ? __pfx_genl_rcv_msg+0x10/0x10 [ 183.985724][ T6428] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 183.985768][ T6428] ? netlink_deliver_tap+0x2e/0x1b0 [ 183.985796][ T6428] ? netlink_deliver_tap+0x2e/0x1b0 [ 183.985851][ T6428] genl_rcv+0x28/0x40 [ 183.985873][ T6428] netlink_unicast+0x7f5/0x990 [ 183.985912][ T6428] netlink_sendmsg+0x813/0xb40 [ 183.985951][ T6428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 183.985984][ T6428] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 183.986016][ T6428] ? __kernel_text_address+0xd/0x30 [ 183.986037][ T6428] ? unwind_get_return_address+0x4d/0x90 [ 183.986062][ T6428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 183.986088][ T6428] sock_sendmsg_nosec+0x13a/0x180 [ 183.986114][ T6428] ____sys_sendmsg+0x565/0x870 [ 183.986156][ T6428] ? __might_fault+0xaf/0x130 [ 183.986184][ T6428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 183.986220][ T6428] ? import_iovec+0x73/0xa0 [ 183.986245][ T6428] ___sys_sendmsg+0x2a5/0x360 [ 183.986272][ T6428] ? __lock_acquire+0x683/0x2ce0 [ 183.986299][ T6428] ? __pfx____sys_sendmsg+0x10/0x10 [ 183.986359][ T6428] ? __fget_files+0x2a/0x420 [ 183.986381][ T6428] ? __fget_files+0x3a8/0x420 [ 183.986412][ T6428] __x64_sys_sendmsg+0x1b7/0x290 [ 183.986440][ T6428] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 183.986490][ T6428] do_syscall_64+0x166/0x520 [ 183.986511][ T6428] ? trace_irq_disable+0x3b/0x140 [ 183.986530][ T6428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.986549][ T6428] ? clear_bhb_loop+0x70/0xc0 [ 183.986574][ T6428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 183.986594][ T6428] RIP: 0033:0x7fc67fc0e0d9 [ 183.986615][ T6428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.986630][ T6428] RSP: 002b:00007fc67de66028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 183.986650][ T6428] RAX: ffffffffffffffda RBX: 00007fc67fe95fa0 RCX: 00007fc67fc0e0d9 [ 183.986664][ T6428] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000009 [ 183.986676][ T6428] RBP: 00007fc67de66090 R08: 0000000000000000 R09: 0000000000000000 [ 183.986687][ T6428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 183.986697][ T6428] R13: 00007fc67fe96038 R14: 00007fc67fe95fa0 R15: 00007ffcd0f197e8 [ 183.986729][ T6428] [ 184.643684][ T5600] Bluetooth: hci3: command tx timeout [ 186.293015][ T6232] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.293159][ T6232] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.293357][ T6232] bridge_slave_0: entered allmulticast mode [ 186.320892][ T6232] bridge_slave_0: entered promiscuous mode [ 186.380336][ T6232] bridge0: port 2(bridge_slave_1) entered blocking state [ 186.380461][ T6232] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.380656][ T6232] bridge_slave_1: entered allmulticast mode [ 186.430174][ T6232] bridge_slave_1: entered promiscuous mode [ 186.719366][ T5600] Bluetooth: hci3: command tx timeout [ 187.300338][ T6457] syz.3.157 (6457): drop_caches: 2 [ 188.414775][ T6471] netlink: 48 bytes leftover after parsing attributes in process `syz.3.160'. [ 189.909922][ T6232] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.995916][ T6232] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.994631][ T6488] netlink: 8 bytes leftover after parsing attributes in process `syz.1.164'. [ 193.343821][ T6232] team0: Port device team_slave_0 added [ 193.440339][ T6232] team0: Port device team_slave_1 added [ 194.084929][ T5817] bridge_slave_1: left allmulticast mode [ 194.085263][ T5817] bridge_slave_1: left promiscuous mode [ 194.144722][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.247128][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.247189][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.651999][ T5817] bridge_slave_0: left allmulticast mode [ 194.652036][ T5817] bridge_slave_0: left promiscuous mode [ 194.652282][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.682120][ T6510] netlink: 48 bytes leftover after parsing attributes in process `syz.3.170'. [ 196.950468][ T6525] syz.4.173 (6525): drop_caches: 2 [ 198.413172][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.4.175'. [ 200.949536][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 201.009190][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 201.030501][ T5817] bond0 (unregistering): Released all slaves [ 202.496846][ T6232] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 202.496861][ T6232] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.496885][ T6232] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 202.806793][ T6232] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 202.806810][ T6232] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 202.806836][ T6232] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 203.646979][ T6232] hsr_slave_0: entered promiscuous mode [ 203.658528][ T6232] hsr_slave_1: entered promiscuous mode [ 203.662942][ T6232] debugfs: 'hsr0' already exists in 'hsr' [ 203.662967][ T6232] Cannot create hsr debugfs directory [ 203.968189][ T6561] tmpfs: Bad value for 'mpol' [ 205.605902][ T6587] netlink: 48 bytes leftover after parsing attributes in process `syz.1.184'. [ 206.577426][ T5591] Bluetooth: hci4: command 0x0406 tx timeout [ 206.591985][ T5601] Bluetooth: hci2: command 0x0406 tx timeout [ 206.602387][ T5601] Bluetooth: hci1: command 0x0406 tx timeout [ 206.740107][ T5244] 8021q: adding VLAN 0 to HW filter on device eth1 [ 207.027067][ T6348] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.027200][ T6348] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.027376][ T6348] bridge_slave_0: entered allmulticast mode [ 207.068842][ T6348] bridge_slave_0: entered promiscuous mode [ 208.401548][ T6348] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.401773][ T6348] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.401936][ T6348] bridge_slave_1: entered allmulticast mode [ 208.526843][ T6348] bridge_slave_1: entered promiscuous mode [ 209.295910][ T6617] netlink: 12 bytes leftover after parsing attributes in process `syz.1.191'. [ 209.324712][ T6617] netlink: 104 bytes leftover after parsing attributes in process `syz.1.191'. [ 210.618901][ T6627] netlink: 48 bytes leftover after parsing attributes in process `syz.1.193'. [ 211.344647][ T6348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 211.403212][ T6348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.730313][ T5817] hsr_slave_0: left promiscuous mode [ 211.770263][ T5817] hsr_slave_1: left promiscuous mode [ 211.772662][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 211.772726][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 211.821973][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 211.821998][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 211.869868][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 211.936891][ T5817] veth1_macvtap: left promiscuous mode [ 211.937176][ T5817] veth0_macvtap: left promiscuous mode [ 211.943822][ T5817] veth1_vlan: left promiscuous mode [ 211.945112][ T5817] veth0_vlan: left promiscuous mode [ 212.044181][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 212.044245][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=092b, bcdDevice=6b.72 [ 212.044299][ T9] usb 2-1: too many configurations: 177, using maximum allowed: 8 [ 212.046440][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 212.046473][ T9] usb 2-1: can't read configurations, error -61 [ 212.240414][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 212.570356][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 212.570411][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=092b, bcdDevice=6b.72 [ 212.570461][ T9] usb 2-1: too many configurations: 177, using maximum allowed: 8 [ 212.573543][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 212.573579][ T9] usb 2-1: can't read configurations, error -61 [ 212.579200][ T9] usb usb2-port1: attempt power cycle [ 212.908537][ T6067] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 212.994589][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 213.036802][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 213.036856][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=092b, bcdDevice=6b.72 [ 213.036904][ T9] usb 2-1: too many configurations: 177, using maximum allowed: 8 [ 213.039857][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 213.039890][ T9] usb 2-1: can't read configurations, error -61 [ 213.120878][ T6067] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 213.126977][ T6067] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 213.126993][ T6067] usb 4-1: Product: syz [ 213.127001][ T6067] usb 4-1: SerialNumber: syz [ 213.162081][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 213.163613][ T6067] usb 4-1: config 0 descriptor?? [ 213.169357][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 213.207749][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 213.207803][ T9] usb 2-1: New USB device found, idVendor=046d, idProduct=092b, bcdDevice=6b.72 [ 213.207852][ T9] usb 2-1: too many configurations: 177, using maximum allowed: 8 [ 213.241531][ T9] usb 2-1: unable to read config index 0 descriptor/start: -61 [ 213.241679][ T9] usb 2-1: can't read configurations, error -61 [ 213.242081][ T9] usb usb2-port1: unable to enumerate USB device [ 213.247811][ T6067] hso 4-1:0.0: Not our interface [ 213.329274][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 213.378909][ T6633] netlink: 4 bytes leftover after parsing attributes in process `syz.3.196'. [ 213.378923][ T6633] netlink: 189 bytes leftover after parsing attributes in process `syz.3.196'. [ 213.405044][ T9] usb 4-1: USB disconnect, device number 4 [ 213.655230][ T6348] team0: Port device team_slave_0 added [ 213.709666][ T6348] team0: Port device team_slave_1 added [ 214.258207][ T6348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 214.258222][ T6348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.258244][ T6348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 214.262602][ T6348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 214.262615][ T6348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 214.262638][ T6348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 215.357305][ T6663] syz.1.200 (6663): drop_caches: 2 [ 215.651561][ T6348] hsr_slave_0: entered promiscuous mode [ 215.652790][ T6348] hsr_slave_1: entered promiscuous mode [ 215.653637][ T6348] debugfs: 'hsr0' already exists in 'hsr' [ 215.653660][ T6348] Cannot create hsr debugfs directory [ 215.809631][ T6232] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 217.136704][ T6232] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 217.395727][ T6232] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 217.436123][ T6674] tmpfs: Unknown parameter 'quota,5Q;c$ [ 217.436123][ T6674] (`tVv>t;?k87ʂϮURDYPnCu7' [ 217.524884][ T6232] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 217.560239][ T5244] 8021q: adding VLAN 0 to HW filter on device eth2 [ 217.560759][ T6232] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 217.661097][ T6232] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 217.848685][ T6232] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 217.933600][ T6232] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 218.632277][ T5600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 218.656594][ T5600] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 218.678567][ T5600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 218.723273][ T5600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 218.758532][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 219.775633][ T6697] netlink: 8 bytes leftover after parsing attributes in process `syz.4.205'. [ 220.958997][ T4898] Bluetooth: hci0: command tx timeout [ 221.877735][ T6722] mtrr: base(0xd0000000) is not aligned on a size(0x0000) boundary [ 221.912031][ T5244] 8021q: adding VLAN 0 to HW filter on device eth3 [ 223.719684][ T4898] Bluetooth: hci0: command tx timeout [ 224.617028][ T5244] 8021q: adding VLAN 0 to HW filter on device eth4 [ 224.688341][ T6348] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 224.808581][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 225.916806][ T4898] Bluetooth: hci0: command tx timeout [ 226.565332][ T6348] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 227.786822][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 227.812898][ T6348] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 227.919229][ T4898] Bluetooth: hci0: command tx timeout [ 227.951575][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 227.995038][ T6348] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 228.041754][ T6348] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 228.439008][ T6067] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 229.569482][ T6067] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 229.570976][ T6067] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 229.571004][ T6067] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 229.571023][ T6067] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 229.571044][ T6067] usb 5-1: config 1 has no interface number 0 [ 229.571074][ T6067] usb 5-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 229.571112][ T6067] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 229.575384][ T6067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.575408][ T6067] usb 5-1: Product: syz [ 229.575423][ T6067] usb 5-1: Manufacturer: syz [ 229.575437][ T6067] usb 5-1: SerialNumber: syz [ 229.977477][ T6067] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -71 [ 230.013813][ T6067] usb 5-1: USB disconnect, device number 2 [ 230.807179][ T6820] sg_write: process 231 (syz.4.223) changed security contexts after opening file descriptor, this is not allowed. [ 230.848860][ T6820] openvswitch: netlink: IP tunnel dst address not specified [ 231.949481][ T6838] netlink: 12 bytes leftover after parsing attributes in process `syz.1.227'. [ 231.973319][ T6838] netlink: 104 bytes leftover after parsing attributes in process `syz.1.227'. [ 233.370567][ T6839] Line length is too long: Should be less than 4094 [ 236.358529][ T5720] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 237.347293][ T5720] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 237.348629][ T5720] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 237.348670][ T5720] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.388803][ T5720] usb 4-1: config 0 descriptor?? [ 238.304402][ T5600] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 238.336452][ T5600] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 238.356194][ T5600] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 238.367098][ T5600] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 238.403222][ T5720] usbhid 4-1:0.0: can't add hid device: -71 [ 238.403351][ T5720] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 238.524111][ T5600] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 238.664859][ T5720] usb 4-1: USB disconnect, device number 5 [ 239.000145][ T5817] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.260530][ T5720] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 241.301689][ T4898] Bluetooth: hci5: command tx timeout [ 242.063919][ T6680] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.064045][ T6680] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.064230][ T6680] bridge_slave_0: entered allmulticast mode [ 242.098798][ T6680] bridge_slave_0: entered promiscuous mode [ 242.124383][ T6680] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.124504][ T6680] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.124663][ T6680] bridge_slave_1: entered allmulticast mode [ 242.146912][ T6680] bridge_slave_1: entered promiscuous mode [ 243.359547][ T4898] Bluetooth: hci5: command tx timeout [ 244.754899][ T5817] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.018023][ T5244] 8021q: adding VLAN 0 to HW filter on device eth5 [ 245.510690][ T4898] Bluetooth: hci5: command tx timeout [ 247.608645][ T4898] Bluetooth: hci5: command tx timeout [ 249.742790][ T6680] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 250.051127][ T6952] netlink: 8 bytes leftover after parsing attributes in process `syz.4.245'. [ 250.145420][ T6680] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 251.343599][ T6959] netlink: 104 bytes leftover after parsing attributes in process `syz.3.246'. [ 251.654185][ T5817] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 252.764598][ T6680] team0: Port device team_slave_0 added [ 252.784398][ T6680] team0: Port device team_slave_1 added [ 254.194979][ T5817] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 254.243156][ T6680] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 254.243172][ T6680] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 254.243196][ T6680] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 254.347650][ T6680] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 254.347666][ T6680] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 254.347684][ T6680] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 255.385555][ T6680] hsr_slave_0: entered promiscuous mode [ 255.399377][ T6680] hsr_slave_1: entered promiscuous mode [ 255.405586][ T6680] debugfs: 'hsr0' already exists in 'hsr' [ 255.405613][ T6680] Cannot create hsr debugfs directory [ 255.688855][ T6067] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 255.720478][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.720536][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.898639][ T6067] usb 5-1: Using ep0 maxpacket: 8 [ 255.899460][ T6067] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 255.915539][ T6067] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 255.915567][ T6067] usb 5-1: Product: syz [ 255.915582][ T6067] usb 5-1: Manufacturer: syz [ 255.915596][ T6067] usb 5-1: SerialNumber: syz [ 255.974330][ T6067] usb 5-1: config 0 descriptor?? [ 256.073411][ T7010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 256.074069][ T7010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 256.218630][ T6067] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 257.370106][ T5720] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 257.592109][ T6067] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 257.697802][ T6067] usb 5-1: USB disconnect, device number 3 [ 257.708654][ T5720] usb 2-1: Using ep0 maxpacket: 32 [ 257.709303][ T5720] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 257.711569][ T5720] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 257.718330][ T5720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.718353][ T5720] usb 2-1: Product: syz [ 257.718367][ T5720] usb 2-1: Manufacturer: syz [ 257.718381][ T5720] usb 2-1: SerialNumber: syz [ 257.871898][ T5720] usb 2-1: config 0 descriptor?? [ 258.673495][ T5244] 8021q: adding VLAN 0 to HW filter on device eth6 [ 258.781066][ T5315] usb 2-1: USB disconnect, device number 7 [ 259.355167][ T5720] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 260.631156][ T5817] bridge_slave_1: left allmulticast mode [ 260.631190][ T5817] bridge_slave_1: left promiscuous mode [ 260.631450][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 260.633265][ T5720] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 261.244378][ T5720] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.244442][ T5720] usb 5-1: Product: syz [ 261.244488][ T5720] usb 5-1: Manufacturer: syz [ 261.244503][ T5720] usb 5-1: SerialNumber: syz [ 261.739789][ T5865] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 262.028832][ T5865] usb 4-1: Using ep0 maxpacket: 32 [ 262.129543][ T5865] usb 4-1: unable to get BOS descriptor or descriptor too short [ 262.224443][ T5865] usb 4-1: New USB device found, idVendor=03f8, idProduct=0004, bcdDevice= 0.40 [ 262.372379][ T5720] usb 5-1: can't set config #1, error -71 [ 262.449092][ T5720] usb 5-1: USB disconnect, device number 4 [ 262.502703][ T5817] bridge_slave_0: left allmulticast mode [ 262.502964][ T5817] bridge_slave_0: left promiscuous mode [ 262.526332][ T5865] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 262.526367][ T5865] usb 4-1: can't read configurations, error -71 [ 262.582898][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.022122][ T7058] syz.4.264 (7058): drop_caches: 2 [ 264.212635][ T5817] bridge_slave_1: left allmulticast mode [ 264.212671][ T5817] bridge_slave_1: left promiscuous mode [ 264.212914][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.640582][ T7062] syz.3.266 uses obsolete (PF_INET,SOCK_PACKET) [ 265.591218][ T5817] bridge_slave_0: left allmulticast mode [ 265.591254][ T5817] bridge_slave_0: left promiscuous mode [ 265.591496][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.714777][ T7066] netlink: 104 bytes leftover after parsing attributes in process `syz.3.267'. [ 268.497869][ T7077] syz.4.270 (7077): drop_caches: 2 [ 268.700355][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 268.779558][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 268.841271][ T5817] bond0 (unregistering): Released all slaves [ 269.726550][ T7081] syz.4.271 (7081): drop_caches: 2 [ 270.535485][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 270.589388][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 270.622938][ T5817] bond0 (unregistering): Released all slaves [ 271.923189][ T7100] netlink: 8 bytes leftover after parsing attributes in process `syz.4.276'. [ 271.923211][ T7100] netlink: 24 bytes leftover after parsing attributes in process `syz.4.276'. [ 271.976135][ T7102] netlink: 8 bytes leftover after parsing attributes in process `syz.4.276'. [ 271.976156][ T7102] netlink: 24 bytes leftover after parsing attributes in process `syz.4.276'. [ 273.288522][ T5865] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 273.449535][ T5865] usb 2-1: Using ep0 maxpacket: 32 [ 273.450477][ T5865] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 273.453319][ T5865] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 273.453345][ T5865] usb 2-1: config 2 has no interface number 0 [ 273.453399][ T5865] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 273.453426][ T5865] usb 2-1: config 2 interface 88 has no altsetting 0 [ 273.485033][ T5865] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 273.485061][ T5865] usb 2-1: Product: syz [ 273.485076][ T5865] usb 2-1: Manufacturer: syz [ 273.485091][ T5865] usb 2-1: SerialNumber: syz [ 273.567563][ T7116] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 273.977270][ T6869] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.977598][ T6869] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.011816][ T6869] bridge_slave_0: entered allmulticast mode [ 274.017229][ T6869] bridge_slave_0: entered promiscuous mode [ 274.107398][ T7112] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 277.093361][ T7123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.278'. [ 279.036771][ T6869] bridge0: port 2(bridge_slave_1) entered blocking state [ 279.036941][ T6869] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.037123][ T6869] bridge_slave_1: entered allmulticast mode [ 279.067954][ T6869] bridge_slave_1: entered promiscuous mode [ 279.383987][ T5600] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 279.420691][ T5600] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 279.442243][ T5865] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -110 [ 279.442617][ T5865] asix 2-1:2.88: probe with driver asix failed with error -110 [ 279.448972][ T5600] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 279.476272][ T5600] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 279.478103][ T5600] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 279.753056][ T5865] usb 2-1: USB disconnect, device number 8 [ 280.677118][ T6869] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 280.703486][ T6869] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.100206][ T5817] hsr_slave_0: left promiscuous mode [ 281.142449][ T5817] hsr_slave_1: left promiscuous mode [ 281.143693][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 281.190315][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 281.388611][ T5817] hsr_slave_0: left promiscuous mode [ 281.429401][ T5817] hsr_slave_1: left promiscuous mode [ 281.430186][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 281.430202][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 281.484808][ T5817] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 281.484831][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 281.487477][ T3346] IPVS: starting estimator thread 0... [ 281.526494][ T4898] Bluetooth: hci3: command tx timeout [ 281.568682][ T5720] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 281.590141][ T5817] veth1_macvtap: left promiscuous mode [ 281.590224][ T5817] veth0_macvtap: left promiscuous mode [ 281.590368][ T5817] veth1_vlan: left promiscuous mode [ 281.590470][ T5817] veth0_vlan: left promiscuous mode [ 281.628881][ T7159] IPVS: using max 9 ests per chain, 21600 per kthread [ 281.698542][ T5720] usb 5-1: device descriptor read/64, error -71 [ 281.969870][ T5720] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 282.108536][ T5720] usb 5-1: device descriptor read/64, error -71 [ 282.181388][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 282.221734][ T5720] usb usb5-port1: attempt power cycle [ 282.224608][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 282.348996][ C0] vcan0: j1939_tp_rxtimer: 0xffff88804be07400: rx timeout, send abort [ 282.351111][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88804be07400: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 283.418833][ T5720] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 283.520017][ T5720] usb 5-1: device descriptor read/8, error -71 [ 283.602437][ T4898] Bluetooth: hci3: command tx timeout [ 283.798503][ T5720] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 283.821040][ T5720] usb 5-1: device descriptor read/8, error -71 [ 283.941111][ T5720] usb usb5-port1: unable to enumerate USB device [ 284.032795][ T7170] netlink: 32 bytes leftover after parsing attributes in process `syz.1.289'. [ 285.070959][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 285.244819][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 285.692921][ T4898] Bluetooth: hci3: command tx timeout [ 286.540493][ T7193] netlink: 8 bytes leftover after parsing attributes in process `syz.1.295'. [ 288.403016][ T4898] Bluetooth: hci3: command tx timeout [ 288.933833][ T7211] netlink: 12 bytes leftover after parsing attributes in process `syz.4.298'. [ 288.943146][ T7211] netlink: 104 bytes leftover after parsing attributes in process `syz.4.298'. [ 290.244938][ T6869] team0: Port device team_slave_0 added [ 290.275705][ T7218] netlink: 8 bytes leftover after parsing attributes in process `syz.4.299'. [ 290.543630][ T6869] team0: Port device team_slave_1 added [ 291.099465][ T6869] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 291.099483][ T6869] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 291.099508][ T6869] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 291.156535][ T6869] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 291.156551][ T6869] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 291.156576][ T6869] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 291.574930][ T7226] netlink: 48 bytes leftover after parsing attributes in process `syz.3.301'. [ 292.346414][ T4898] Bluetooth: to_multiplier 0 < 10 [ 292.446289][ T6869] hsr_slave_0: entered promiscuous mode [ 292.476595][ T6869] hsr_slave_1: entered promiscuous mode [ 292.491556][ T6869] debugfs: 'hsr0' already exists in 'hsr' [ 292.491581][ T6869] Cannot create hsr debugfs directory [ 292.508165][ T7237] tipc: Started in network mode [ 292.508198][ T7237] tipc: Node identity 7f000001, cluster identity 4711 [ 292.708283][ T7237] tipc: New replicast peer: 127.0.0.2 [ 292.718724][ T7237] tipc: Enabled bearer , priority 10 [ 293.928738][ T31] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 294.117494][ T5315] tipc: Node number set to 2130706433 [ 294.129021][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 294.138063][ T31] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 294.152627][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 294.152654][ T31] usb 4-1: Product: syz [ 294.152669][ T31] usb 4-1: Manufacturer: syz [ 294.152683][ T31] usb 4-1: SerialNumber: syz [ 294.404746][ T4898] Bluetooth: hci4: command 0x0406 tx timeout [ 295.193082][ T31] usb 4-1: config 0 descriptor?? [ 295.373016][ T7268] netlink: 104 bytes leftover after parsing attributes in process `syz.1.307'. [ 296.437942][ T7267] syz.4.308 (7267): drop_caches: 2 [ 296.456203][ T31] ssu100 4-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected [ 296.758967][ T31] ssu100 4-1:0.0: probe with driver ssu100 failed with error -110 [ 297.071911][ T5720] usb 4-1: USB disconnect, device number 9 [ 297.406836][ T7291] netlink: 48 bytes leftover after parsing attributes in process `syz.1.311'. [ 297.917791][ T5600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 297.959879][ T5600] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 297.983235][ T5600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 297.988017][ T5600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 298.018225][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 299.538834][ T7318] syz.4.315 (7318): drop_caches: 2 [ 300.170677][ T4898] Bluetooth: hci0: command tx timeout [ 300.450350][ T7330] netlink: 104 bytes leftover after parsing attributes in process `syz.1.317'. [ 301.758765][ T31] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 301.918506][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 301.920312][ T31] usb 2-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 301.924660][ T31] usb 2-1: config 2 has an invalid interface number: 88 but max is 0 [ 301.924684][ T31] usb 2-1: config 2 has no interface number 0 [ 301.924726][ T31] usb 2-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 301.924749][ T31] usb 2-1: config 2 interface 88 has no altsetting 0 [ 301.986847][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 301.986873][ T31] usb 2-1: Product: syz [ 301.986888][ T31] usb 2-1: Manufacturer: syz [ 301.986901][ T31] usb 2-1: SerialNumber: syz [ 302.063399][ T7340] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 302.257572][ T4898] Bluetooth: hci0: command tx timeout [ 302.674788][ T7335] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 305.255930][ T4898] Bluetooth: hci0: command tx timeout [ 307.124940][ T31] asix 2-1:2.88 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 307.125108][ T31] asix 2-1:2.88: probe with driver asix failed with error -71 [ 307.257899][ T31] usb 2-1: USB disconnect, device number 9 [ 307.343600][ T7370] netlink: 48 bytes leftover after parsing attributes in process `syz.3.322'. [ 307.599508][ T4898] Bluetooth: hci0: command tx timeout [ 307.829151][ T7127] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.829347][ T7127] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.829498][ T7127] bridge_slave_0: entered allmulticast mode [ 307.831507][ T7127] bridge_slave_0: entered promiscuous mode [ 307.892325][ T7127] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.892537][ T7127] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.892711][ T7127] bridge_slave_1: entered allmulticast mode [ 307.967723][ T7127] bridge_slave_1: entered promiscuous mode [ 308.225231][ T7127] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 308.268226][ T7127] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 308.472397][ T7127] team0: Port device team_slave_0 added [ 308.544847][ T7127] team0: Port device team_slave_1 added [ 309.710249][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz.4.327'. [ 310.018529][ T9] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 311.103668][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 311.104417][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 311.104453][ T9] usb 4-1: New USB device found, idVendor=0763, idProduct=2031, bcdDevice= 0.40 [ 311.105954][ T9] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 311.105997][ T9] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 58, changing to 4 [ 311.158878][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.158905][ T9] usb 4-1: Product: syz [ 311.158919][ T9] usb 4-1: Manufacturer: syz [ 311.158933][ T9] usb 4-1: SerialNumber: syz [ 312.068160][ T7414] netlink: 16 bytes leftover after parsing attributes in process `syz.1.323'. [ 313.104305][ T7127] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 313.104321][ T7127] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.104344][ T7127] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 313.470522][ T9] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 313.768202][ T7127] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 313.768215][ T7127] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 313.768235][ T7127] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 314.259576][ T7434] netlink: 48 bytes leftover after parsing attributes in process `syz.1.333'. [ 314.323927][ T9] usb 4-1: USB disconnect, device number 10 [ 314.986022][ T7440] syz.4.334 (7440): drop_caches: 2 [ 315.217008][ T7442] syz.3.335 (7442): drop_caches: 2 [ 315.965850][ T6871] udevd[6871]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 317.130286][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.130352][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.186518][ T7461] capability: warning: `syz.4.340' uses deprecated v2 capabilities in a way that may be insecure [ 317.300680][ T7127] hsr_slave_0: entered promiscuous mode [ 317.306552][ T181] IPVS: starting estimator thread 0... [ 317.318007][ T7127] hsr_slave_1: entered promiscuous mode [ 317.324555][ T7127] debugfs: 'hsr0' already exists in 'hsr' [ 317.324581][ T7127] Cannot create hsr debugfs directory [ 317.398701][ T7465] IPVS: using max 8 ests per chain, 19200 per kthread [ 319.478555][ T5315] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 319.699388][ T5315] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 319.701057][ T5315] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 319.701086][ T5315] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 319.701109][ T5315] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 319.702870][ T5315] usb 2-1: New USB device strings: Mfr=245, Product=0, SerialNumber=0 [ 319.702893][ T5315] usb 2-1: Manufacturer: syz [ 319.767706][ T5315] usb 2-1: config 0 descriptor?? [ 319.806913][ T5315] usbhid 2-1:0.0: can't add hid device: -22 [ 319.807025][ T5315] usbhid 2-1:0.0: probe with driver usbhid failed with error -22 [ 320.001569][ T6067] usb 2-1: USB disconnect, device number 10 [ 320.254002][ T7484] syz.3.344 (7484): drop_caches: 2 [ 320.473267][ T7491] netlink: 48 bytes leftover after parsing attributes in process `syz.4.346'. [ 322.061303][ T7288] bridge0: port 1(bridge_slave_0) entered blocking state [ 322.061486][ T7288] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.061676][ T7288] bridge_slave_0: entered allmulticast mode [ 322.113313][ T7288] bridge_slave_0: entered promiscuous mode [ 322.659170][ T7288] bridge0: port 2(bridge_slave_1) entered blocking state [ 322.659367][ T7288] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.659532][ T7288] bridge_slave_1: entered allmulticast mode [ 322.665505][ T7288] bridge_slave_1: entered promiscuous mode [ 322.729898][ T7531] netlink: 8 bytes leftover after parsing attributes in process `syz.1.354'. [ 322.729930][ T7531] netlink: 80 bytes leftover after parsing attributes in process `syz.1.354'. [ 323.612969][ T7540] syz.1.356 (7540): drop_caches: 2 [ 323.995210][ T5244] 8021q: adding VLAN 0 to HW filter on device eth9 [ 324.136663][ T7288] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 324.485459][ T7288] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 324.525836][ T7549] syz.3.357 (7549): drop_caches: 2 [ 324.814461][ T7288] team0: Port device team_slave_0 added [ 324.829399][ T7288] team0: Port device team_slave_1 added [ 325.158910][ T5817] bridge_slave_1: left allmulticast mode [ 325.158946][ T5817] bridge_slave_1: left promiscuous mode [ 325.159267][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.406116][ T5817] bridge_slave_0: left allmulticast mode [ 325.406150][ T5817] bridge_slave_0: left promiscuous mode [ 325.406405][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.619429][ T7568] netlink: 48 bytes leftover after parsing attributes in process `syz.1.363'. [ 325.665731][ T5817] bridge_slave_1: left allmulticast mode [ 325.665765][ T5817] bridge_slave_1: left promiscuous mode [ 325.666002][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 325.788592][ T5865] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 325.850580][ T5817] bridge_slave_0: left allmulticast mode [ 325.850615][ T5817] bridge_slave_0: left promiscuous mode [ 325.850857][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 325.969074][ T5865] usb 4-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 325.973736][ T5865] usb 4-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 325.973762][ T5865] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 325.977376][ T5865] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.977401][ T5865] usb 4-1: Product: syz [ 325.977415][ T5865] usb 4-1: Manufacturer: syz [ 325.977430][ T5865] usb 4-1: SerialNumber: syz [ 326.040972][ T5865] usb 4-1: config 0 descriptor?? [ 326.067402][ T5865] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 326.148906][ T5817] bridge_slave_1: left allmulticast mode [ 326.149018][ T5817] bridge_slave_1: left promiscuous mode [ 326.149436][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 326.323776][ T5817] bridge_slave_0: left allmulticast mode [ 326.323812][ T5817] bridge_slave_0: left promiscuous mode [ 326.324047][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.745913][ T36] usb 4-1: USB disconnect, device number 11 [ 327.424931][ T57] IPVS: starting estimator thread 0... [ 327.548632][ T7576] IPVS: using max 7 ests per chain, 16800 per kthread [ 328.608929][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 330.032955][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 330.157518][ T5817] bond0 (unregistering): Released all slaves [ 330.600264][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 330.682191][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 330.761197][ T5817] bond0 (unregistering): Released all slaves [ 331.032169][ T7601] syz.3.370 (7601): drop_caches: 2 [ 331.369114][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 331.449260][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 331.510253][ T5817] bond0 (unregistering): Released all slaves [ 331.529077][ T7127] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 331.623106][ T7127] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 331.968323][ T7585] veth3: entered promiscuous mode [ 331.987814][ T7127] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 332.088727][ T7127] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 332.093666][ T7288] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 332.093681][ T7288] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 332.093705][ T7288] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 332.278651][ T5315] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 332.504601][ T7611] syz.1.372 (7611): drop_caches: 2 [ 332.772832][ T5315] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 333.109532][ T7127] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 333.153056][ T5315] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 333.153086][ T5315] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 333.153110][ T5315] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 333.155234][ T5315] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.155256][ T5315] usb 4-1: Product: syz [ 333.155270][ T5315] usb 4-1: Manufacturer: syz [ 333.155283][ T5315] usb 4-1: SerialNumber: syz [ 333.185874][ T5315] usb 4-1: config 0 descriptor?? [ 333.191275][ T7604] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 333.192112][ T7604] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 333.222418][ T5315] usb 4-1: ucan: probing device on interface #0 [ 333.263931][ T7127] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 333.265881][ T7288] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 333.265894][ T7288] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 333.265968][ T7288] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 333.424745][ T7127] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 333.562688][ T7127] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 333.671539][ T5315] usb 4-1: ucan: device reported invalid device info [ 333.671577][ T5315] usb 4-1: ucan: probe failed; try to update the device firmware [ 333.915103][ T7288] hsr_slave_0: entered promiscuous mode [ 333.933573][ T7288] hsr_slave_1: entered promiscuous mode [ 333.934468][ T7288] debugfs: 'hsr0' already exists in 'hsr' [ 333.934492][ T7288] Cannot create hsr debugfs directory [ 334.442833][ T5817] hsr_slave_0: left promiscuous mode [ 334.478646][ T5817] hsr_slave_1: left promiscuous mode [ 334.516514][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.574968][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.800563][ T5817] hsr_slave_0: left promiscuous mode [ 334.838750][ T5817] hsr_slave_1: left promiscuous mode [ 334.839958][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.890863][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.246619][ T5315] usb 4-1: USB disconnect, device number 12 [ 335.279188][ T5817] hsr_slave_0: left promiscuous mode [ 335.290974][ T7641] syz.4.379 (7641): drop_caches: 2 [ 335.299447][ T5817] hsr_slave_1: left promiscuous mode [ 335.300768][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 335.343200][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 335.454648][ T7647] netlink: 48 bytes leftover after parsing attributes in process `syz.1.380'. [ 336.037049][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 336.369286][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 338.286897][ T7657] Bluetooth: MGMT ver 1.23 [ 340.023726][ T5600] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 340.058011][ T5600] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 340.063986][ T5600] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 340.065188][ T5600] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 340.065940][ T5600] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 340.149788][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 340.377616][ T7668] netlink: 12 bytes leftover after parsing attributes in process `syz.4.385'. [ 340.384868][ T7668] netlink: 104 bytes leftover after parsing attributes in process `syz.4.385'. [ 341.071052][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 341.692577][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 341.739065][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 343.016304][ T5600] Bluetooth: hci5: command tx timeout [ 343.046221][ T7698] syz.3.389 (7698): drop_caches: 2 [ 345.038562][ T5600] Bluetooth: hci5: command tx timeout [ 345.065671][ T5244] 8021q: adding VLAN 0 to HW filter on device eth10 [ 345.883474][ T7724] netlink: 12 bytes leftover after parsing attributes in process `syz.4.394'. [ 345.891314][ T7724] netlink: 104 bytes leftover after parsing attributes in process `syz.4.394'. [ 346.699048][ T7723] netlink: zone id is out of range [ 346.699062][ T7723] netlink: zone id is out of range [ 346.699070][ T7723] netlink: zone id is out of range [ 346.699077][ T7723] netlink: zone id is out of range [ 346.699084][ T7723] netlink: zone id is out of range [ 346.699108][ T7723] netlink: zone id is out of range [ 346.699349][ T7723] netlink: zone id is out of range [ 346.699358][ T7723] netlink: zone id is out of range [ 346.699365][ T7723] netlink: zone id is out of range [ 346.699372][ T7723] netlink: zone id is out of range [ 347.122562][ T7733] netlink: 48 bytes leftover after parsing attributes in process `syz.4.396'. [ 347.740743][ T5600] Bluetooth: hci5: command tx timeout [ 348.080289][ T7742] futex_wake_op: syz.1.398 tries to shift op by -1; fix this program [ 348.236968][ T7743] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 348.749840][ T5244] 8021q: adding VLAN 0 to HW filter on device eth11 [ 348.858487][ T7730] netlink: 12 bytes leftover after parsing attributes in process `syz.3.395'. [ 349.896059][ T5600] Bluetooth: hci5: command tx timeout [ 350.552528][ T7779] syz.1.402 (7779): drop_caches: 2 [ 351.724304][ T7794] netlink: 12 bytes leftover after parsing attributes in process `syz.4.404'. [ 351.724932][ T7794] netlink: 104 bytes leftover after parsing attributes in process `syz.4.404'. [ 352.889430][ T7793] netlink: 48 bytes leftover after parsing attributes in process `syz.1.405'. [ 353.641315][ T5315] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 353.791867][ T5315] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 353.796470][ T5315] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.796525][ T5315] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 353.845105][ T5315] usb 5-1: config 0 descriptor?? [ 353.893979][ T5315] pwc: Askey VC010 type 2 USB webcam detected. [ 353.994262][ T7810] syz_tun: entered allmulticast mode [ 354.014800][ T7663] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.014923][ T7663] bridge0: port 1(bridge_slave_0) entered disabled state [ 354.015125][ T7663] bridge_slave_0: entered allmulticast mode [ 354.024299][ T7663] bridge_slave_0: entered promiscuous mode [ 354.035586][ T7663] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.035711][ T7663] bridge0: port 2(bridge_slave_1) entered disabled state [ 354.035874][ T7663] bridge_slave_1: entered allmulticast mode [ 354.045556][ T7663] bridge_slave_1: entered promiscuous mode [ 354.121418][ T7810] syz_tun: left allmulticast mode [ 354.213801][ T5244] 8021q: adding VLAN 0 to HW filter on device eth12 [ 354.341718][ T7663] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 355.162113][ T7663] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 355.240795][ T5315] pwc: recv_control_msg error -71 req 02 val 2700 [ 355.241223][ T5315] pwc: recv_control_msg error -71 req 02 val 2c00 [ 355.241648][ T5315] pwc: recv_control_msg error -71 req 04 val 1000 [ 355.250434][ T5315] pwc: recv_control_msg error -71 req 04 val 1300 [ 355.252171][ T5315] pwc: recv_control_msg error -71 req 04 val 1400 [ 355.254225][ T5315] pwc: recv_control_msg error -71 req 02 val 2000 [ 355.254732][ T5315] pwc: recv_control_msg error -71 req 02 val 2100 [ 355.255192][ T5315] pwc: recv_control_msg error -71 req 04 val 1500 [ 355.255647][ T5315] pwc: recv_control_msg error -71 req 02 val 2500 [ 355.256093][ T5315] pwc: recv_control_msg error -71 req 02 val 2400 [ 355.256636][ T5315] pwc: recv_control_msg error -71 req 02 val 2600 [ 355.257086][ T5315] pwc: recv_control_msg error -71 req 02 val 2900 [ 355.257522][ T5315] pwc: recv_control_msg error -71 req 02 val 2800 [ 355.258141][ T5315] pwc: recv_control_msg error -71 req 04 val 1100 [ 355.258641][ T5315] pwc: recv_control_msg error -71 req 04 val 1200 [ 355.315866][ T5315] pwc: Registered as video4. [ 355.382324][ T7288] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 355.443718][ T5315] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input36 [ 355.465710][ T7288] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 356.797282][ T7288] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 357.745427][ T7288] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 357.785012][ T5315] usb 5-1: USB disconnect, device number 9 [ 358.023983][ T7663] team0: Port device team_slave_0 added [ 358.053575][ T7663] team0: Port device team_slave_1 added [ 358.592644][ T4898] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 358.604950][ T4898] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 358.626447][ T4898] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 358.641954][ T4898] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 358.643926][ T4898] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 358.802644][ T7834] netlink: 48 bytes leftover after parsing attributes in process `syz.3.414'. [ 358.803546][ T7834] bridge_slave_0: left allmulticast mode [ 358.803575][ T7834] bridge_slave_0: left promiscuous mode [ 358.804071][ T7834] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.315217][ T7859] netlink: 12 bytes leftover after parsing attributes in process `syz.1.415'. [ 359.318808][ T7859] netlink: 104 bytes leftover after parsing attributes in process `syz.1.415'. [ 360.081826][ T7834] net_ratelimit: 14 callbacks suppressed [ 360.081844][ T7834] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 360.951945][ T7869] syz.1.416 (7869): drop_caches: 2 [ 361.027820][ T7871] syz.4.417 (7871): drop_caches: 2 [ 361.150567][ T5600] Bluetooth: hci3: command tx timeout [ 361.577265][ T7663] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 361.577281][ T7663] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.577304][ T7663] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 361.742642][ T7880] netlink: 104 bytes leftover after parsing attributes in process `syz.1.420'. [ 362.158491][ T5315] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 362.308582][ T5315] usb 2-1: Using ep0 maxpacket: 8 [ 362.314019][ T7663] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 362.314033][ T7663] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 362.314050][ T7663] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 362.315432][ T5315] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 362.386898][ T5315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 362.386925][ T5315] usb 2-1: Product: syz [ 362.386940][ T5315] usb 2-1: Manufacturer: syz [ 362.386953][ T5315] usb 2-1: SerialNumber: syz [ 362.444199][ T5315] usb 2-1: config 0 descriptor?? [ 362.661864][ T5315] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 363.210624][ T5600] Bluetooth: hci3: command tx timeout [ 363.594861][ T7663] hsr_slave_0: entered promiscuous mode [ 363.595986][ T7663] hsr_slave_1: entered promiscuous mode [ 363.612521][ T7663] debugfs: 'hsr0' already exists in 'hsr' [ 363.612547][ T7663] Cannot create hsr debugfs directory [ 363.725499][ T7926] netlink: 12 bytes leftover after parsing attributes in process `syz.3.424'. [ 363.734790][ T7926] netlink: 104 bytes leftover after parsing attributes in process `syz.3.424'. [ 365.031560][ T7937] syz.3.426 (7937): drop_caches: 2 [ 365.278572][ T5600] Bluetooth: hci3: command tx timeout [ 365.697836][ T5315] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 365.713836][ T5315] usb 2-1: USB disconnect, device number 11 [ 366.057038][ T7953] netlink: 104 bytes leftover after parsing attributes in process `syz.3.429'. [ 366.940008][ T7958] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 367.368504][ T5600] Bluetooth: hci3: command tx timeout [ 367.459838][ T5865] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 367.612533][ T5865] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 367.614181][ T5865] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 367.614225][ T5865] usb 4-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 367.708622][ T7975] netlink: 12 bytes leftover after parsing attributes in process `syz.1.434'. [ 367.717225][ T7975] netlink: 104 bytes leftover after parsing attributes in process `syz.1.434'. [ 368.489835][ T7981] tmpfs: Unknown parameter 'grpquota_blosk_hardlimdt' [ 368.519837][ T5865] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.519864][ T5865] usb 4-1: Product: syz [ 368.519879][ T5865] usb 4-1: Manufacturer: syz [ 368.519893][ T5865] usb 4-1: SerialNumber: syz [ 368.758405][ T5865] cdc_ncm 4-1:1.0: skipping garbage [ 368.758429][ T5865] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 368.758471][ T5865] cdc_ncm 4-1:1.0: bind() failure [ 368.835332][ T5865] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 368.837704][ T5865] cdc_ncm 4-1:1.1: bind() failure [ 368.909979][ T7979] bridge0: port 2(bridge_slave_1) entered listening state [ 368.979262][ T7979] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.018809][ T5315] usb 4-1: USB disconnect, device number 13 [ 369.338255][ T7988] netlink: 104 bytes leftover after parsing attributes in process `syz.1.439'. [ 369.688587][ T7995] binder: 7985:7995 ioctl c0306201 0 returned -14 [ 370.977874][ T5315] usb 4-1: new full-speed USB device number 14 using dummy_hcd [ 371.923935][ T5315] usb 4-1: not running at top speed; connect to a high speed hub [ 371.924182][ T5315] usb 4-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 372.268167][ T5315] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 372.268194][ T5315] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 372.268246][ T5315] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.521889][ T5315] uvcvideo 4-1:1.0: Found Unit with invalid ID 0 [ 372.690275][ T8002] netlink: 12 bytes leftover after parsing attributes in process `syz.3.441'. [ 373.138542][ T5865] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 373.197869][ T8018] netlink: 14 bytes leftover after parsing attributes in process `syz.1.444'. [ 373.321913][ T5865] usb 5-1: Using ep0 maxpacket: 16 [ 373.329740][ T5865] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 373.336462][ T5865] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 373.336494][ T5865] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 373.336535][ T5865] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.346978][ T8015] netlink: 96 bytes leftover after parsing attributes in process `syz.1.444'. [ 373.406225][ T5865] usb 5-1: config 0 descriptor?? [ 373.737116][ T5315] usb 4-1: string descriptor 0 read error: -71 [ 373.766960][ T5315] uvcvideo 4-1:1.0: Found UVC 0.00 device (046d:0825) [ 373.767096][ T5315] uvcvideo 4-1:1.0: No streaming interface found for terminal 32770. [ 374.030669][ T5315] usb 4-1: USB disconnect, device number 14 [ 374.130278][ T8024] netlink: 12 bytes leftover after parsing attributes in process `syz.1.445'. [ 374.131352][ T8024] netlink: 104 bytes leftover after parsing attributes in process `syz.1.445'. [ 375.617966][ T8032] netlink: 48 bytes leftover after parsing attributes in process `syz.3.446'. [ 376.375883][ T5865] hid_parser_main: 227 callbacks suppressed [ 376.375911][ T5865] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 376.375941][ T5865] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 376.376052][ T5865] microsoft 0003:045E:07DA.0002: unknown main item tag 0x0 [ 376.376868][ T5865] microsoft 0003:045E:07DA.0002: unknown global tag 0xe [ 376.376889][ T5865] microsoft 0003:045E:07DA.0002: item 0 0 1 14 parsing failed [ 376.377663][ T5865] microsoft 0003:045E:07DA.0002: parse failed [ 376.377771][ T5865] microsoft 0003:045E:07DA.0002: probe with driver microsoft failed with error -22 [ 377.971816][ T8006] usb 5-1: USB disconnect, device number 10 [ 378.800967][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.801023][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.048556][ T8006] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 380.318604][ T8006] usb 5-1: Using ep0 maxpacket: 32 [ 380.319465][ T8006] usb 5-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.06 [ 380.344772][ T8006] usb 5-1: config 2 has an invalid interface number: 88 but max is 0 [ 380.344790][ T8006] usb 5-1: config 2 has no interface number 0 [ 380.344817][ T8006] usb 5-1: config 2 interface 88 altsetting 25 bulk endpoint 0x6 has invalid maxpacket 256 [ 380.344830][ T8006] usb 5-1: config 2 interface 88 has no altsetting 0 [ 380.841454][ T8065] netlink: 48 bytes leftover after parsing attributes in process `syz.1.454'. [ 380.841703][ T5817] bridge_slave_1: left allmulticast mode [ 380.841733][ T5817] bridge_slave_1: left promiscuous mode [ 380.842001][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.381465][ T8006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=1 [ 381.381493][ T8006] usb 5-1: Product: syz [ 381.442791][ T8006] usb 5-1: can't set config #2, error -71 [ 381.445530][ T8006] usb 5-1: USB disconnect, device number 11 [ 381.590178][ T5817] bridge_slave_0: left allmulticast mode [ 381.590214][ T5817] bridge_slave_0: left promiscuous mode [ 381.590473][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.801846][ T8069] netlink: 12 bytes leftover after parsing attributes in process `syz.4.455'. [ 381.802939][ T8069] netlink: 104 bytes leftover after parsing attributes in process `syz.4.455'. [ 383.059066][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 383.159070][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 383.178565][ T8006] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 383.220003][ T5817] bond0 (unregistering): Released all slaves [ 383.358583][ T8006] usb 4-1: Using ep0 maxpacket: 32 [ 383.427132][ T8006] usb 4-1: unable to get BOS descriptor or descriptor too short [ 383.427189][ T8006] usb 4-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 383.470370][ T8006] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.470398][ T8006] usb 4-1: Product: syz [ 383.470412][ T8006] usb 4-1: Manufacturer: syz [ 383.470425][ T8006] usb 4-1: SerialNumber: syz [ 383.542409][ T8006] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 383.543317][ T8006] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 385.985295][ T7846] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.985418][ T7846] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.985610][ T7846] bridge_slave_0: entered allmulticast mode [ 386.024506][ T5719] usb 4-1: USB disconnect, device number 15 [ 386.046778][ T7846] bridge_slave_0: entered promiscuous mode [ 386.267968][ T5817] hsr_slave_0: left promiscuous mode [ 386.452146][ T5817] hsr_slave_1: left promiscuous mode [ 386.453666][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 386.599371][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 386.842053][ T8099] syz.3.463 (8099): drop_caches: 2 [ 388.905676][ T8108] netlink: 12 bytes leftover after parsing attributes in process `syz.3.465'. [ 388.906813][ T8108] netlink: 104 bytes leftover after parsing attributes in process `syz.3.465'. [ 389.935730][ T37] audit: type=1326 audit(1787319539.192:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.935782][ T37] audit: type=1326 audit(1787319539.192:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.974042][ T37] audit: type=1326 audit(1787319539.192:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.974093][ T37] audit: type=1326 audit(1787319539.242:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=448 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.974131][ T37] audit: type=1326 audit(1787319539.242:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.974168][ T37] audit: type=1326 audit(1787319539.242:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.976532][ T37] audit: type=1326 audit(1787319539.242:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.976582][ T37] audit: type=1326 audit(1787319539.242:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.976618][ T37] audit: type=1326 audit(1787319539.242:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 389.981918][ T37] audit: type=1326 audit(1787319539.242:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8109 comm="syz.3.466" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f08fafde0d9 code=0x7ffc0000 [ 390.809227][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 390.937791][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 391.429332][ T7846] bridge0: port 2(bridge_slave_1) entered blocking state [ 391.429402][ T7846] bridge0: port 2(bridge_slave_1) entered disabled state [ 391.429528][ T7846] bridge_slave_1: entered allmulticast mode [ 391.431087][ T7846] bridge_slave_1: entered promiscuous mode [ 392.431438][ T7846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 392.454678][ T7846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 392.979977][ T8136] netlink: 48 bytes leftover after parsing attributes in process `syz.4.472'. [ 394.215158][ T8144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.474'. [ 394.225460][ T8144] netlink: 104 bytes leftover after parsing attributes in process `syz.4.474'. [ 395.018221][ T7846] team0: Port device team_slave_0 added [ 395.039614][ T7846] team0: Port device team_slave_1 added [ 395.250169][ T7846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 395.250346][ T7846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 395.250372][ T7846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 395.253427][ T7846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 395.253441][ T7846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 395.253466][ T7846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 395.528681][ T7846] hsr_slave_0: entered promiscuous mode [ 395.534577][ T7846] hsr_slave_1: entered promiscuous mode [ 395.535423][ T7846] debugfs: 'hsr0' already exists in 'hsr' [ 395.535444][ T7846] Cannot create hsr debugfs directory [ 395.680233][ T8157] netlink: 12 bytes leftover after parsing attributes in process `syz.4.478'. [ 398.788499][ T8006] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 399.473804][ T8006] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 0.40 [ 399.494766][ T8006] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 399.494802][ T8006] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 399.539319][ T8006] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.539345][ T8006] usb 5-1: Product: ఉ [ 399.539360][ T8006] usb 5-1: Manufacturer: 侮荍௨缗蜯懿濓聎陱ၥ릶鿽鰕嗕ဨꏥ脶镾⦈娖寣ⳑ婔闻氛㹻ꡌ譌孒쿠闡뇢덜秬律䷽ᒖ蘮伊ߗ䲴큼ࡪష썤롄쟞頪쒁 [ 399.539382][ T8006] usb 5-1: SerialNumber: ⰻ [ 399.883812][ T8006] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 399.945289][ T8202] mmap: syz.1.486 (8202) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 400.590076][ T8209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.487'. [ 400.599328][ T8209] netlink: 104 bytes leftover after parsing attributes in process `syz.3.487'. [ 401.670344][ T4898] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 401.709128][ T4898] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 401.710483][ T4898] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 401.711517][ T4898] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 401.715542][ T4898] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 401.748086][ T5719] usb 5-1: USB disconnect, device number 12 [ 403.578485][ T5719] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 403.948003][ T5719] usb 5-1: Using ep0 maxpacket: 32 [ 403.950973][ T5719] usb 5-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 403.952490][ T5719] usb 5-1: config 0 has an invalid interface number: 85 but max is 0 [ 403.952513][ T5719] usb 5-1: config 0 has no interface number 0 [ 403.952554][ T5719] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 403.952580][ T5719] usb 5-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 403.952602][ T5719] usb 5-1: config 0 interface 85 has no altsetting 0 [ 403.966535][ T5719] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.966563][ T5719] usb 5-1: Product: syz [ 403.966578][ T5719] usb 5-1: Manufacturer: syz [ 403.966592][ T5719] usb 5-1: SerialNumber: syz [ 403.986871][ T5719] usb 5-1: config 0 descriptor?? [ 404.159058][ T4898] Bluetooth: hci0: command tx timeout [ 404.660108][ T8247] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 405.561546][ T5719] appletouch 5-1:0.85: Failed to read mode from device. [ 405.561780][ T5719] appletouch 5-1:0.85: probe with driver appletouch failed with error -5 [ 405.623926][ T5719] usb 5-1: USB disconnect, device number 13 [ 405.750443][ T201] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 406.108915][ T201] usb 4-1: Using ep0 maxpacket: 32 [ 406.136086][ T8278] netlink: 12 bytes leftover after parsing attributes in process `syz.1.499'. [ 406.141227][ T8278] netlink: 104 bytes leftover after parsing attributes in process `syz.1.499'. [ 406.239130][ T4898] Bluetooth: hci0: command tx timeout [ 406.936644][ T201] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 406.939992][ T201] usb 4-1: config index 0 descriptor too short (expected 35577, got 27) [ 406.940018][ T201] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 406.940037][ T201] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 406.940057][ T201] usb 4-1: config 1 has no interface number 0 [ 406.940116][ T201] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 406.940141][ T201] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 406.940180][ T201] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 407.080786][ T201] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 407.512803][ T8289] netlink: 12 bytes leftover after parsing attributes in process `syz.1.500'. [ 408.465634][ T4898] Bluetooth: hci0: command tx timeout [ 408.567424][ T201] snd_usb_pod 4-1:1.1: set_interface failed [ 408.568073][ T201] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 408.578063][ T201] snd_usb_pod 4-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 408.596197][ T201] usb 4-1: USB disconnect, device number 16 [ 408.844209][ T8301] netlink: 24 bytes leftover after parsing attributes in process `syz.1.504'. [ 409.021960][ T8306] binder: 8303:8306 ioctl 5000940c 0 returned -22 [ 409.023813][ T8306] binder: 8303:8306 ioctl 40285881 0 returned -22 [ 410.478489][ T4898] Bluetooth: hci0: command tx timeout [ 412.377328][ T31] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 412.756903][ T31] usb 4-1: unable to get BOS descriptor or descriptor too short [ 412.783817][ T31] usb 4-1: not running at top speed; connect to a high speed hub [ 412.783866][ T31] usb 4-1: New USB device found, idVendor=0499, idProduct=105c, bcdDevice= 0.40 [ 412.838564][ T31] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 413.836097][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.836124][ T31] usb 4-1: Product: syz [ 413.888894][ T31] usb 4-1: can't set config #1, error -71 [ 413.892323][ T31] usb 4-1: USB disconnect, device number 17 [ 413.987286][ T5817] bridge_slave_1: left allmulticast mode [ 413.987319][ T5817] bridge_slave_1: left promiscuous mode [ 413.987589][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.163332][ T5817] bridge_slave_0: left allmulticast mode [ 414.163357][ T5817] bridge_slave_0: left promiscuous mode [ 414.163538][ T5817] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.293381][ T31] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 414.331405][ T31] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 414.964672][ T5817] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 415.073553][ T5817] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 415.160737][ T5817] bond0 (unregistering): Released all slaves [ 416.240670][ T5817] hsr_slave_0: left promiscuous mode [ 416.333808][ T5817] hsr_slave_1: left promiscuous mode [ 416.335000][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 416.773944][ T5817] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 419.420426][ T8420] syz.3.531 (8420): drop_caches: 2 [ 419.646642][ T5600] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 420.246124][ T5817] team0 (unregistering): Port device team_slave_1 removed [ 420.264927][ T5600] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 420.367407][ T5600] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 420.387125][ T5600] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 420.398663][ T5600] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 422.511198][ T5817] team0 (unregistering): Port device team_slave_0 removed [ 423.283876][ T4898] Bluetooth: hci6: command tx timeout [ 423.569614][ T5244] 8021q: adding VLAN 0 to HW filter on device eth5 [ 425.388839][ T4898] Bluetooth: hci6: command tx timeout [ 426.800215][ T5315] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 427.648987][ T4898] Bluetooth: hci6: command tx timeout [ 427.818494][ T5315] usb 2-1: Using ep0 maxpacket: 8 [ 427.819486][ T5315] usb 2-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 427.820988][ T5315] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 427.821010][ T5315] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 427.827254][ T5315] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.827278][ T5315] usb 2-1: Product: syz [ 427.827292][ T5315] usb 2-1: Manufacturer: syz [ 427.827306][ T5315] usb 2-1: SerialNumber: syz [ 427.874405][ T5315] usb 2-1: 0:1 : does not exist [ 427.874633][ T5315] usb 2-1: unit 1 not found! [ 427.874655][ T5315] usb 2-1: unit 9 not found! [ 429.680584][ T4898] Bluetooth: hci6: command tx timeout [ 430.236665][ T5315] usb 2-1: USB disconnect, device number 12 [ 433.034156][ T5865] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 433.388752][ T5865] usb 4-1: Using ep0 maxpacket: 16 [ 433.898844][ T5865] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 433.913024][ T5865] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 433.913058][ T5865] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 433.929802][ T5865] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.929829][ T5865] usb 4-1: Product: syz [ 433.929851][ T5865] usb 4-1: Manufacturer: syz [ 433.929865][ T5865] usb 4-1: SerialNumber: syz [ 434.490981][ T6636] udevd[6636]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 434.792933][ T8215] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.887519][ T5865] usb 4-1: config 0 descriptor?? [ 434.932266][ T8215] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.933170][ T8215] bridge_slave_0: entered allmulticast mode [ 435.053065][ T8215] bridge_slave_0: entered promiscuous mode [ 436.192009][ T5865] usb 4-1: can't set config #0, error -71 [ 436.236183][ T5865] usb 4-1: USB disconnect, device number 18 [ 436.342048][ T8215] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.342169][ T8215] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.342356][ T8215] bridge_slave_1: entered allmulticast mode [ 436.369029][ T8215] bridge_slave_1: entered promiscuous mode [ 436.551055][ T8215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 436.605794][ T8215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 436.608426][ T5720] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 436.817564][ T5720] usb 5-1: Using ep0 maxpacket: 8 [ 436.841149][ T5720] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 436.937139][ T5720] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 436.937179][ T5720] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.981815][ T5720] usb 5-1: config 0 descriptor?? [ 437.008634][ T5720] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 437.529035][ T5720] gspca_vc032x: reg_r err -110 [ 437.529179][ T5720] vc032x 5-1:0.0: probe with driver vc032x failed with error -110 [ 439.046744][ T8536] Bluetooth: MGMT ver 1.23 [ 439.723566][ T5587] usb 5-1: USB disconnect, device number 14 [ 440.066394][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.066470][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.899932][ T8215] team0: Port device team_slave_0 added [ 441.153814][ T7663] netdevsim netdevsim5: probe with driver netdevsim failed with error -12 [ 442.749003][ T8215] team0: Port device team_slave_1 added [ 443.082307][ T8215] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.082325][ T8215] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.082351][ T8215] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.135805][ T8215] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.135823][ T8215] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.135859][ T8215] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.716235][ T8215] hsr_slave_0: entered promiscuous mode [ 443.719995][ T8215] hsr_slave_1: entered promiscuous mode [ 443.784379][ T8215] debugfs: 'hsr0' already exists in 'hsr' [ 443.784399][ T8215] Cannot create hsr debugfs directory [ 444.568468][ T5719] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 446.228722][ T155] bridge_slave_1: left allmulticast mode [ 446.228753][ T155] bridge_slave_1: left promiscuous mode [ 446.228973][ T155] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.378664][ T155] bridge_slave_0: left allmulticast mode [ 446.378701][ T155] bridge_slave_0: left promiscuous mode [ 446.379154][ T155] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.471895][ T5719] usb 5-1: unable to get BOS descriptor or descriptor too short [ 446.471954][ T5719] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 0.00 [ 446.472006][ T5719] usb 5-1: no configurations [ 446.472018][ T5719] usb 5-1: can't read configurations, error -22 [ 447.037520][ T8581] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 447.239169][ T155] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.445560][ T155] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.669689][ T155] bond0 (unregistering): Released all slaves [ 449.118434][ T5600] Bluetooth: hci3: command 0x1003 tx timeout [ 449.122880][ T4898] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 449.534762][ T8604] netlink: 'syz.3.566': attribute type 2 has an invalid length. [ 449.736368][ T155] hsr_slave_0: left promiscuous mode [ 449.939564][ T155] hsr_slave_1: left promiscuous mode [ 449.940967][ T155] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 450.080128][ T155] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 453.095569][ T155] team0 (unregistering): Port device team_slave_1 removed [ 453.203508][ T155] team0 (unregistering): Port device team_slave_0 removed [ 454.245628][ T8426] bridge0: port 1(bridge_slave_0) entered blocking state [ 454.245826][ T8426] bridge0: port 1(bridge_slave_0) entered disabled state [ 454.246010][ T8426] bridge_slave_0: entered allmulticast mode [ 454.293379][ T8426] bridge_slave_0: entered promiscuous mode [ 454.351070][ T8426] bridge0: port 2(bridge_slave_1) entered blocking state [ 454.351209][ T8426] bridge0: port 2(bridge_slave_1) entered disabled state [ 454.351404][ T8426] bridge_slave_1: entered allmulticast mode [ 454.380530][ T8426] bridge_slave_1: entered promiscuous mode [ 454.472836][ T8426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 454.598784][ T8426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 454.717871][ T8627] netlink: 32 bytes leftover after parsing attributes in process `syz.3.569'. [ 454.718065][ T8628] netlink: 8 bytes leftover after parsing attributes in process `syz.3.569'. [ 455.613051][ T8631] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 455.617210][ T8426] team0: Port device team_slave_0 added [ 455.683466][ T8426] team0: Port device team_slave_1 added [ 455.963757][ T155] bridge_slave_1: left allmulticast mode [ 455.963793][ T155] bridge_slave_1: left promiscuous mode [ 455.964054][ T155] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.109952][ T155] bridge_slave_0: left allmulticast mode [ 456.109975][ T155] bridge_slave_0: left promiscuous mode [ 456.110217][ T155] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.215060][ T8641] syz.1.572 (8641) used greatest stack depth: 18464 bytes left [ 458.767501][ T155] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 458.871007][ T155] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 458.921900][ T155] bond0 (unregistering): Released all slaves [ 459.478849][ T8426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 459.478866][ T8426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 459.478887][ T8426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 459.485330][ T8426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 459.485345][ T8426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 459.485370][ T8426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 459.642905][ T8215] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 459.753937][ T8215] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 459.782673][ T8586] syz.4.564 (8586): drop_caches: 1 [ 459.829577][ T8587] syz.4.564 (8587): drop_caches: 1 [ 459.858196][ T8215] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 459.927626][ T8215] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 459.994854][ T8215] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 460.061683][ T8215] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 460.067425][ T8426] hsr_slave_0: entered promiscuous mode [ 460.068189][ T8426] hsr_slave_1: entered promiscuous mode [ 460.073519][ T8426] debugfs: 'hsr0' already exists in 'hsr' [ 460.073544][ T8426] Cannot create hsr debugfs directory [ 460.337990][ T155] hsr_slave_0: left promiscuous mode [ 460.386922][ T155] hsr_slave_1: left promiscuous mode [ 460.394509][ T155] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.442226][ T155] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 462.321057][ T5600] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 462.382099][ T5600] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 462.404061][ T5600] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 462.414439][ T5600] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 462.461781][ T5600] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 462.541383][ T8662] netlink: 44 bytes leftover after parsing attributes in process `syz.3.579'. [ 464.729022][ T4898] Bluetooth: hci3: command tx timeout [ 465.175975][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 465.233976][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 465.234594][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 465.356483][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 466.788710][ T8674] netlink: 32 bytes leftover after parsing attributes in process `syz.3.580'. [ 466.802629][ T4898] Bluetooth: hci3: command tx timeout [ 466.860933][ T155] team0 (unregistering): Port device team_slave_1 removed [ 469.808449][ T4898] Bluetooth: hci3: command tx timeout [ 469.834342][ T155] team0 (unregistering): Port device team_slave_0 removed [ 471.506247][ T8215] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 471.589171][ T8215] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 471.847208][ T4898] Bluetooth: hci3: command tx timeout [ 479.796293][ T8730] netlink: 4 bytes leftover after parsing attributes in process `syz.3.592'. [ 480.644487][ T5600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 480.654425][ T5720] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 480.690770][ T5600] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 480.704032][ T5600] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 480.709967][ T5600] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 480.713771][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 480.847824][ T5720] usb 2-1: device descriptor read/64, error -71 [ 481.110071][ T5720] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 481.249435][ T5720] usb 2-1: device descriptor read/64, error -71 [ 481.368788][ T5720] usb usb2-port1: attempt power cycle [ 481.728476][ T5720] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 481.757374][ T5720] usb 2-1: device descriptor read/8, error -71 [ 481.804279][ T8752] ================================================================== [ 481.804299][ T8752] BUG: KASAN: slab-use-after-free in dvb_media_device_free+0x3a/0x510 [ 481.804333][ T8752] Read of size 8 at addr ffff88802c24fcf0 by task syz.3.598/8752 [ 481.804353][ T8752] [ 481.804374][ T8752] CPU: 0 UID: 0 PID: 8752 Comm: syz.3.598 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 481.804404][ T8752] Tainted: [L]=SOFTLOCKUP [ 481.804412][ T8752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 481.804432][ T8752] Call Trace: [ 481.804440][ T8752] [ 481.804449][ T8752] dump_stack_lvl+0xe8/0x150 [ 481.804480][ T8752] print_address_description+0x55/0x1e0 [ 481.804509][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.804527][ T8752] print_report+0x58/0x70 [ 481.804552][ T8752] kasan_report+0x117/0x150 [ 481.804583][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.804608][ T8752] dvb_media_device_free+0x3a/0x510 [ 481.804630][ T8752] dvb_remove_device+0x107/0x280 [ 481.804653][ T8752] dvb_unregister_frontend+0x79/0x130 [ 481.804686][ T8752] vidtv_bridge_remove+0x86/0x110 [ 481.804714][ T8752] ? __pfx_platform_remove+0x10/0x10 [ 481.804741][ T8752] device_release_driver_internal+0x48b/0x880 [ 481.804776][ T8752] unbind_store+0x1a4/0x1d0 [ 481.804803][ T8752] ? __pfx_sysfs_kf_write+0x10/0x10 [ 481.804824][ T8752] kernfs_fop_write_iter+0x3a5/0x540 [ 481.804856][ T8752] vfs_write+0x61e/0xbb0 [ 481.804883][ T8752] ? __pfx_vfs_write+0x10/0x10 [ 481.804907][ T8752] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 481.804932][ T8752] ? mutex_lock_nested+0x152/0x1d0 [ 481.804958][ T8752] ? fdget_pos+0x252/0x320 [ 481.804985][ T8752] ksys_write+0x156/0x270 [ 481.805009][ T8752] ? __pfx_ksys_write+0x10/0x10 [ 481.805038][ T8752] do_syscall_64+0x166/0x520 [ 481.805059][ T8752] ? trace_irq_disable+0x3b/0x140 [ 481.805081][ T8752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.805103][ T8752] ? clear_bhb_loop+0x70/0xc0 [ 481.805127][ T8752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.805153][ T8752] RIP: 0033:0x7f08fafde0d9 [ 481.805173][ T8752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.805191][ T8752] RSP: 002b:00007f08f9236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 481.805214][ T8752] RAX: ffffffffffffffda RBX: 00007f08fb265fa0 RCX: 00007f08fafde0d9 [ 481.805230][ T8752] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 0000000000000004 [ 481.805243][ T8752] RBP: 00007f08fb075024 R08: 0000000000000000 R09: 0000000000000000 [ 481.805257][ T8752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 481.805270][ T8752] R13: 00007f08fb266038 R14: 00007f08fb265fa0 R15: 00007fff4abc83f8 [ 481.805296][ T8752] [ 481.805304][ T8752] [ 481.805309][ T8752] Allocated by task 1: [ 481.805318][ T8752] kasan_save_track+0x3e/0x80 [ 481.805348][ T8752] __kasan_kmalloc+0x93/0xb0 [ 481.805369][ T8752] __kmalloc_cache_noprof+0x3da/0x6b0 [ 481.805387][ T8752] dvb_register_device+0x309/0x1dd0 [ 481.805406][ T8752] dvb_register_frontend+0x619/0x900 [ 481.805435][ T8752] vidtv_bridge_probe+0x9d5/0xf60 [ 481.805459][ T8752] platform_probe+0xf9/0x190 [ 481.805482][ T8752] really_probe+0x254/0xae0 [ 481.805510][ T8752] __driver_probe_device+0x1e8/0x360 [ 481.805537][ T8752] driver_probe_device+0x4f/0x240 [ 481.805565][ T8752] __driver_attach+0x339/0x600 [ 481.805598][ T8752] bus_for_each_dev+0x23e/0x2c0 [ 481.805616][ T8752] bus_add_driver+0x348/0x670 [ 481.805636][ T8752] driver_register+0x23a/0x320 [ 481.805652][ T8752] vidtv_bridge_init+0x3d/0x60 [ 481.805678][ T8752] do_one_initcall+0x250/0x870 [ 481.805706][ T8752] do_initcall_level+0x10a/0x1a0 [ 481.805732][ T8752] do_initcalls+0x59/0xa0 [ 481.805757][ T8752] kernel_init_freeable+0x29d/0x3e0 [ 481.805783][ T8752] kernel_init+0x22/0x1d0 [ 481.805807][ T8752] ret_from_fork+0x514/0xb70 [ 481.805834][ T8752] ret_from_fork_asm+0x1a/0x30 [ 481.805862][ T8752] [ 481.805867][ T8752] Freed by task 8752: [ 481.805876][ T8752] kasan_save_track+0x3e/0x80 [ 481.805905][ T8752] kasan_save_free_info+0x40/0x50 [ 481.805928][ T8752] __kasan_slab_free+0x5c/0x80 [ 481.805945][ T8752] kfree+0x1c5/0x6d0 [ 481.805970][ T8752] dvb_remove_device+0xce/0x280 [ 481.805987][ T8752] dvb_unregister_frontend+0x79/0x130 [ 481.806015][ T8752] vidtv_bridge_remove+0x86/0x110 [ 481.806038][ T8752] device_release_driver_internal+0x48b/0x880 [ 481.806067][ T8752] unbind_store+0x1a4/0x1d0 [ 481.806089][ T8752] kernfs_fop_write_iter+0x3a5/0x540 [ 481.806117][ T8752] vfs_write+0x61e/0xbb0 [ 481.806138][ T8752] ksys_write+0x156/0x270 [ 481.806158][ T8752] do_syscall_64+0x166/0x520 [ 481.806177][ T8752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.806196][ T8752] [ 481.806201][ T8752] The buggy address belongs to the object at ffff88802c24fc00 [ 481.806201][ T8752] which belongs to the cache kmalloc-512 of size 512 [ 481.806219][ T8752] The buggy address is located 240 bytes inside of [ 481.806219][ T8752] freed 512-byte region [ffff88802c24fc00, ffff88802c24fe00) [ 481.806240][ T8752] [ 481.806246][ T8752] The buggy address belongs to the physical page: [ 481.806263][ T8752] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c24c [ 481.806283][ T8752] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 481.806300][ T8752] flags: 0x80000000000040(head|node=0|zone=1) [ 481.806318][ T8752] page_type: f5(slab) [ 481.806337][ T8752] raw: 0080000000000040 ffff88813ffb5c80 dead000000000100 dead000000000122 [ 481.806355][ T8752] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 481.806375][ T8752] head: 0080000000000040 ffff88813ffb5c80 dead000000000100 dead000000000122 [ 481.806392][ T8752] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 481.806411][ T8752] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 481.806428][ T8752] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 481.806439][ T8752] page dumped because: kasan: bad access detected [ 481.806454][ T8752] page_owner tracks the page as allocated [ 481.806461][ T8752] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 15335420550, free_ts 0 [ 481.806497][ T8752] post_alloc_hook+0x1f9/0x250 [ 481.806525][ T8752] get_page_from_freelist+0x2630/0x26a0 [ 481.806546][ T8752] __alloc_frozen_pages_noprof+0x18d/0x380 [ 481.806567][ T8752] allocate_slab+0x79/0x5e0 [ 481.806598][ T8752] refill_objects+0x2d8/0x350 [ 481.806621][ T8752] __pcs_replace_empty_main+0x334/0x690 [ 481.806645][ T8752] __kmalloc_cache_noprof+0x470/0x6b0 [ 481.806663][ T8752] bus_add_driver+0x165/0x670 [ 481.806683][ T8752] driver_register+0x23a/0x320 [ 481.806700][ T8752] usb_register_driver+0x1e4/0x390 [ 481.806717][ T8752] do_one_initcall+0x250/0x870 [ 481.806743][ T8752] do_initcall_level+0x10a/0x1a0 [ 481.806768][ T8752] do_initcalls+0x59/0xa0 [ 481.806792][ T8752] kernel_init_freeable+0x29d/0x3e0 [ 481.806817][ T8752] kernel_init+0x22/0x1d0 [ 481.806840][ T8752] ret_from_fork+0x514/0xb70 [ 481.806859][ T8752] page_owner free stack trace missing [ 481.806864][ T8752] [ 481.806868][ T8752] Memory state around the buggy address: [ 481.806878][ T8752] ffff88802c24fb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 481.806891][ T8752] ffff88802c24fc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 481.806903][ T8752] >ffff88802c24fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 481.806915][ T8752] ^ [ 481.806928][ T8752] ffff88802c24fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 481.806941][ T8752] ffff88802c24fd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 481.806951][ T8752] ================================================================== [ 481.806992][ T8752] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 481.807010][ T8752] CPU: 0 UID: 0 PID: 8752 Comm: syz.3.598 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 481.807039][ T8752] Tainted: [L]=SOFTLOCKUP [ 481.807047][ T8752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 481.807059][ T8752] Call Trace: [ 481.807067][ T8752] [ 481.807076][ T8752] vpanic+0x56d/0xa60 [ 481.807108][ T8752] ? rcu_is_watching+0x16/0xb0 [ 481.807137][ T8752] ? __pfx_vpanic+0x10/0x10 [ 481.807172][ T8752] panic+0xc5/0xd0 [ 481.807195][ T8752] ? __pfx_panic+0x10/0x10 [ 481.807218][ T8752] ? preempt_schedule_thunk+0x16/0x40 [ 481.807242][ T8752] ? preempt_schedule_thunk+0x16/0x40 [ 481.807264][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.807285][ T8752] check_panic_on_warn+0x89/0xb0 [ 481.807316][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.807336][ T8752] end_report+0x73/0x170 [ 481.807358][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.807377][ T8752] kasan_report+0x128/0x150 [ 481.807398][ T8752] ? dvb_media_device_free+0x3a/0x510 [ 481.807421][ T8752] dvb_media_device_free+0x3a/0x510 [ 481.807443][ T8752] dvb_remove_device+0x107/0x280 [ 481.807463][ T8752] dvb_unregister_frontend+0x79/0x130 [ 481.807494][ T8752] vidtv_bridge_remove+0x86/0x110 [ 481.807523][ T8752] ? __pfx_platform_remove+0x10/0x10 [ 481.807551][ T8752] device_release_driver_internal+0x48b/0x880 [ 481.807591][ T8752] unbind_store+0x1a4/0x1d0 [ 481.807618][ T8752] ? __pfx_sysfs_kf_write+0x10/0x10 [ 481.807638][ T8752] kernfs_fop_write_iter+0x3a5/0x540 [ 481.807670][ T8752] vfs_write+0x61e/0xbb0 [ 481.807698][ T8752] ? __pfx_vfs_write+0x10/0x10 [ 481.807719][ T8752] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 481.807739][ T8752] ? mutex_lock_nested+0x152/0x1d0 [ 481.807764][ T8752] ? fdget_pos+0x252/0x320 [ 481.807789][ T8752] ksys_write+0x156/0x270 [ 481.807813][ T8752] ? __pfx_ksys_write+0x10/0x10 [ 481.807840][ T8752] do_syscall_64+0x166/0x520 [ 481.807860][ T8752] ? trace_irq_disable+0x3b/0x140 [ 481.807883][ T8752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.807904][ T8752] ? clear_bhb_loop+0x70/0xc0 [ 481.807927][ T8752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.807948][ T8752] RIP: 0033:0x7f08fafde0d9 [ 481.807967][ T8752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.807987][ T8752] RSP: 002b:00007f08f9236028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 481.808009][ T8752] RAX: ffffffffffffffda RBX: 00007f08fb265fa0 RCX: 00007f08fafde0d9 [ 481.808024][ T8752] RDX: 0000000000000007 RSI: 0000200000000300 RDI: 0000000000000004 [ 481.808036][ T8752] RBP: 00007f08fb075024 R08: 0000000000000000 R09: 0000000000000000 [ 481.808049][ T8752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 481.808061][ T8752] R13: 00007f08fb266038 R14: 00007f08fb265fa0 R15: 00007fff4abc83f8 [ 481.808085][ T8752] [ 481.809589][ T8752] Kernel Offset: disabled