last executing test programs: 6m42.686282473s ago: executing program 0 (id=849): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0xa8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x2, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x90, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x48, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x34, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x46}]}]}, @CTA_EXPECT_NAT={0x4}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40810}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000004, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x5, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0xfffffff7, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 6m41.422905227s ago: executing program 0 (id=858): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) lseek(r0, 0x0, 0x0) read(r0, &(0x7f0000000100), 0x14) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0xc138fd00, &(0x7f0000000200)) 6m41.15179529s ago: executing program 0 (id=860): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2d) 6m41.012593965s ago: executing program 0 (id=863): r0 = syz_clone(0x0, 0x0, 0x1d, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000040)='stat\x00') capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000180)={0x200002, 0x200003, 0xf461, 0x4, 0xd64}) pread64(r2, &(0x7f0000000140)=""/15, 0xf, 0x4) 6m40.543553297s ago: executing program 0 (id=868): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) lseek(r0, 0x0, 0x0) read(r0, &(0x7f0000000100), 0x14) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r1, 0xc138fd00, &(0x7f0000000200)) 6m40.294376148s ago: executing program 0 (id=870): mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000180), 0x3db66e6159adff3, 0x10100, 0x0) 6m24.987196306s ago: executing program 32 (id=870): mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000180), 0x3db66e6159adff3, 0x10100, 0x0) 5m13.107420709s ago: executing program 2 (id=1196): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu\x00', 0x275a, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000140)=0x1e) ioctl$KVM_RUN(r0, 0xae80, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x25}, 0x1, 0x6, 0x0, 0x100, 0x4, 0x540000, r2}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000180)=0x1, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000002c0)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x6, 0x0, 0x80, 0x4, 0x4000200}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r7, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @remote, 0x0, 0x6, 0x0, 0x100, 0x6, 0x4180107, r6}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f00000004c0)={@remote, @dev={0xfe, 0x80, '\x00', 0x2b}, @private1, 0x1, 0x6, 0x0, 0x100, 0x4, 0x86120186, r9}) 5m12.666831204s ago: executing program 2 (id=1200): close(0x3) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000280)={'a', ' *:* ', 'rm\x00'}, 0x9) 5m12.51139315s ago: executing program 2 (id=1201): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000140), 0x12) 5m12.420773223s ago: executing program 2 (id=1202): socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0xa, 0x1, 0x11, &(0x7f0000000100)) 5m12.104529841s ago: executing program 2 (id=1205): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f00000000c0)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'full', 0x20, 0x2000000007, 0x20, 0x10000000fffff}, 0x2f) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000005c0), 0x12) close(r1) 5m11.598075925s ago: executing program 2 (id=1208): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) close(0xffffffffffffffff) close(0x4) 4m56.292930939s ago: executing program 33 (id=1208): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) close(0xffffffffffffffff) close(0x4) 3m30.872048386s ago: executing program 3 (id=1823): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f00000000c0), 0x8, &(0x7f0000000080)={[{@index_off}]}) 3m30.715496406s ago: executing program 3 (id=1825): r0 = open(&(0x7f00000003c0)='./file0\x00', 0x48040, 0x0) finit_module(r0, 0x0, 0x2) 3m30.640395023s ago: executing program 3 (id=1827): r0 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x6, 0x8012, r0, 0x180000000) 3m30.495639187s ago: executing program 3 (id=1829): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000040)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f0000000300)='./file0/../file0\x00') 3m30.223500575s ago: executing program 3 (id=1833): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r0, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000002280)="ed", 0x1}], 0x5e}, 0x0) 3m27.639542971s ago: executing program 3 (id=1844): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000400000030000004c0001800d0001007564703a73797a3000000000380004"], 0x60}}, 0x0) 3m27.27699236s ago: executing program 34 (id=1844): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000400000030000004c0001800d0001007564703a73797a3000000000380004"], 0x60}}, 0x0) 2m36.636883566s ago: executing program 1 (id=2099): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f00000006c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000002c0)=0x1, 0x4) sendmmsg$inet(r0, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000002880)=[{&(0x7f00000027c0)="af", 0x1}], 0x1}}], 0x1, 0x2400cc40) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x3, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2ed, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10001, 0x3, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2m36.318612041s ago: executing program 1 (id=2102): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone(0x1022000, 0x0, 0xfffffffffffffc76, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) 2m35.883314686s ago: executing program 1 (id=2104): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0xe0f, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xb60d, 0x6, 0x5, 0x7, 0x4, 0xdb, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x6, 0x5, 0x0, 0xffffffff, 0xe661, 0x80, 0x7, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0x0, 0x4, 0x80008071, 0x800, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x6, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x0, 0x8, 0x8000, 0x1, 0x7], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x0, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x5, 0x7fff, 0x6, 0x500, 0x401, 0x6, 0x1, 0xff, 0x6, 0x2, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0xfffff256, 0x6, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000008, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x9, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x6, 0x1ef, 0x5, 0x0, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x5, 0xffffffff, 0x2, 0x400003, 0xfffffffd, 0x4, 0xf, 0x8, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x7, 0xb1, 0xaca, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x200807ff, 0x2006, 0x80a2ed, 0x1000004, 0x25], [0x5, 0xbb33, 0x7, 0x503d, 0x5, 0x4, 0x6, 0x6, 0x80000000, 0xb9, 0x1, 0x10001ff, 0x2, 0x4184, 0x5, 0x3, 0x2, 0x10000, 0x1, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x3, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x80000002, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 2m34.267251875s ago: executing program 1 (id=2107): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$igmp(0x2, 0x3, 0x2) socket$packet(0x11, 0x2, 0x300) socket$inet6(0xa, 0x3, 0x8000000003c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) 2m33.292830283s ago: executing program 1 (id=2111): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x20) recvmsg$kcm(r0, &(0x7f0000000900)={0x0, 0xffc3, 0x0}, 0x80) 2m31.415290058s ago: executing program 1 (id=2121): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000004080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001bc0)=""/207, 0xcf}], 0x1}}], 0x1, 0x400123a0, 0x0) sendmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000005340)=[{&(0x7f0000004200)="c4753f27ccee5fbd7d821a3993e7f698e66f48d0dc816d3e4e7ee71b1f818ed9b5759a3482041d249235bc96b754f335bfaf6555f5dbea59b4de6783b0a5a9ce81559f6c73a21c28d38cf78e959bdf4bcdfd01436ee9484ffadd02cf167705bb4eeac8f5703d5cc514bb27d25e76bbfb5b3fc51c34e205b71a80b7ea2409a12180196733d73e1cda8a3cdf40eac427e912c328652691b2db3e772f1926354e2d4d0f598ae95266e03814fff832f7922e54680cf9bc166c100de28a0bcf217bce62008e4f3f21b9a5516ea89122c87732", 0xd0}], 0x1}}], 0x1, 0x9200000000000000) 2m30.651802825s ago: executing program 35 (id=2121): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r0, &(0x7f0000004080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001bc0)=""/207, 0xcf}], 0x1}}], 0x1, 0x400123a0, 0x0) sendmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f0000005340)=[{&(0x7f0000004200)="c4753f27ccee5fbd7d821a3993e7f698e66f48d0dc816d3e4e7ee71b1f818ed9b5759a3482041d249235bc96b754f335bfaf6555f5dbea59b4de6783b0a5a9ce81559f6c73a21c28d38cf78e959bdf4bcdfd01436ee9484ffadd02cf167705bb4eeac8f5703d5cc514bb27d25e76bbfb5b3fc51c34e205b71a80b7ea2409a12180196733d73e1cda8a3cdf40eac427e912c328652691b2db3e772f1926354e2d4d0f598ae95266e03814fff832f7922e54680cf9bc166c100de28a0bcf217bce62008e4f3f21b9a5516ea89122c87732", 0xd0}], 0x1}}], 0x1, 0x9200000000000000) 5.399486086s ago: executing program 4 (id=3468): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000740)={0xa, 0x3, 0x4, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x9}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002700090027bd7000000000000e"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x10) setsockopt$inet6_buf(r0, 0x29, 0x32, &(0x7f0000000200)="3e3a821e7890a70745a5a1d111d69d0e9513cc66", 0x14) mkdir(&(0x7f0000000040)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x10002, 0x60) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0xee01, 0xee01}}, './mysys/bus/pci/drivers/xhci_hcd/new_id\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) mount$cgroup(0x0, &(0x7f00000000c0)='./mysys/bus/pci/drivers/xhci_hcd/new_id\x00', &(0x7f0000000140), 0xa04010, &(0x7f0000000400)={[{@cpuset_v2_mode}, {@name={'name', 0x3d, '-\xe6\\/^)[&{!$'}}, {@nofavordynmods}], [{@euid_eq={'euid', 0x3d, r4}}, {@context={'context', 0x3d, 'user_u'}}, {@uid_gt={'uid>', 0xee00}}, {@hash}, {@pcr={'pcr', 0x3d, 0x1a}}, {@obj_user={'obj_user', 0x3d, 'sysfs\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/dev/sg#\x00'}}, {@fowner_lt={'fowner<', r5}}, {@measure}]}) r6 = syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r6, 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000500000037"]) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2113fbd10002010300000000000000000700001088000a800c000140000000010800012e00000001740002800c00028005000100110000000c00028005000100010000000c00028005000100840000000c00028005000100110000002c00018014000300fe8000000000000000000000000000aa14000400fe800000000000000d8500000000000000bb0c00028005000100110000000600034000010000ec000a80300002802c0001801400030000000000000000000000ffffffffffff14000400fe80000000000000000000000000001e300002802c00018014000300fc02000000000000000000000000000014000400ff02000000000000000000000000000188000280cab3f27d99f79d8e36de77a4bcde8014000300fc02000000000000000000000000000114000400fe8000000000000000000000000000bb2c00018014000300fc00000000000000000000000000000014000400fc0200000000000000000000000000002c00018014000300fc020000000000000000000000000000140004002001000000b59273c8b6b1c33d8f9ce9143379594a842ffb82f9023176ce8be11136df3bf828b114f5502b135a23182a34760a10fc6565806ca8c980dcd92198ade21543a6b192d78a86f1217c5032"], 0x188}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r7 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$FIDEDUPERANGE(r8, 0xc0189436, &(0x7f0000000300)={0x8, 0x3}) sendto(r7, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = syz_open_dev$sg(&(0x7f00000006c0), 0x7000000, 0x6a000) ioctl$SG_BLKSECTGET(r10, 0x1267, &(0x7f0000000700)) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000c80)={{0x6000, 0x50000, 0x3, 0x80, 0xf, 0xff, 0x81, 0x0, 0x2, 0x8a, 0x0, 0x80}, {0x100000, 0x100000, 0x4, 0x5, 0xb5, 0x2, 0xe, 0x9, 0x81, 0x1, 0x2, 0x61}, {0xffffffff, 0x70000, 0xf, 0x7f, 0x10, 0x6f, 0x8, 0x0, 0x5, 0x3, 0x9, 0x4}, {0x6000, 0x70000, 0x9, 0x6a, 0xd, 0x2, 0x4, 0x0, 0xa, 0x9, 0x76, 0xe0}, {0xdddd1000, 0x41000, 0xb, 0x2, 0xc, 0x84, 0x3, 0x4, 0x5, 0x88, 0x1b, 0x69}, {0xffff1000, 0xdddd0000, 0x4, 0x4, 0x80, 0x4, 0xe, 0xe, 0x6, 0x3, 0x70, 0x9f}, {0x7000, 0xeeee8000, 0x6, 0x7, 0x5, 0x4, 0x7, 0x6, 0x8, 0x52, 0x9, 0x26}, {0xffff1000, 0xc000, 0xc, 0x30, 0xf6, 0xd0, 0x23, 0x9, 0x3, 0xb, 0x7, 0x2}, {0x2, 0x2}, {0x5000, 0x4}, 0xa, 0x0, 0x8, 0x20006, 0x5, 0x2000, 0x26000, [0xfffffffffffffffb, 0x1, 0x7, 0xc4c]}) recvmmsg(r7, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) r11 = openat(r2, &(0x7f00000001c0)='./mysys/bus/pci/drivers/xhci_hcd/new_id\x00', 0x1, 0x2) write(r11, &(0x7f0000000200)='1af4 1050 ffff ffff 0 0 0\n', 0x1a) 5.158025459s ago: executing program 7 (id=3471): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) recvfrom(r0, &(0x7f0000001380)=""/179, 0xb3, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{}, "afe5134c9da000", "adfbcc48c4e258530a0ce1603324e8a24a6e60592a7236a845e4fbe28b478f28", "b5c170ab", "336eeb66f3e85abe"}, 0x38) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, &(0x7f0000002580)=""/4046, 0xfce, 0x12, 0x0, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c80", 0x87}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda3", 0x2d}], 0x2) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$netlink(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)={0x3c, r2, 0x1, 0x70bd2b, 0x25dfdbfc, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8010}, 0x4) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x810}, 0x40404) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) 5.1040989s ago: executing program 4 (id=3472): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x88}, 0x80) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 4.279488272s ago: executing program 5 (id=3477): r0 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x28800) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f00000007c0)=0x42000401, 0x4) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x4e22, @empty}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) r4 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000001c0), 0x40, 0x0) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r4, 0xc01064c7, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0]}) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x980000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90b, 0x9, '\x00', @p_u16=&(0x7f0000000040)}}) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000001a0001002abd7000000000000a"], 0x78}], 0x1, 0x0, 0x0, 0x24400}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) socket(0x2a, 0x5, 0x1) ioctl$AUTOFS_IOC_SETTIMEOUT(r6, 0x80049367, &(0x7f0000000280)) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000140081044e81f782db44b9040218080207000000040000a118000200e000000100000e1208000f0100810401a80016ea1f000840032e5f54c92011148ed08734843c8802033d0803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 4.077790176s ago: executing program 5 (id=3478): semop(0x0, &(0x7f0000000200)=[{0x0, 0xffff, 0x1000}], 0x1f4) 4.06922519s ago: executing program 4 (id=3479): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, 0x0, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x80}, 0x80) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 3.954833787s ago: executing program 7 (id=3480): semop(0x0, &(0x7f0000000200)=[{0x0, 0xffff, 0x1000}], 0x1f4) (fail_nth: 1) 3.662388171s ago: executing program 5 (id=3482): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) recvfrom(r0, &(0x7f0000001380)=""/179, 0xb3, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d382e23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c80", 0x87}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dd", 0x2c}], 0x2) setsockopt$sock_int(r0, 0x1, 0x7, 0x0, 0x0) 3.575774245s ago: executing program 7 (id=3484): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x7, 0x7f, 0xa9, 0x4d, 0x3, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0x6, 0x0, 0x7, 0x3c5b, 0x1, 0x20, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x6, 0x7, 0x5, 0x8, 0x4c74, 0xffff7fff, 0x7, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0xffffffff, 0x7, 0x5, 0x80003e, 0x18e, 0x6, 0x6, 0x0, 0x8, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x8, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x1007, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x40, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x200009, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x6, 0x408, 0x3ff, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3000515, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6cff, 0x6, 0x38, 0x200, 0x1fd, 0x80, 0x7, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0xcc, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xffffffff, 0x5, 0x1c, 0x120000, 0x7ef, 0x2006, 0x80a2ed, 0x4, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce4, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x2, 0x10000, 0x4, 0x7fff, 0xfffc, 0xa620, 0x1, 0x5, 0x801, 0x2000002, 0x150, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0x10001, 0x3, 0x7e, 0x9, 0x9622, 0x7, 0xaf, 0x20000008, 0x5, 0x226, 0x2, 0x5, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0xe1c4, 0x0, 0x4, 0x5, 0x7ff, 0xd7, 0x200, 0xb, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 3.357095644s ago: executing program 7 (id=3486): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(0x3) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) recvmmsg$unix(r0, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012140, 0x0) 3.1782278s ago: executing program 7 (id=3488): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, 0x0, 0x0) add_key(&(0x7f0000000040)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000f3c7c820da059a0095620102030109023400010000000009049200030f6276000905000000000000000705e37e1b82e60905f2020000060000090501"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000e0)='./sec/tomoyo/profile\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)="3cb89a1d1846c611ac64297361626c65640a", 0x12) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = epoll_create1(0x0) epoll_pwait2(r3, &(0x7f0000000340)=[{}], 0x1, &(0x7f0000000580), &(0x7f0000000680)={[0x2]}, 0x8) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000c80)="0b0ec2a1e3fc84788972f461fec29e0fe5be85ea822a7348bd54a57f68a85a2284ad43c367bae5f7bd6c1e1d9017109e232e5bb561d280b32fa2b07a0cd31f1b8b9acdc89d4d5725350a9ec9303e53def89bcb6bb6ea83324927b43749f25be60c4f8707382b8e3062032c28dcccb784fdcfe6f2febd55e05bf1ccb63237c1d1bea4db828a5be79e518cf55a88e130609528b8aff64359e76eee93584aad3f751172c449fb", 0xa5}, {&(0x7f0000000680)="5f62f632763c84825847145170282f67ba6d5dadf0baf135d503e93a17ee560409202f4c5f0de32b0e53e4d26d04c825d923318fd574b1924b09ebb91d5be30b532a2fb95030c6be2a14ccfbce6eef05ea88d2413dc3fc0ae8a2e071f8764a4843611ae28b340100ddefa8ffed32420677397aa63e880adc56d03d8799429f33741886bd6c4065bba5005d74f67508dc3434165b51bf8f73bf1a7c158d8905e518e8", 0xa2}, {&(0x7f0000000740)="dfd1db04f5eef4b5714a69f5392e27d1b79a961a16fbdc4f01a9e38a1f95f939a209f049ad8d4f9447506fd73cec26b8246758f684013c99b717e119d15432e9d46da8a0c25e7e3771b0b146e56d2fcf8107332acc1c56948171260ed44c97919f70210c914c1098c9ac622d46f0ffae373480c9d8e590395ea4365569b8ea75ea1a9a181cfa88541804ec97980211c9b7eb2235d6f0b644fd31dda9bc2cc99434e0df4934d0", 0xa6}, {&(0x7f0000000c40)="a405df87c6e89abd7ae7e6b8550f9923917c9d38e14a4e9ace3100b34d0056282b7ed43e9c", 0x25}, {&(0x7f0000000800)="f76c72c4066a174e1300da0da7d191a618fc5793ff23c6328c6d61df0a2fb72441d4ded25cf7b5f31eb5d65e412665a6177f09ca3ac5cfd751577dec547711dc43b694a601fcb6575547046ec2a01c32b65d3429fbb9623a83d457d3ddea9eb90ab14b6b323a9358af0b55cff95844d5b47f6994a72f984e19e961cc00f6e364e141c8", 0x83}, {&(0x7f00000008c0)="4b000ffd096c1b77cd99b1458609c4b82100375ca9411e734cc8e9627df29e9b97a002d7f15ea9f42bd71401384ed6b5772b5c618c35c4aab72b1d515ceada9e64d7a35fd435e98f06243fcd53966c196ff3f47537912a1a5dec7e8e1fbf4543d1a6c80467d6ba3d241e3fd22efa09c638c98b4ce9fbe6d2053fcfa334eaee64efad2d349f048afb2635ae06c05697746fe073ed230c9c7c4643396305424c1c7eaa3ee09891995a607de26be9abcd2b65a4f9093da8a07eea61b1ff21ea3b323b191f95b997cfdface3dc21a664e38896f9f689bc06f4800d5c977102358770b0d8425f098be9383b5e487e7165e847191d5e95233e971edd", 0xf9}, {&(0x7f0000002380)="a66554178426362975b882a7d6b43fe537b6b0036a966a05363793ec2f6830cc5b81e514b9cbe4c27c3f3a581556b832100a4233e3e80fda14dd84611893300a863a8a6f6d8e0c7633e168ad7e25d4bd14ba6812101488e9444165b8100d576a996fec019ae11a03498329bcbacd0e8a206bd0de0c7e09f64a57d56974599f09aa148b4224dcffe1b5a1e55bbc1fdae8bf2f72437cf399c4cda11554b21158e3ddb00ddb71a1bd1daa50d631b027238397d692214223af1d685e7a3318da65c9233eba674ff72097411ef3ee19b892b1b36eeb925a6698f4d455b02163a3504ee6accffad7aaf9d19763d886272559ef0501594ea23d45a43e13bba05d7d332750ce5d9d3b37d234f46464fcc5f495e0fae02a24efd67db315c92f9483196bd38b38b3675bc0de5873f9d7b01ee5c564f5573b474e3c9f3b955929d9112007049e4245d68b93f365a90d35c837cc13999f2d6a23be87786e4234d74b1160669c7962b3b413201192565fb93252c153dd735e280e01d13dc34468f67684a4308c7dbe07687e0f56fa54f44b0141895ad75781ca026d813e8c17794b9d87d97136d29aced71b1f526dfab6301b78f1deab7949c97cce6616f4afd46a331e2fb54342dd1964c70a2717f4239c9e5157ac93c42d05f230da440a9227f0f82ee95cc79ca2d3da3f889b37f85f50d75711a910a57d213edb4b981cde33e01ec960885f31511ed7f8e01ddd36d76e1b1e40e81cd21ef9c34134400fdd94e34e5d77f4b7ca3612663e0f6b364be4a9dc775f3b12386ec04960524a9a5e6879e50db657c89a7dc7ec1f919ba8c77e926538599e7969868a5ef3e92817a3402c13de0efcb9fef445ee49f4b0ed26c5dbadff51459d5229661e4b7d2548c9ea4ce89b828daf5f5873e1d9e693ba037fc00ccc3dd74096c0f1ea508ee96ad7d85664947193e011e2f037917af7716d7f27cac25c9785f13baddfeba40997af5f6f4029cf5b781b654a635ee8696078d99025012cbad5af13bc26e2d100726fc98c11f8f16057a8506f29cf30bcf9ab7883ad1708d11bf70ee54fced84c69d90eb302e8aff586c0b25893e09868426cb4649145ede32035c47360fba7fe863cb00b86f583090c5b8d8549ba62cb822ed182fc07f029a826b5c86dccd603408bfc060c80c8ae21be086998f45923e1fe36eea10a66a55cc9f3cb6a296535dabc831fefe26b80ee47c723c596c51e1d7c073df20874eef79a291934c4c6a7c6b656595fc76b25d0d50590c1df29d59842a19a6acd60e783069aa0c21d792129132d59d12cd4417583dc967d7d44f392770da18e30a70a330e7b05aebf09e93aa545ca382a29f810e8a4efc0fffd3660f76892c2027daccfd743734c359bacaec86e4f15ca31b83894b67b3a3539cb5567bbcacd9a52c9b8d87252ddab0dbdd373f7150b87893fa4b6c5e6016f2146471f092a2cf4c75b6ed08a2f27f9f68d1817d7e782c0fa3026fd4e283b6b23bff2a9d84f5cdea217ce396080b623fe6d5da91fcab0e563b8c54af99007f6680efc9fdcd35d1d2ad8539ee04744e38c750114de55b80192c5d6aee8cbc34a47426bb22a9e3e2fcb87530c418a65fad7d5fbb15f569a69fc2cb92dad8f574330fdf2aa6033d1be037d5e3e964ff01329c43401bc86a72025288100ce86c053b922e9a7a692912bca4dabfc0e3a8966a65c96d3a420809c2d600928546a4ea26ff7100081f3ca8a70c64b3a4fc33b3e2546ff4a43502d448f2c0b274a244d32c955b02d897b1c53a2724ff886a1ccc91ea3a22dbd1f5f3f2e33db9ac9aae458a27e2a529ac2d8671f0e30df63a5d1a579b8f5a68f4a53fb4f3f76d41bee8e10635606f2a7fde9af7bd0df3ab9750b0c6c962fbc36e9474e3efac01ea98a4fe6e0f819d62dcde2b9b77fb0d430495ee042d1e70a52debb0d13b09906f77327dd4ccfe2b6796f9aa5e5b2fa9b2249c66b49cd7e1cbdb194c239d7e2e0928a45c8c55904cd345c5d8b92a5526ff51b5c2e477089eeb16cb3996c243c66a82f4349370ac26bef5d900ec582f274cc38b0258993de6cc79574fdacb895721fd4d04f84c4d89e109629f48a24fb3241882f154a35ae6659e0bb35af409c51cb11a26413be88a1e5ae1e8d2b1333a6c80c42c654f269dd875aa7f19517f62b8e031f11bdb11bafcf4b4f06496142579f7769ee41dd24701cd3ed016030f7d5cf24a4cfdcd9b05e38524cd1a81e16b948672329bd111f7442bdc81b68b36495b5f4aa44d7c2fdea8703849a17f7d3327086355ca3b36c10eb38556bf95b3575ba32b97f268af1f1347ed28368828124361f6c1e6b64e6ba9efc3094d50bb049c35db5ea2b3c76576b1a8f37da0711436048ae443523032497e542c04458f04cfffd11c53c431065c20e8add72c0c31caeec12d0bf391fa1c0a75e23d39c31da409083f768f545090b05c54084ffc5d7fd85cea725807638f4ab0026204452a8c198cc60133ce00e9a2b9ebeb30d7f33a1bb25cb2948bf44288cce43b6ac13012d8860fce83d9a0f6f1886723f41130466186ac56d5384bfd04fe87c67528996c1ee1ad8e551dda563e75d5dc8ac6a47990a62c915dc23f4ae6596dcfdb44661de969aec7f6d3fa8f05e106a8db7abeb3682bdc8e87aefbb09e642b2cef2919ddc55ded8dbce0606d3c4a0747a293a991b8cd832381c30813b887a22c2df569c12c430cf7471578eb787acab65b54569bece6921805af9ac41b268ce329a25bacdb02f8f3c4ef930f1799ff940f42c21955ddd5496234d62447d1c9d8e0cc7bb8fd5ca5e9fa2ef99105a4d44d6ce37532407fcccc4e71103baa0c7ff1767e05762424d9301294daa95523792cb73b348c41ec713d19c2b917a4dc50be3f0742762e5055cd6ebb3afa2b89a94c6a921e039ddaee98fc7a961a5e415322bd4b333d83768ee8945f29556f94372a16285cb1ff103640d93b837861f1d0d9e65fe35583b6f76889e7d09a2cdf3c2ef305a0f6d205deedee94ac602974fa58284e33aee55947a7a042abf0759ec8c1410493114454320b5003f23dac1c600a471ff09bdbf5bb40be87a69d388592241d9989f0435eeede193e6994b80a2145eca4afb5e691341e37e4580b0c54d7fc506cc9641020cd342a85fe56946e49854756ae6534edd03de881481e11701851f0f30fedbfcf335c3855c8d9541ef234f8718fbb0d9f127093a3e7c1d49d8a20729ab41a0118683b7044ee490d7137bebbbbfb245d5e30356e102eda0052a37cca70c221475b5c596f68c745701dc6e31f7846270bcd516ded5d0b4666b249a32f0acb1b8a7de8e6f007ee740561f64b7f30b4764ec5116a1eda1526225ddd01b1d999ff17d0798be47e3a5957011aa6e03318897ce1c452b78f9badf89098fe696894953581b01ceffc4fa0eefd654df9ea70b1f2f1e287192a5a20a381e8fad0fb99814208970902fdd28cf6a6457d7873a76359e226e5b203bd6f85bea30cb0ab5817e1b32fbbbd33a4e67f3771b7256a3a9ec20dae8a248af32a909bb5ec28f0f85722b81151f0f0a500a5c39c36476ac42c30bcb68a61a13141541ec54d895f0d7ca1afb728202e77f2f85170a3c2de378f1cfa0c2d1b0353f5d2fd0537017dc5510232a7a27a444476bbca2b84394639cf8ded35568868f9dcfa445b33c694aa8696d899afdf0d98a542e6a3c0212480ef3063ae0b8bcaa133978e9ebd76a3ccf652b0022b3cc7f1c9f2731c1c08f45fc84f7dade8471f6855e3005d75390e36a6646b8ac0dd5da9f9ef4bc35639ac96280bc47a547c0941af4516278b66469c7fc22932cbb2ac92cc12745bdf4ab4411d48396120f0e397ff6c22c54873296a897928d0158a5e63e6d48016cb4af44a3d71296acffe59241a8537f8b2cbc88b8ee2f4090e8e16b8af4700a60d0c199cc45cedf8dfe9a78ddd8637f7a9cfc16b078b1f9acfb8cb35f94b7564b1e23904e40dd5bdef1c78397457c05dd1108c3257bfda2e36b31969e8642c825c9dafe2fa4ee2708023c26255e6c41c2c873923e98eb1397dbc51324dfbec7943a5564fa815b9492d53c6cf6d42cd07165ae54e81f7989f2e406a13bea4df4d4a6971d81a4492e5703b6ba1f21ca5ffd68cdb15a713abd70d411e64d873b9f36ced7f354273c5c9782dd8a410ac28fee250f4b82095f4ab7a5c5a7d57114b6196cc2accdb44e39351a5d7c2c519ff861db8e4a368fdc1c5459f2b4cef0076d9b57b9ba2e76b3d8b87a515fc5c777d7e8023ef898fcf31365abc3e0a1307fa85f29d3c8a7e70d58b1228e8376c212ffb76f895aadedcf3f70bddcc347473dba5602d7734c4e9a2054cd3763acbb7fe82155d4a50e6a72d917b22b16ea8abd987834b4b1b04556e5442b1b643fa842a08ab5d860715b250447170c8d30829730a53974b6554a6454bab2eeda2966cc13a02a2b2c2e157ccd1795bcbc9c7bec370d9f492745b7c03c5ba21a45ff6bbba064ec83ec2ea5", 0xc72}], 0x7}}], 0x1, 0x8800) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r4, &(0x7f0000000000)={0x3a, 'syz1', 0x3a, 'E', 0x3a, 0x100, 0x3a, '%!{!&)[\\', 0x3a, '\xde', 0x3a, './file0', 0x3a, [0x50]}, 0x31) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0xc80, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) r5 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r5, 0x5) r6 = syz_clone(0x100000, &(0x7f0000001880), 0x0, 0x0, 0x0, 0x0) sched_setaffinity(r6, 0x0, 0x0) sendmsg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000100000000010010000010000001200000000000000102000ad6fdb58984df3e57131b0c64f2801a2ff97269ed2ef7063736d30be588c0ab15e5f91fd5a65ec0729af3d95b295d594366b384b3e6f67b869c919"], 0x28}, 0x0) sendmsg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="18560000e2ffffff1301000001000000120000000000000014d8d14d65e209b9e89dd0562a8b8e1efb935c2fc8cbc54ee2a1db5b75da8c79ed99236d3d96afaf13b3d56dd3b884a7ed1cdb79f506f13f6a290744b956de4fb4bf19b22abc64a6394db4acb91422f841306dfbe7d68bbed1fb3650c4c52920137fbf1635f36dd0f258394c6dac22efa163fbf416fe75a08b1de2e117c19dfdac2fe6746e6623fd1d7688a8d309ee8bbac0d51a8be459c875225f9e2046c742ba45faaff3bed494dcc0d83ecabb71be"], 0x18}, 0x0) 3.060220238s ago: executing program 4 (id=3489): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000010c0)=ANY=[@ANYBLOB="12010000190000404f045db600000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io(r0, &(0x7f0000000200)={0x2c, &(0x7f0000000040)={0x0, 0x1f, 0x21, {0x21, 0xd, "3fc1ec1735ccab0f78429d70cb0c592b6bf0a10477d230bb79fef474efca76"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x443}}, &(0x7f0000000100)={0x0, 0xf, 0x55, {0x5, 0xf, 0x55, 0x4, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x3, 0x0, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "c18d1463672c0faff516f0e2851c11cf"}, @generic={0x32, 0x10, 0x2, "e8366b0a89083aa2a4605985101c88695578c0b21ca64f74e2de1e13194f5080d7c9921089d8fa84d863e7dfaebe30"}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xff, 0x1, 0xe8, 0x8, "a1287564", "b474b298"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x2, 0x4, 0x3, 0xa8, 0x100, 0x8}}}, &(0x7f0000000640)={0x84, &(0x7f0000000240)={0x0, 0x10, 0x1d, "5ce8de8a5272686f91bc7aa649d4bd489d7be5ab55f8ccb84959417330"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xd5}, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x2, 0x1}}, &(0x7f0000000340)={0x20, 0x0, 0x8, {0x120, 0x4, [0x0]}}, &(0x7f0000000380)={0x40, 0x7, 0x2, 0x6}, &(0x7f00000003c0)={0x40, 0x9, 0x1, 0x16}, &(0x7f0000000400)={0x40, 0xb, 0x2, "1926"}, &(0x7f0000000440)={0x40, 0xf, 0x2}, &(0x7f0000000480)={0x40, 0x13, 0x6, @link_local}, &(0x7f00000004c0)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}}, &(0x7f0000000500)={0x40, 0x19, 0x2, 'T3'}, &(0x7f0000000540)={0x40, 0x1a, 0x2, 0xff81}, &(0x7f0000000580)={0x40, 0x1c, 0x1, 0x1}, &(0x7f00000005c0)={0x40, 0x1e, 0x1, 0x20}, &(0x7f0000000600)={0x40, 0x21, 0x1, 0x2}}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\"\a'], 0x0}, 0x0) 2.679539369s ago: executing program 5 (id=3490): r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20, 0x1) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500), 0x800, &(0x7f0000000b40)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@access_client}, {@noextend}], [{@permit_directio}]}}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000340)={0x60, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_FRAME={0x44, 0x33, @action={{{}, {}, @device_b, @device_a, @initial, {0x0, 0xffc}}, @mesh_hwmp_psel={0xd, 0x1, {@val={0x82, 0x20, {{0x1, 0x1, 0x1, 0x0, 0x1}, 0x0, 0x2, 0x62, @device_b, 0x5, @value=@device_b, 0xffffffff, 0xfffff800}}, @void, @val={0x84, 0x2, {0x2}}, @void}}}}]}, 0x60}, 0x1, 0x0, 0x0, 0x2800}, 0x10) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect(r7, &(0x7f0000000040)=@llc={0x1a, 0x313, 0xc, 0x6, 0x6, 0x7, @broadcast}, 0x80) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TLS_RX(r8, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x304}, "966908f4f23bc0fb", "ab1fcad69c0c09d8d1fb9e4a474dbe8fafed7ae67cc834544b9e700888781507", "1d403e37", "d4dfa2f518dbd58e"}, 0x38) 1.76347159s ago: executing program 6 (id=3492): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r0, 0x5) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}], 0x18}, 0x0) 1.550742277s ago: executing program 6 (id=3493): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01030000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000000028000480080002404c13000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c0002400000000000000001090001"], 0xfc}}, 0x0) 1.190866513s ago: executing program 5 (id=3494): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000"}], 0x18}, 0x0) recvfrom(r0, &(0x7f0000000300)=""/256, 0x100, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) read(r2, &(0x7f0000000700), 0x20) write(r3, 0x0, 0x0) read(r2, &(0x7f0000000310), 0x6) sendto$inet(r0, &(0x7f0000000300), 0x22, 0x0, &(0x7f0000000080)={0x2, 0x1234, @loopback}, 0x10) recvmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/256, 0x100}], 0x1}, 0x0) 875.418252ms ago: executing program 4 (id=3495): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}], 0x30}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 840.202171ms ago: executing program 6 (id=3496): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)}], 0x1}, 0x48043) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 641.462769ms ago: executing program 4 (id=3497): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r0, &(0x7f00000025c0)={0xfc, {"a2e3ad1bed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f3b356d030890e0879b0af8c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb62913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab002f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="1201000000000040d90455a000000000000109022400010000100009040000c403000200092100105c0122070009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00228e010000"], 0x0}, 0x0) 563.933439ms ago: executing program 6 (id=3498): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r0, 0x5) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) 463.028418ms ago: executing program 7 (id=3499): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x2d, 0x2, 0x0) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xccd, 0xb1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0xff, 0x0, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x7, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x6, 0x6, 0xd8, {0x7, 0x25, 0x1, 0x18, 0xe9, 0x7fff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x4, 0x0, 0x7, {0x7, 0x25, 0x1, 0xc, 0x7, 0x800}}}}}}}}]}}, &(0x7f0000002f40)={0x0, 0x0, 0x0, 0x0}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x801}, 0x4004000) bind$xdp(r1, &(0x7f0000000000)={0x2d, 0x0, 0x0, 0x3c, r1}, 0x10) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="5800000002060102000034e40000000004000008050005000a000000050001000600000005000400000000000900020073797a310000000011000300686173683a69702c706f727400001f000c0007"], 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 451.776153ms ago: executing program 6 (id=3500): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000", 0x11, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000540)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x4c, 0xa, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x20, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PROTO={0x5, 0x7, 0x5c}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_BYTES={0xc}}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x840}, 0x20000080) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x8}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 217.338963ms ago: executing program 6 (id=3501): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, 0x1c, {[@window={0xa, 0x3}, @timestamp={0x5, 0xa}, @generic={0x0, 0x7, "d58838068b"}]}}}}}}, 0x4a) 0s ago: executing program 5 (id=3502): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) writev(r1, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000300), 0x40000000000049e, 0x1000000000fe, 0x0) kernel console output (not intermixed with test programs): 148.502760][ T6600] tun0: tun_chr_ioctl cmd 1074025675 [ 148.502776][ T6600] tun0: persist disabled [ 150.032578][ T6632] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 151.613728][ T6680] netlink: 24 bytes leftover after parsing attributes in process `syz.0.363'. [ 153.060429][ T6705] netlink: 24 bytes leftover after parsing attributes in process `syz.3.373'. [ 154.108714][ T6735] netlink: 24 bytes leftover after parsing attributes in process `syz.2.385'. [ 154.502238][ T6747] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 154.766389][ T6755] netlink: 24 bytes leftover after parsing attributes in process `syz.0.396'. [ 159.115391][ T6871] netlink: 24 bytes leftover after parsing attributes in process `syz.2.441'. [ 159.890213][ T6899] netlink: 24 bytes leftover after parsing attributes in process `syz.1.453'. [ 161.128861][ T6912] syz.3.457 (6912) used greatest stack depth: 16848 bytes left [ 161.571888][ T6932] netlink: 24 bytes leftover after parsing attributes in process `syz.0.465'. [ 162.649153][ T6948] 9p: Bad value for 'rfdno' [ 163.511470][ T6961] netlink: 24 bytes leftover after parsing attributes in process `syz.3.476'. [ 163.825446][ T6969] 9p: Bad value for 'rfdno' [ 164.607697][ T6988] netlink: 24 bytes leftover after parsing attributes in process `syz.1.488'. [ 164.876397][ T6994] 9pnet_fd: Insufficient options for proto=fd [ 164.877827][ T6994] sctp: [Deprecated]: syz.0.490 (pid 6994) Use of int in maxseg socket option. [ 164.877827][ T6994] Use struct sctp_assoc_value instead [ 165.079499][ T6998] 9p: Bad value for 'rfdno' [ 165.803822][ T7024] binfmt_misc: register: failed to install interpreter file ./file0 [ 166.009305][ T7030] 9p: Bad value for 'rfdno' [ 170.923860][ T7175] capability: warning: `syz.2.568' uses deprecated v2 capabilities in a way that may be insecure [ 171.957087][ T7201] fuse: Bad value for 'fd' [ 172.958896][ T7225] fuse: Bad value for 'fd' [ 174.071942][ T7231] syz.2.591 (7231) used greatest stack depth: 16648 bytes left [ 174.934117][ T7254] fuse: Bad value for 'fd' [ 179.127183][ T7320] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(0) [ 184.018777][ T7410] dyndbg: expected <4096 bytes into control [ 184.629663][ T7425] fuse: Bad value for 'fd' [ 184.630511][ T7426] fuse: Bad value for 'fd' [ 185.494105][ T7451] fuse: Bad value for 'fd' [ 185.579366][ T7455] fuse: Bad value for 'fd' [ 186.249083][ T7474] fuse: Bad value for 'fd' [ 188.935119][ T7491] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 191.906630][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 192.085643][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 192.087834][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 16 [ 192.119730][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=000c, bcdDevice= 0.40 [ 192.119763][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 192.119784][ T10] usb 2-1: Product: syz [ 192.119799][ T10] usb 2-1: Manufacturer: syz [ 192.119814][ T10] usb 2-1: SerialNumber: syz [ 192.171290][ T7535] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 192.633337][ T7535] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 192.919168][ T10] usb 2-1: USB disconnect, device number 2 [ 194.273661][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.273768][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.498776][ T7587] netlink: 24 bytes leftover after parsing attributes in process `syz.3.731'. [ 203.267632][ T7779] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 204.627578][ T7804] tipc: Started in network mode [ 204.627606][ T7804] tipc: Node identity -, cluster identity 4711 [ 206.069805][ T5696] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 206.229657][ T5696] usb 2-1: Using ep0 maxpacket: 32 [ 206.242713][ T5696] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 206.242795][ T5696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.242847][ T5696] usb 2-1: Product: syz [ 206.242887][ T5696] usb 2-1: Manufacturer: syz [ 206.242928][ T5696] usb 2-1: SerialNumber: syz [ 206.754370][ T5696] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 206.754455][ T5696] usb 2-1: MIDIStreaming interface descriptor not found [ 206.944457][ T5696] usb 2-1: USB disconnect, device number 3 [ 207.041105][ T5818] udevd[5818]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 207.611590][ T7860] netlink: 48 bytes leftover after parsing attributes in process `syz.1.833'. [ 207.910647][ T7871] overlayfs: missing 'lowerdir' [ 210.374077][ T5772] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 210.654137][ T5772] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 210.990768][ T7922] fido_id[7922]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 214.333750][ T7984] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(0) [ 215.715465][ T7995] kvm: pic: non byte read [ 215.721387][ T7995] kvm: pic: non byte read [ 215.721614][ T7995] kvm: pic: non byte read [ 215.721841][ T7995] kvm: pic: non byte read [ 215.722056][ T7995] kvm: pic: non byte read [ 215.722270][ T7995] kvm: pic: non byte read [ 215.722486][ T7995] kvm: pic: non byte read [ 215.737043][ T7995] kvm: pic: non byte read [ 215.737488][ T7995] kvm: pic: non byte read [ 215.737921][ T7995] kvm: pic: non byte read [ 221.450764][ T8075] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 222.036111][ T8055] Bluetooth: hci2: command 0x0406 tx timeout [ 222.065989][ T8054] Bluetooth: hci3: command 0x0406 tx timeout [ 222.231175][ T8054] Bluetooth: hci0: command 0x0406 tx timeout [ 222.414974][ T8076] Bluetooth: hci1: command 0x0406 tx timeout [ 228.302080][ T4905] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 228.355919][ T4905] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 228.386641][ T4905] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 228.404913][ T4905] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 228.420341][ T4905] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 230.513886][ T5606] Bluetooth: hci4: command tx timeout [ 231.321154][ T8160] picdev_read: 4 callbacks suppressed [ 231.321175][ T8160] kvm: pic: non byte read [ 231.321390][ T8160] kvm: pic: non byte read [ 231.321597][ T8160] kvm: pic: non byte read [ 231.321798][ T8160] kvm: pic: non byte read [ 231.322001][ T8160] kvm: pic: non byte read [ 231.322199][ T8160] kvm: pic: non byte read [ 231.372348][ T8160] kvm: pic: non byte read [ 231.372582][ T8160] kvm: pic: non byte read [ 231.372782][ T8160] kvm: pic: non byte read [ 231.372983][ T8160] kvm: pic: non byte read [ 232.590042][ T5606] Bluetooth: hci4: command tx timeout [ 233.951057][ T8175] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 234.670471][ T5606] Bluetooth: hci4: command tx timeout [ 234.928079][ T8192] kvm [8190]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010000) = 0x7 [ 235.351165][ T8199] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 236.760840][ T5606] Bluetooth: hci4: command tx timeout [ 236.883762][ T10] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 236.936493][ T10] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 237.171703][ T8129] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.173630][ T8129] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.173934][ T8129] bridge_slave_0: entered allmulticast mode [ 237.216005][ T8129] bridge_slave_0: entered promiscuous mode [ 237.258929][ T8129] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.273796][ T8129] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.274116][ T8129] bridge_slave_1: entered allmulticast mode [ 237.322407][ T8129] bridge_slave_1: entered promiscuous mode [ 239.134630][ T68] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.550996][ T8129] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 239.784543][ T68] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 239.968428][ T8129] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 240.536004][ T68] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 240.715440][ T8129] team0: Port device team_slave_0 added [ 240.735611][ T8241] input: syz0 as /devices/virtual/input/input5 [ 240.818933][ T8129] team0: Port device team_slave_1 added [ 240.916202][ T5691] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 241.081085][ T5691] usb 4-1: Using ep0 maxpacket: 16 [ 241.084440][ T5691] usb 4-1: unable to get BOS descriptor or descriptor too short [ 241.136375][ T5691] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 241.136408][ T5691] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.136428][ T5691] usb 4-1: Product: syz [ 241.136444][ T5691] usb 4-1: Manufacturer: syz [ 241.136458][ T5691] usb 4-1: SerialNumber: syz [ 241.552494][ T68] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 241.557011][ T5691] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 241.589017][ T5691] usb 4-1: 2:1 : no UAC_FORMAT_TYPE desc [ 242.854347][ T8129] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 242.854366][ T8129] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 242.854396][ T8129] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 242.977041][ T8129] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 242.977059][ T8129] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 242.977089][ T8129] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 243.192799][ T5691] usb 4-1: USB disconnect, device number 5 [ 243.617145][ T8129] hsr_slave_0: entered promiscuous mode [ 243.671360][ T8129] hsr_slave_1: entered promiscuous mode [ 243.677421][ T8129] debugfs: 'hsr0' already exists in 'hsr' [ 243.677448][ T8129] Cannot create hsr debugfs directory [ 244.251225][ T8278] bridge0: port 4(dummy0) entered blocking state [ 244.253826][ T8278] bridge0: port 4(dummy0) entered disabled state [ 244.287238][ T8278] dummy0: entered allmulticast mode [ 244.451250][ T8278] dummy0: entered promiscuous mode [ 244.566489][ T8278] bridge0: port 4(dummy0) entered blocking state [ 244.568770][ T8278] bridge0: port 4(dummy0) entered forwarding state [ 245.591138][ T68] bridge_slave_1: left allmulticast mode [ 245.591312][ T68] bridge_slave_1: left promiscuous mode [ 245.635420][ T68] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.961166][ T5772] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 246.016207][ T68] bridge_slave_0: left allmulticast mode [ 246.016240][ T68] bridge_slave_0: left promiscuous mode [ 246.016490][ T68] bridge0: port 1(bridge_slave_0) entered disabled state [ 246.129591][ T5772] usb 4-1: Using ep0 maxpacket: 32 [ 246.148369][ T5772] usb 4-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 246.148396][ T5772] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 246.148415][ T5772] usb 4-1: Product: syz [ 246.148429][ T5772] usb 4-1: Manufacturer: syz [ 246.148442][ T5772] usb 4-1: SerialNumber: syz [ 246.711820][ T5772] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 246.711868][ T5772] usb 4-1: MIDIStreaming interface descriptor not found [ 247.032918][ T5772] usb 4-1: USB disconnect, device number 6 [ 247.434890][ T5818] udevd[5818]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 247.449631][ T1010] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 247.647285][ T8317] overlayfs: overlapping lowerdir path [ 248.656172][ T1010] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 248.656222][ T1010] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 248.656245][ T1010] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 248.762589][ T1010] usb 3-1: config 0 descriptor?? [ 249.181416][ T68] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 249.259043][ T1010] keytouch 0003:0926:3333.0005: fixing up Keytouch IEC report descriptor [ 249.269676][ T68] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 249.308662][ T68] bond0 (unregistering): Released all slaves [ 249.685387][ T1010] input: HID 0926:3333 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0926:3333.0005/input/input6 [ 250.874841][ T1010] keytouch 0003:0926:3333.0005: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.2-1/input0 [ 251.106133][ T1010] usb 3-1: USB disconnect, device number 4 [ 251.318462][ T8347] fido_id[8347]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 252.207049][ T5747] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 253.375645][ T5747] hid-generic 0000:0000:0000.0006: hidraw1: HID v0.00 Device [syz1] on syz0 [ 253.663673][ T5251] 8021q: adding VLAN 0 to HW filter on device eth1 [ 255.713646][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.713757][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.324499][ T38] kauditd_printk_skb: 294 callbacks suppressed [ 256.324516][ T38] audit: type=1326 audit(1785218077.136:308): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8df667de99 code=0x7ffc0000 [ 256.326842][ T38] audit: type=1326 audit(1785218077.136:309): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8df667de99 code=0x7ffc0000 [ 256.401401][ T38] audit: type=1326 audit(1785218077.216:310): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8df663e6ce code=0x7ffc0000 [ 256.401455][ T38] audit: type=1326 audit(1785218077.216:311): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.401517][ T38] audit: type=1326 audit(1785218077.216:312): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.626069][ T38] audit: type=1326 audit(1785218077.436:313): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.631957][ T38] audit: type=1326 audit(1785218077.436:314): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.636439][ T38] audit: type=1326 audit(1785218077.446:315): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.696319][ T38] audit: type=1326 audit(1785218077.496:316): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.752632][ T1010] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 256.768313][ T38] audit: type=1326 audit(1785218077.576:317): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8400 comm="syz.2.1013" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f8df667db2b code=0x7ffc0000 [ 256.974521][ T1010] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 256.974549][ T1010] usb 3-1: config 0 has no interfaces? [ 256.998408][ T1010] usb 3-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 256.998438][ T1010] usb 3-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 256.998458][ T1010] usb 3-1: Product: syz [ 257.067387][ T1010] usb 3-1: config 0 descriptor?? [ 257.255779][ T5251] 8021q: adding VLAN 0 to HW filter on device eth2 [ 257.324102][ T10] usb 3-1: USB disconnect, device number 5 [ 257.579729][ T68] hsr_slave_0: left promiscuous mode [ 257.619681][ T68] hsr_slave_1: left promiscuous mode [ 257.622134][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 257.622227][ T68] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 257.662016][ T68] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 257.662037][ T68] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 257.669648][ T1010] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 257.819156][ T68] veth1_macvtap: left promiscuous mode [ 257.819366][ T68] veth0_macvtap: left promiscuous mode [ 257.820824][ T1010] usb 2-1: Using ep0 maxpacket: 16 [ 257.842726][ T1010] usb 2-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 257.842761][ T1010] usb 2-1: config 0 interface 0 has no altsetting 0 [ 257.842785][ T1010] usb 2-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 257.842801][ T1010] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 257.894866][ T68] veth1_vlan: left promiscuous mode [ 257.895647][ T68] veth0_vlan: left promiscuous mode [ 257.923265][ T1010] usb 2-1: config 0 descriptor?? [ 258.368775][ T1010] zydacron 0003:13EC:0006.0007: unbalanced collection at end of report description [ 258.369335][ T1010] zydacron 0003:13EC:0006.0007: parse failed [ 258.369408][ T1010] zydacron 0003:13EC:0006.0007: probe with driver zydacron failed with error -22 [ 258.577738][ T1010] usb 2-1: USB disconnect, device number 4 [ 258.781906][ T5772] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 258.803165][ T5772] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 259.560756][ T68] team0 (unregistering): Port device team_slave_1 removed [ 259.690373][ T68] team0 (unregistering): Port device team_slave_0 removed [ 260.881137][ T5696] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 260.917421][ T8129] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 261.092147][ T5696] usb 4-1: Using ep0 maxpacket: 16 [ 261.104480][ T5696] usb 4-1: unable to get BOS descriptor or descriptor too short [ 261.118363][ T5696] usb 4-1: config 3 has an invalid interface number: 165 but max is 1 [ 261.118387][ T5696] usb 4-1: config 3 has no interface number 0 [ 261.118427][ T5696] usb 4-1: config 3 interface 1 has no altsetting 0 [ 261.118446][ T5696] usb 4-1: config 3 interface 165 has no altsetting 0 [ 261.167851][ T5696] usb 4-1: New USB device found, idVendor=19d2, idProduct=0012, bcdDevice= 0.a9 [ 261.167881][ T5696] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.167902][ T5696] usb 4-1: Product: syz [ 261.167916][ T5696] usb 4-1: Manufacturer: syz [ 261.167931][ T5696] usb 4-1: SerialNumber: syz [ 261.252382][ T8129] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 262.220364][ T8129] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 262.273282][ T5696] rndis_host 4-1:3.165: rndis: master #0/0000000000000000 slave #1/ffff88803c1b1000 [ 262.298498][ T5696] usb 4-1: USB disconnect, device number 7 [ 262.466230][ T8129] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 262.472964][ T8129] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 262.541181][ T8129] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 262.544044][ T8129] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 262.652080][ T8478] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1035'. [ 262.705911][ T8129] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 263.096925][ T8494] zero sized request [ 263.186165][ T8499] random: crng reseeded on system resumption [ 263.448633][ T8129] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.696233][ T8129] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.743575][ T5251] 8021q: adding VLAN 0 to HW filter on device eth3 [ 263.864981][ T1027] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.896779][ T1027] bridge0: port 1(bridge_slave_0) entered forwarding state [ 264.016489][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.016627][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 266.983356][ T8557] random: crng reseeded on system resumption [ 267.001268][ T5251] 8021q: adding VLAN 0 to HW filter on device eth4 [ 267.209426][ T8129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 269.302279][ T8594] serio: Serial port ptm0 [ 269.416957][ T8129] veth0_vlan: entered promiscuous mode [ 269.541065][ T8129] veth1_vlan: entered promiscuous mode [ 269.746177][ T8604] size and base must be multiples of 4 kiB [ 269.746219][ T8604] CPU: 1 UID: 0 PID: 8604 Comm: syz.1.1062 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 269.746242][ T8604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 269.746263][ T8604] Call Trace: [ 269.746271][ T8604] [ 269.746279][ T8604] dump_stack_lvl+0xe8/0x150 [ 269.746310][ T8604] mtrr_add+0xd5/0x100 [ 269.746335][ T8604] mtrr_ioctl+0xca4/0x13c0 [ 269.746367][ T8604] ? __pfx_mtrr_ioctl+0x10/0x10 [ 269.746394][ T8602] MTRR 1 not used [ 269.746406][ T8604] ? __fget_files+0x2a/0x420 [ 269.746432][ T8604] ? __fget_files+0x3a8/0x420 [ 269.746453][ T8604] ? __fget_files+0x2a/0x420 [ 269.746472][ T8604] ? __pfx_mtrr_ioctl+0x10/0x10 [ 269.746502][ T8604] proc_reg_unlocked_ioctl+0x1df/0x2d0 [ 269.746523][ T8604] ? __pfx_proc_reg_unlocked_ioctl+0x10/0x10 [ 269.746542][ T8604] __se_sys_ioctl+0xff/0x170 [ 269.746565][ T8604] do_syscall_64+0x17b/0x530 [ 269.746580][ T8604] ? irqentry_exit+0x10f/0x8f0 [ 269.746593][ T8604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.746608][ T8604] ? clear_bhb_loop+0x40/0x90 [ 269.746626][ T8604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.746641][ T8604] RIP: 0033:0x7fc40d6ede99 [ 269.746658][ T8604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.746687][ T8604] RSP: 002b:00007fc40b946028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 269.746714][ T8604] RAX: ffffffffffffffda RBX: 00007fc40d975fa0 RCX: 00007fc40d6ede99 [ 269.746729][ T8604] RDX: 0000000000000000 RSI: 0000000040104d01 RDI: 0000000000000003 [ 269.746742][ T8604] RBP: 00007fc40d783eaf R08: 0000000000000000 R09: 0000000000000000 [ 269.746754][ T8604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 269.746766][ T8604] R13: 00007fc40d976038 R14: 00007fc40d975fa0 R15: 00007ffe02fd7948 [ 269.746800][ T8604] [ 269.803609][ T8129] veth0_macvtap: entered promiscuous mode [ 269.965929][ T8129] veth1_macvtap: entered promiscuous mode [ 270.084186][ T8129] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 270.136103][ T8129] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 270.216630][ T48] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.217492][ T48] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.217540][ T48] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.217580][ T48] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.338582][ T8612] overlayfs: missing 'lowerdir' [ 271.331210][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 271.331232][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 271.477716][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 271.477737][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 273.469671][ T10] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 273.624942][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 273.624977][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 273.625003][ T10] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 273.625019][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 273.718404][ T10] usb 2-1: config 0 descriptor?? [ 273.999703][ T5691] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 274.038386][ T8670] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=4015170203 (32121361624 ns) > initial count (30716351936 ns). Using initial count to start timer. [ 274.149924][ T5691] usb 5-1: Using ep0 maxpacket: 32 [ 274.153815][ T5691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.153844][ T5691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.153882][ T5691] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 274.153905][ T5691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.190894][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 274.191216][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 274.225357][ T5691] usb 5-1: config 0 descriptor?? [ 274.243843][ T5691] hub 5-1:0.0: USB hub found [ 274.269114][ T10] usb 2-1: USB disconnect, device number 5 [ 274.444294][ T5691] hub 5-1:0.0: 1 port detected [ 274.647725][ T5691] hub 5-1:0.0: hub_hub_status failed (err = -71) [ 274.647750][ T5691] hub 5-1:0.0: config failed, can't get hub status (err -71) [ 274.684635][ T5691] usbhid 5-1:0.0: can't add hid device: -71 [ 274.684748][ T5691] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 274.760571][ T5691] usb 5-1: USB disconnect, device number 2 [ 275.503092][ T8693] random: crng reseeded on system resumption [ 275.545298][ T8692] mmap: syz.1.1090 (8692) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 280.787583][ T8796] overlayfs: overlapping lowerdir path [ 283.165545][ T8815] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 283.333667][ T38] kauditd_printk_skb: 19 callbacks suppressed [ 283.333686][ T38] audit: type=1326 audit(1785218104.146:337): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=8819 comm="syz.4.1124" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fbaecf8de99 code=0x0 [ 283.365296][ T8824] tipc: Can't bind to reserved service type 2 [ 283.609523][ T8831] overlayfs: overlapping lowerdir path [ 285.272530][ T8862] serio: Serial port ptm0 [ 286.190489][ T8884] overlayfs: overlapping lowerdir path [ 288.235406][ T8882] overlayfs: overlapping lowerdir path [ 288.523767][ T8893] overlayfs: missing 'lowerdir' [ 289.049603][ T1010] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 289.209777][ T1010] usb 4-1: Using ep0 maxpacket: 16 [ 289.217756][ T1010] usb 4-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 289.217789][ T1010] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.217810][ T1010] usb 4-1: Product: syz [ 289.217825][ T1010] usb 4-1: Manufacturer: syz [ 289.217841][ T1010] usb 4-1: SerialNumber: syz [ 289.514352][ T1010] usb 4-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 289.576197][ T1010] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 289.576820][ T1010] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 289.576929][ T1010] usb 4-1: media controller created [ 289.644478][ T1010] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 289.761573][ T1010] zl10353_read_register: readreg error (reg=127, ret==-71) [ 289.859823][ T1010] dvb_usb_gl861 4-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 289.888630][ T1010] usb 4-1: USB disconnect, device number 8 [ 290.252203][ T8917] Need at least one configuration in g1. [ 290.252581][ T8917] udc usbip-vudc.0: failed to start g1: -22 [ 290.252598][ T8917] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 290.320953][ T8917] UDC core: g1: couldn't find an available UDC or it's busy [ 292.042257][ T8942] binder: 8941:8942 ioctl c0306201 200000000080 returned -14 [ 292.048290][ T8942] binder: 8941:8942 ioctl c0306201 2000000003c0 returned -14 [ 297.939780][ T1010] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 298.899593][ T1010] usb 2-1: Using ep0 maxpacket: 8 [ 298.907662][ T1010] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 298.907692][ T1010] usb 2-1: config 0 interface 0 has no altsetting 0 [ 298.907724][ T1010] usb 2-1: New USB device found, idVendor=20bc, idProduct=5500, bcdDevice= 0.00 [ 298.907746][ T1010] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 298.992136][ T1010] usb 2-1: config 0 descriptor?? [ 299.451304][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.451339][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.451374][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.451401][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.451427][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.451453][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.456337][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.456378][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.456406][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.456433][ T1010] betop 0003:20BC:5500.0009: unknown main item tag 0x0 [ 299.471625][ T9028] syz_tun: entered promiscuous mode [ 299.471681][ T9028] syz_tun: entered allmulticast mode [ 299.567557][ T1010] betop 0003:20BC:5500.0009: hidraw0: USB HID v80.00 Device [HID 20bc:5500] on usb-dummy_hcd.1-1/input0 [ 299.567589][ T1010] betop 0003:20BC:5500.0009: no inputs found [ 299.643388][ T1010] usb 2-1: USB disconnect, device number 6 [ 299.760398][ T9036] fido_id[9036]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 312.935982][ T9103] netlink: 'syz.4.1222': attribute type 1 has an invalid length. [ 312.936004][ T9103] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1222'. [ 316.362194][ T4905] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 316.367530][ T4905] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 316.368637][ T4905] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 316.380920][ T4905] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 316.383844][ T4905] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 317.079777][ T9067] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 317.162732][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.162843][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.518107][ T5606] Bluetooth: hci0: command tx timeout [ 318.666495][ T9162] syzkaller1: entered allmulticast mode [ 318.786750][ T9177] netlink: 'syz.1.1238': attribute type 1 has an invalid length. [ 318.786766][ T9177] netlink: 'syz.1.1238': attribute type 4 has an invalid length. [ 318.786776][ T9177] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.1238'. [ 318.788323][ T9177] netlink: 'syz.1.1238': attribute type 1 has an invalid length. [ 318.788337][ T9177] netlink: 'syz.1.1238': attribute type 4 has an invalid length. [ 318.788346][ T9177] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.1238'. [ 318.903722][ T9179] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1239'. [ 318.924199][ T9179] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1239'. [ 319.217423][ T1542] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.435606][ T9185] overlayfs: overlapping lowerdir path [ 319.788555][ T1542] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.293792][ T1542] bridge0: port 3(netdevsim1) entered disabled state [ 320.411089][ T1542] netdevsim netdevsim2 netdevsim1 (unregistering): left allmulticast mode [ 320.411171][ T1542] netdevsim netdevsim2 netdevsim1 (unregistering): left promiscuous mode [ 320.417636][ T1542] bridge0: port 3(netdevsim1) entered disabled state [ 320.570686][ T1542] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.589574][ T5606] Bluetooth: hci0: command tx timeout [ 320.635622][ T9205] syzkaller1: entered allmulticast mode [ 321.364448][ T1542] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 322.135001][ T9127] bridge0: port 1(bridge_slave_0) entered blocking state [ 322.135395][ T9127] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.135636][ T9127] bridge_slave_0: entered allmulticast mode [ 322.167915][ T9127] bridge_slave_0: entered promiscuous mode [ 322.181499][ T9127] bridge0: port 2(bridge_slave_1) entered blocking state [ 322.181875][ T9127] bridge0: port 2(bridge_slave_1) entered disabled state [ 322.182128][ T9127] bridge_slave_1: entered allmulticast mode [ 322.185469][ T9127] bridge_slave_1: entered promiscuous mode [ 322.652369][ T9127] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 322.669668][ T5606] Bluetooth: hci0: command tx timeout [ 322.693159][ T9127] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 322.884494][ T9127] team0: Port device team_slave_0 added [ 322.968913][ T9261] vxcan0: tx address claim with different name [ 322.995865][ T9127] team0: Port device team_slave_1 added [ 323.206509][ T9274] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1269'. [ 323.228109][ T9274] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1269'. [ 323.299947][ T1542] dummy0: left allmulticast mode [ 323.316513][ T1542] dummy0: left promiscuous mode [ 323.321811][ T1542] bridge0: port 4(dummy0) entered disabled state [ 323.461538][ T1542] bridge_slave_1: left allmulticast mode [ 323.461576][ T1542] bridge_slave_1: left promiscuous mode [ 323.461874][ T1542] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.621957][ T1542] bridge_slave_0: left allmulticast mode [ 323.622027][ T1542] bridge_slave_0: left promiscuous mode [ 323.622395][ T1542] bridge0: port 1(bridge_slave_0) entered disabled state [ 324.600308][ T1542] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 324.683679][ T1542] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 324.724982][ T1542] bond0 (unregistering): Released all slaves [ 324.759656][ T5606] Bluetooth: hci0: command tx timeout [ 324.762637][ T9127] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 324.762652][ T9127] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 324.762681][ T9127] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 325.138429][ T9127] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 325.138447][ T9127] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.138489][ T9127] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 325.157790][ T1542] tipc: Left network mode [ 325.361593][ T9127] hsr_slave_0: entered promiscuous mode [ 325.367743][ T9127] hsr_slave_1: entered promiscuous mode [ 325.375629][ T9127] debugfs: 'hsr0' already exists in 'hsr' [ 325.375700][ T9127] Cannot create hsr debugfs directory [ 326.705126][ T5251] 8021q: adding VLAN 0 to HW filter on device eth5 [ 327.999645][ T1542] hsr_slave_0: left promiscuous mode [ 328.043588][ T1542] hsr_slave_1: left promiscuous mode [ 328.045046][ T1542] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 328.045063][ T1542] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 328.082554][ T1542] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 328.082597][ T1542] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 328.273577][ T1542] veth1_macvtap: left promiscuous mode [ 328.273678][ T1542] veth0_macvtap: left promiscuous mode [ 328.273966][ T1542] veth1_vlan: left promiscuous mode [ 328.282909][ T1542] veth0_vlan: left promiscuous mode [ 329.191018][ T1542] team0 (unregistering): Port device team_slave_1 removed [ 329.250357][ T1542] team0 (unregistering): Port device team_slave_0 removed [ 329.922654][ T9363] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 330.172201][ T9373] netlink: zone id is out of range [ 330.175334][ T9373] netlink: set zone limit has 4 unknown bytes [ 331.166233][ T9127] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 331.252105][ T9127] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 331.258262][ T9396] syzkaller1: entered promiscuous mode [ 331.258285][ T9396] syzkaller1: entered allmulticast mode [ 331.286531][ T9127] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 331.372411][ T9127] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 331.878498][ T9127] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 331.904561][ T9127] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 331.923514][ T5251] 8021q: adding VLAN 0 to HW filter on device eth6 [ 331.924606][ T9127] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 332.025967][ T9127] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 332.555941][ T9127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 332.653345][ T9127] 8021q: adding VLAN 0 to HW filter on device team0 [ 332.776743][ T1474] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.776916][ T1474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 332.973597][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.973766][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 333.096514][ T9436] Need at least one configuration in g1. [ 333.096646][ T9436] udc usbip-vudc.0: failed to start g1: -22 [ 333.096662][ T9436] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 333.396492][ T9436] UDC core: g1: couldn't find an available UDC or it's busy [ 333.946983][ T5251] 8021q: adding VLAN 0 to HW filter on device eth7 [ 334.674398][ T9127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 334.993935][ T9494] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 335.457165][ T9506] Need at least one configuration in g1. [ 335.457311][ T9506] udc usbip-vudc.0: failed to start g1: -22 [ 335.457334][ T9506] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 335.509689][ T9506] UDC core: g1: couldn't find an available UDC or it's busy [ 335.531313][ T9512] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.1334'. [ 335.622667][ T5251] 8021q: adding VLAN 0 to HW filter on device eth8 [ 335.891714][ T9127] veth0_vlan: entered promiscuous mode [ 335.948907][ T9523] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1338'. [ 335.972450][ T9127] veth1_vlan: entered promiscuous mode [ 335.980594][ T9523] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1338'. [ 335.992693][ T9523] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1338'. [ 336.092677][ T9127] veth0_macvtap: entered promiscuous mode [ 336.191073][ T9127] veth1_macvtap: entered promiscuous mode [ 336.337506][ T9127] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 336.437351][ T9127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 336.524359][ T48] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.524405][ T48] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.524439][ T48] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.524474][ T48] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 336.598524][ T9535] Need at least one configuration in g1. [ 336.598647][ T9535] udc usbip-vudc.0: failed to start g1: -22 [ 336.598669][ T9535] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 336.602822][ T9535] UDC core: g1: couldn't find an available UDC or it's busy [ 336.710344][ T9537] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1344'. [ 337.062032][ T9548] netlink: 'syz.3.1348': attribute type 29 has an invalid length. [ 337.204472][ T9551] netlink: 'syz.3.1348': attribute type 29 has an invalid length. [ 337.662311][ T1351] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 337.662350][ T1351] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 337.946072][ T9566] netlink: 'syz.3.1354': attribute type 1 has an invalid length. [ 337.946094][ T9566] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.1354'. [ 338.051440][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 338.051454][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 338.164888][ T9569] Need at least one configuration in g1. [ 338.164977][ T9569] udc usbip-vudc.0: failed to start g1: -22 [ 338.164991][ T9569] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 338.165626][ T9569] UDC core: g1: couldn't find an available UDC or it's busy [ 338.525924][ T9584] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1361'. [ 338.861660][ T9594] netlink: 'syz.4.1364': attribute type 1 has an invalid length. [ 338.861681][ T9594] netlink: 16150 bytes leftover after parsing attributes in process `syz.4.1364'. [ 339.102186][ T9605] Need at least one configuration in g1. [ 339.102325][ T9605] udc usbip-vudc.0: failed to start g1: -22 [ 339.102348][ T9605] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 339.103404][ T9605] UDC core: g1: couldn't find an available UDC or it's busy [ 339.694454][ T9623] netlink: 'syz.4.1375': attribute type 1 has an invalid length. [ 339.694474][ T9623] netlink: 16150 bytes leftover after parsing attributes in process `syz.4.1375'. [ 340.061545][ T9629] Need at least one configuration in g1. [ 340.061705][ T9629] udc usbip-vudc.0: failed to start g1: -22 [ 340.061729][ T9629] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 340.102308][ T9629] UDC core: g1: couldn't find an available UDC or it's busy [ 340.306627][ T9638] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1382'. [ 340.827165][ T9655] Need at least one configuration in g1. [ 340.827437][ T9655] udc usbip-vudc.0: failed to start g1: -22 [ 340.827462][ T9655] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 340.874755][ T9655] UDC core: g1: couldn't find an available UDC or it's busy [ 341.924171][ T9694] Need at least one configuration in g1. [ 341.924327][ T9694] udc usbip-vudc.0: failed to start g1: -22 [ 341.924349][ T9694] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 341.927029][ T9694] UDC core: g1: couldn't find an available UDC or it's busy [ 342.599795][ T9713] netlink: 'syz.5.1414': attribute type 1 has an invalid length. [ 342.599827][ T9713] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.1414'. [ 342.793858][ T9717] Need at least one configuration in g1. [ 342.794002][ T9717] udc usbip-vudc.0: failed to start g1: -22 [ 342.794025][ T9717] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 342.795118][ T9717] UDC core: g1: couldn't find an available UDC or it's busy [ 355.032087][ T9741] netlink: 'syz.1.1423': attribute type 1 has an invalid length. [ 355.032109][ T9741] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.1423'. [ 355.034018][ T9740] Need at least one configuration in g1. [ 355.034158][ T9740] udc usbip-vudc.0: failed to start g1: -22 [ 355.034182][ T9740] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 355.079602][ T5606] Bluetooth: hci4: command 0x0406 tx timeout [ 355.148447][ T9740] UDC core: g1: couldn't find an available UDC or it's busy [ 355.961481][ T9778] netlink: 'syz.5.1437': attribute type 1 has an invalid length. [ 355.961503][ T9778] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.1437'. [ 356.540222][ T9796] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1444'. [ 356.904907][ T9808] netlink: 'syz.5.1448': attribute type 1 has an invalid length. [ 356.904929][ T9808] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.1448'. [ 358.306336][ T9849] kvm: requested 2514 ns i8254 timer period limited to 200000 ns [ 358.648947][ T9853] netlink: 'syz.3.1460': attribute type 1 has an invalid length. [ 358.648969][ T9853] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.1460'. [ 359.748648][ T9892] netlink: 'syz.5.1470': attribute type 1 has an invalid length. [ 359.748670][ T9892] netlink: 16150 bytes leftover after parsing attributes in process `syz.5.1470'. [ 362.626216][ T9993] overlayfs: missing 'lowerdir' [ 363.877880][T10007] Need at least one configuration in g1. [ 363.878039][T10007] udc usbip-vudc.0: failed to start g1: -22 [ 363.878065][T10007] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 363.914092][T10007] UDC core: g1: couldn't find an available UDC or it's busy [ 365.060549][T10038] Need at least one configuration in g1. [ 365.060695][T10038] udc usbip-vudc.0: failed to start g1: -22 [ 365.060718][T10038] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 365.062990][T10038] UDC core: g1: couldn't find an available UDC or it's busy [ 365.612446][T10050] process 'syz.5.1522' launched './file2' with NULL argv: empty string added [ 366.239921][T10058] netlink: 'syz.3.1526': attribute type 25 has an invalid length. [ 367.222988][T10084] netlink: 'syz.5.1536': attribute type 25 has an invalid length. [ 368.347356][T10112] netlink: 'syz.5.1546': attribute type 25 has an invalid length. [ 369.267225][T10134] netlink: 'syz.5.1555': attribute type 25 has an invalid length. [ 369.282239][T10136] netlink: 'syz.3.1557': attribute type 1 has an invalid length. [ 369.282259][T10136] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.1557'. [ 370.118629][T10162] netlink: 'syz.1.1567': attribute type 1 has an invalid length. [ 370.118650][T10162] netlink: 16150 bytes leftover after parsing attributes in process `syz.1.1567'. [ 370.141142][T10163] netlink: 'syz.5.1568': attribute type 25 has an invalid length. [ 370.505032][T10165] smpboot: CPU 1 is now offline [ 370.946959][T10170] clocksource: Switched to clocksource acpi_pm [ 371.255996][T10168] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 371.894352][T10187] evm: overlay not supported [ 375.620114][T10272] kvm: user requested TSC rate below hardware speed [ 375.697299][T10273] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 376.623226][ T38] audit: type=1326 audit(1785218197.439:338): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7ff054b1f0f3 code=0x7ffc0000 [ 376.623288][ T38] audit: type=1326 audit(1785218197.439:339): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0548bde99 code=0x7ffc0000 [ 376.623446][ T38] audit: type=1326 audit(1785218197.439:340): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0548bde99 code=0x7ffc0000 [ 376.626010][ T38] audit: type=1326 audit(1785218197.439:341): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0548bde99 code=0x7ffc0000 [ 376.626237][ T38] audit: type=1326 audit(1785218197.439:342): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7ff054b1f0f3 code=0x7ffc0000 [ 376.626395][ T38] audit: type=1326 audit(1785218197.439:343): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff0548bde99 code=0x7ffc0000 [ 376.626595][ T38] audit: type=1326 audit(1785218197.439:344): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7ff054b1f0f3 code=0x7ffc0000 [ 376.626809][ T38] audit: type=1326 audit(1785218197.439:345): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=56 compat=0 ip=0x7ff0548bde99 code=0x7ffc0000 [ 376.853097][ T38] audit: type=1326 audit(1785218197.659:347): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7ff054b1f0f3 code=0x7ffc0000 [ 376.853236][ T38] audit: type=1326 audit(1785218197.659:346): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=10282 comm="syz.3.1615" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7ff054b1f0f3 code=0x7ffc0000 [ 377.312655][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 377.312722][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.377596][T10357] kvm: requested 17600 ns i8254 timer period limited to 200000 ns [ 380.406196][T10357] kvm: requested 128228 ns i8254 timer period limited to 200000 ns [ 380.408003][T10357] kvm: requested 59504 ns i8254 timer period limited to 200000 ns [ 380.433653][T10357] kvm: requested 198628 ns i8254 timer period limited to 200000 ns [ 380.461027][T10357] kvm: requested 59504 ns i8254 timer period limited to 200000 ns [ 380.468464][T10357] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 380.498128][T10357] kvm: requested 121523 ns i8254 timer period limited to 200000 ns [ 380.555753][T10357] kvm: requested 24304 ns i8254 timer period limited to 200000 ns [ 380.599223][T10357] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 380.600997][T10357] kvm: requested 134933 ns i8254 timer period limited to 200000 ns [ 381.011851][T10369] Need at least one configuration in g1. [ 381.011996][T10369] udc usbip-vudc.0: failed to start g1: -22 [ 381.012029][T10369] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 381.013851][T10369] UDC core: g1: couldn't find an available UDC or it's busy [ 382.217946][T10401] Need at least one configuration in g1. [ 382.218106][T10401] udc usbip-vudc.0: failed to start g1: -22 [ 382.218133][T10401] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 382.320668][T10401] UDC core: g1: couldn't find an available UDC or it's busy [ 383.225658][T10418] Need at least one configuration in g1. [ 383.225815][T10418] udc dummy_udc.0: failed to start g1: -22 [ 383.225851][T10418] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 383.229299][T10418] UDC core: g1: couldn't find an available UDC or it's busy [ 384.573435][T10440] netlink: 'syz.5.1676': attribute type 25 has an invalid length. [ 385.450707][T10465] netlink: 'syz.3.1687': attribute type 25 has an invalid length. [ 385.674431][T10473] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1691'. [ 385.912894][ T38] kauditd_printk_skb: 22 callbacks suppressed [ 385.912913][ T38] audit: type=1800 audit(1785218206.709:370): pid=10457 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.4.1681" name="file0" dev="fuse" ino=0 res=0 errno=0 [ 386.475938][T10489] netlink: 'syz.5.1698': attribute type 25 has an invalid length. [ 387.305510][T10510] netlink: 'syz.1.1708': attribute type 25 has an invalid length. [ 388.493172][T10536] netlink: 'syz.4.1718': attribute type 25 has an invalid length. [ 389.661829][T10548] create_pit_timer: 7 callbacks suppressed [ 389.661846][T10548] kvm: requested 17600 ns i8254 timer period limited to 200000 ns [ 389.700300][T10548] kvm: requested 128228 ns i8254 timer period limited to 200000 ns [ 389.704920][T10548] kvm: requested 59504 ns i8254 timer period limited to 200000 ns [ 389.707806][T10548] kvm: requested 198628 ns i8254 timer period limited to 200000 ns [ 389.743423][T10548] kvm: requested 59504 ns i8254 timer period limited to 200000 ns [ 389.747844][T10548] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 389.784659][T10548] kvm: requested 121523 ns i8254 timer period limited to 200000 ns [ 389.796981][T10548] kvm: requested 24304 ns i8254 timer period limited to 200000 ns [ 389.812819][T10548] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 389.817315][T10548] kvm: requested 134933 ns i8254 timer period limited to 200000 ns [ 390.198168][T10559] netlink: 'syz.4.1727': attribute type 25 has an invalid length. [ 390.929898][T10578] netlink: 'syz.5.1736': attribute type 25 has an invalid length. [ 391.890162][T10586] netlink: 'syz.4.1738': attribute type 2 has an invalid length. [ 392.678513][T10607] netlink: 'syz.3.1747': attribute type 25 has an invalid length. [ 392.877910][ T1010] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 393.019963][T10623] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1753'. [ 393.071934][ T1010] usb 5-1: unable to get BOS descriptor or descriptor too short [ 393.075632][ T1010] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 393.075654][ T1010] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 393.075699][ T1010] usb 5-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 393.075870][ T1010] usb 5-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 393.075911][ T1010] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 393.075936][ T1010] usb 5-1: config 1 interface 1 has no altsetting 0 [ 393.136070][ T1010] usb 5-1: string descriptor 0 read error: -22 [ 393.136418][ T1010] usb 5-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 393.136515][ T1010] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.749423][T10634] netlink: 'syz.3.1759': attribute type 25 has an invalid length. [ 393.838946][ T1010] usb 5-1: 2:0: cannot get min/max values for control 2 (id 2) [ 394.351722][ T1010] usb 5-1: USB disconnect, device number 3 [ 398.600734][ T1010] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 398.760876][ T1010] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 398.760925][ T1010] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 398.760950][ T1010] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.799923][ T1010] usb 6-1: config 0 descriptor?? [ 399.298813][ T1010] keytouch 0003:0926:3333.000A: fixing up Keytouch IEC report descriptor [ 399.382431][ T1010] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.000A/input/input7 [ 399.383882][ T32] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 399.601395][ T32] usb 2-1: Using ep0 maxpacket: 16 [ 399.649679][ T32] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 399.649710][ T32] usb 2-1: config 0 has no interface number 0 [ 399.649887][ T32] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 399.649915][ T32] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 399.724554][ T32] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 399.724606][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.724774][ T32] usb 2-1: Product: syz [ 399.724792][ T32] usb 2-1: Manufacturer: syz [ 399.724807][ T32] usb 2-1: SerialNumber: syz [ 399.825272][ T32] usb 2-1: config 0 descriptor?? [ 399.829778][T10723] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 399.829920][T10723] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 400.093156][T10723] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 400.094595][T10723] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 400.183858][T10737] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1806'. [ 400.305520][ T32] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 400.305748][ T32] asix 2-1:0.34: probe with driver asix failed with error -61 [ 400.344206][ T1010] keytouch 0003:0926:3333.000A: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 400.401033][ T1010] usb 6-1: USB disconnect, device number 2 [ 400.594231][T10740] fido_id[10740]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 401.135787][T10760] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1815'. [ 401.673442][T10775] overlayfs: missing 'lowerdir' [ 401.842646][T10781] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1826'. [ 402.062955][ T32] usb 2-1: USB disconnect, device number 7 [ 402.213554][T10789] overlayfs: failed lookup in lower (newroot/507, name='file0', err=-40): overlapping layers [ 402.367692][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 402.367975][ T5599] do_umount: task=syz-executor[5599] propagate_mount_busy()!=0 [ 402.618554][ T32] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 402.844328][ T32] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 402.844355][ T32] usb 2-1: config 0 has no interface number 0 [ 402.844399][ T32] usb 2-1: config 0 interface 41 has no altsetting 0 [ 402.856268][ T32] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 402.858266][ T32] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.858320][ T32] usb 2-1: Product: syz [ 402.858355][ T32] usb 2-1: Manufacturer: syz [ 402.858391][ T32] usb 2-1: SerialNumber: syz [ 402.933021][ T32] usb 2-1: config 0 descriptor?? [ 402.982314][T10801] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1836'. [ 403.789765][ T32] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 404.005860][ T32] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 404.005888][ T32] CoreChips 2-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 404.046036][ T32] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 404.076807][ T32] usb 2-1: USB disconnect, device number 8 [ 404.806767][T10822] tap0: tun_chr_ioctl cmd 1074025676 [ 404.806790][T10822] tap0: owner set to 0 [ 405.673490][ T5606] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 405.719507][ T5606] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 405.730126][ T5606] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 405.733535][ T5606] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 405.751456][ T5606] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 406.114641][ T1427] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 406.919290][ T1427] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.494350][ T1427] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 407.963906][ T4905] Bluetooth: hci2: command tx timeout [ 410.026847][ T4905] Bluetooth: hci2: command tx timeout [ 410.388011][T10896] netlink: 'syz.1.1867': attribute type 298 has an invalid length. [ 410.439019][ T1427] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.608017][T10911] bridge0: port 3(erspan0) entered blocking state [ 411.608992][T10911] bridge0: port 3(erspan0) entered disabled state [ 411.609184][T10911] erspan0: entered allmulticast mode [ 411.668109][T10911] erspan0: entered promiscuous mode [ 411.668870][T10911] bridge0: port 3(erspan0) entered blocking state [ 411.669021][T10911] bridge0: port 3(erspan0) entered forwarding state [ 412.131262][ T4905] Bluetooth: hci2: command tx timeout [ 412.256412][T10834] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.257953][T10834] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.258414][T10834] bridge_slave_0: entered allmulticast mode [ 412.280967][T10834] bridge_slave_0: entered promiscuous mode [ 412.306741][T10834] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.314397][T10834] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.314664][T10834] bridge_slave_1: entered allmulticast mode [ 412.354632][T10834] bridge_slave_1: entered promiscuous mode [ 412.537354][ T1427] bridge_slave_1: left allmulticast mode [ 412.537380][ T1427] bridge_slave_1: left promiscuous mode [ 412.537566][ T1427] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.706558][ T1427] bridge_slave_0: left allmulticast mode [ 412.706612][ T1427] bridge_slave_0: left promiscuous mode [ 412.706879][ T1427] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.821603][T10937] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1879'. [ 414.079287][ T1427] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 414.179256][ T1427] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 414.185137][ T4905] Bluetooth: hci2: command tx timeout [ 414.269760][ T1427] bond0 (unregistering): Released all slaves [ 414.731740][T10834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 414.984608][T10834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 415.109316][T10834] team0: Port device team_slave_0 added [ 415.159498][T10834] team0: Port device team_slave_1 added [ 415.250810][T10834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 415.250827][T10834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.250854][T10834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 415.260485][T10834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 415.260523][T10834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 415.260595][T10834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 416.545702][T10834] hsr_slave_0: entered promiscuous mode [ 416.551818][T10834] hsr_slave_1: entered promiscuous mode [ 416.577024][T10834] debugfs: 'hsr0' already exists in 'hsr' [ 416.577048][T10834] Cannot create hsr debugfs directory [ 416.724693][ T1427] hsr_slave_0: left promiscuous mode [ 416.764883][ T1427] hsr_slave_1: left promiscuous mode [ 416.767905][ T1427] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 416.767924][ T1427] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 416.794885][ T5747] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 416.813821][ T1427] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 416.813869][ T1427] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 416.968035][ T5747] usb 5-1: unable to get BOS descriptor or descriptor too short [ 416.969945][ T5747] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 64, changing to 7 [ 416.973302][ T5747] usb 5-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice= 0.40 [ 416.973329][ T5747] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.973361][ T5747] usb 5-1: Product: syz [ 416.973377][ T5747] usb 5-1: Manufacturer: syz [ 416.973392][ T5747] usb 5-1: SerialNumber: syz [ 417.111767][ T1427] veth1_macvtap: left promiscuous mode [ 417.111925][ T1427] veth0_macvtap: left promiscuous mode [ 417.112230][ T1427] veth1_vlan: left promiscuous mode [ 417.149431][ T1427] veth0_vlan: left promiscuous mode [ 417.339171][ T5747] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 417.370420][ T5747] usb 5-1: USB disconnect, device number 4 [ 419.957548][ T1427] team0 (unregistering): Port device team_slave_1 removed [ 420.035673][ T1427] team0 (unregistering): Port device team_slave_0 removed [ 420.816133][ T5251] 8021q: adding VLAN 0 to HW filter on device eth9 [ 423.149278][ T9] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 423.300697][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 423.318914][ T9] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 423.318942][ T9] usb 6-1: config 0 has no interface number 0 [ 423.319093][ T9] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 423.319122][ T9] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 423.366243][ T9] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 423.366274][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.366293][ T9] usb 6-1: Product: syz [ 423.366306][ T9] usb 6-1: Manufacturer: syz [ 423.366320][ T9] usb 6-1: SerialNumber: syz [ 423.424960][ T9] usb 6-1: config 0 descriptor?? [ 423.429689][T11084] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 423.430144][T11084] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 423.722301][T11084] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 423.722446][T11084] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 423.951125][ T9] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 423.951448][ T9] asix 6-1:0.34: probe with driver asix failed with error -61 [ 424.483321][ T5251] 8021q: adding VLAN 0 to HW filter on device eth10 [ 424.560532][T10834] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 424.831287][T10834] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 424.832337][T10834] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 425.243548][ T10] usb 6-1: USB disconnect, device number 3 [ 425.295080][T10834] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 425.311422][T10834] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 425.610412][T10834] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 425.717036][T10834] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 425.856430][T10834] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 426.751188][T10834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 427.021534][T10834] 8021q: adding VLAN 0 to HW filter on device team0 [ 427.135206][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 427.135377][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 427.206900][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 427.207076][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 427.720504][ T5251] 8021q: adding VLAN 0 to HW filter on device eth11 [ 431.189524][T11168] Need at least one configuration in g1. [ 431.189665][T11168] udc usbip-vudc.0: failed to start g1: -22 [ 431.189690][T11168] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 431.245229][T11168] UDC core: g1: couldn't find an available UDC or it's busy [ 433.819135][ T5251] 8021q: adding VLAN 0 to HW filter on device eth12 [ 433.927875][T11215] Need at least one configuration in g1. [ 433.928039][T11215] udc usbip-vudc.0: failed to start g1: -22 [ 433.928064][T11215] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 433.957873][T11215] UDC core: g1: couldn't find an available UDC or it's busy [ 434.085592][T11213] capability: warning: `syz.1.1950' uses 32-bit capabilities (legacy support in use) [ 434.397853][T10834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 435.793423][T11247] Need at least one configuration in g1. [ 435.793571][T11247] udc usbip-vudc.0: failed to start g1: -22 [ 435.793595][T11247] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 435.797828][T11247] UDC core: g1: couldn't find an available UDC or it's busy [ 436.206048][T10834] veth0_vlan: entered promiscuous mode [ 436.363161][T10834] veth1_vlan: entered promiscuous mode [ 436.637392][T11261] netlink: 100 bytes leftover after parsing attributes in process `syz.5.1965'. [ 436.637674][T10834] veth0_macvtap: entered promiscuous mode [ 436.676086][T10834] veth1_macvtap: entered promiscuous mode [ 436.819076][T10834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 437.059122][T10834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 437.129745][ T1427] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.130045][ T1427] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.130089][ T1427] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.206094][ T1427] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 438.547584][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.547604][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.913620][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.913638][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.335805][T11302] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1845'. [ 440.065302][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.065422][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.057743][T11334] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1990'. [ 441.284355][ T38] audit: type=1326 audit(1785218262.111:371): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=11340 comm="syz.1.1993" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=228 compat=0 ip=0x7fc40e4bb0f3 code=0x0 [ 441.991599][T11356] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1998'. [ 441.991630][T11356] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1998'. [ 442.111257][ T4905] Bluetooth: hci0: command 0x0406 tx timeout [ 442.441855][T11363] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2001'. [ 443.570093][T11391] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2013'. [ 443.698439][T11395] Need at least one configuration in g1. [ 443.698572][T11395] udc usbip-vudc.0: failed to start g1: -22 [ 443.698594][T11395] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 443.699802][T11395] UDC core: g1: couldn't find an available UDC or it's busy [ 444.234360][T11416] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2024'. [ 444.370984][ T5696] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 444.522302][ T5696] usb 2-1: Using ep0 maxpacket: 16 [ 444.540901][ T5696] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 444.540943][ T5696] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 444.573120][ T5696] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 444.573169][ T5696] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.573190][ T5696] usb 2-1: Product: syz [ 444.573211][ T5696] usb 2-1: Manufacturer: syz [ 444.573226][ T5696] usb 2-1: SerialNumber: syz [ 444.967521][ T5696] usb 2-1: Can't get UAC3 power state for id 10 [ 445.726573][ T5696] usb 2-1: 0:2 : does not exist [ 445.726595][ T5696] usb 2-1: 0:3 : does not exist [ 445.726609][ T5696] usb 2-1: 0:4 : does not exist [ 445.726623][ T5696] usb 2-1: 0:5 : does not exist [ 445.726698][ T5696] usb 2-1: BAAD SPEAKERPHONE c_chmask mismatch [ 446.919825][ T5696] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 446.956716][ T5696] usb 2-1: USB disconnect, device number 9 [ 447.274231][T11478] udevd[11478]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 447.380954][T11486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2045'. [ 448.346791][T11513] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2054'. [ 448.652924][T11518] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2054'. [ 448.741334][T11523] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2057'. [ 449.882993][T11557] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2066'. [ 449.918285][T11557] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2066'. [ 452.175796][ T5772] IPVS: starting estimator thread 0... [ 452.225661][T11610] IPVS: sh: FWM 3 0x00000003 - no destination available [ 452.238427][T11602] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2079'. [ 453.024939][T11615] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2079'. [ 453.276643][T11609] IPVS: using max 4 ests per chain, 9600 per kthread [ 454.406269][T11636] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2091'. [ 454.407643][T11636] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2091'. [ 454.408386][T11636] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2091'. [ 455.039041][ T5606] Bluetooth: hci0: unexpected event for opcode 0x202d [ 456.161541][T11667] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2100'. [ 456.180333][T11667] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2100'. [ 456.181014][T11667] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2100'. [ 456.294241][T11661] loop9: detected capacity change from 0 to 7 [ 458.165145][T11688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2106'. [ 458.166677][T11688] netlink: 'syz.4.2106': attribute type 15 has an invalid length. [ 459.439332][T11700] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2111'. [ 459.445228][T11700] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2111'. [ 459.519032][T11700] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2111'. [ 459.829219][T11707] fuse: fd is not a fuse device [ 461.775215][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.929473][T11728] 9p: Bad value for 'rfdno' [ 462.264456][T11737] netlink: 'syz.5.2128': attribute type 25 has an invalid length. [ 462.496369][ T4905] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 462.579889][ T4905] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 462.581575][ T4905] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 462.586745][ T4905] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 462.629542][ T4905] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 463.121920][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.669508][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.046840][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.828809][ T4905] Bluetooth: hci1: command tx timeout [ 465.911033][ T12] bridge_slave_1: left allmulticast mode [ 465.911068][ T12] bridge_slave_1: left promiscuous mode [ 465.911409][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.075216][ T12] bridge_slave_0: left allmulticast mode [ 466.075251][ T12] bridge_slave_0: left promiscuous mode [ 466.075537][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.906219][ T4905] Bluetooth: hci1: command tx timeout [ 467.965656][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 468.037361][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 468.076167][ T12] bond0 (unregistering): Released all slaves [ 468.153875][ T5251] 8021q: adding VLAN 0 to HW filter on device eth13 [ 468.978933][ T4905] Bluetooth: hci1: command tx timeout [ 469.086995][T11742] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.126325][T11742] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.126605][T11742] bridge_slave_0: entered allmulticast mode [ 469.172505][T11742] bridge_slave_0: entered promiscuous mode [ 469.199816][T11742] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.204088][T11742] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.204400][T11742] bridge_slave_1: entered allmulticast mode [ 469.223303][T11742] bridge_slave_1: entered promiscuous mode [ 469.577851][T11742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 469.612833][T11742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 470.957398][T11742] team0: Port device team_slave_0 added [ 470.966879][T11742] team0: Port device team_slave_1 added [ 471.057722][ T4905] Bluetooth: hci1: command tx timeout [ 474.955577][T11907] kthread_run failed with err -4 [ 475.344610][ T4905] Bluetooth: hci0: unexpected event for opcode 0x2011 [ 475.682590][T11922] Need at least one configuration in g1. [ 475.682789][T11922] udc usbip-vudc.0: failed to start g1: -22 [ 475.682814][T11922] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 475.801785][T11742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 475.801808][T11742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.801831][T11742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 475.831891][ T5251] 8021q: adding VLAN 0 to HW filter on device eth14 [ 475.883172][T11742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 475.883188][T11742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.883222][T11742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 476.022693][T11922] UDC core: g1: couldn't find an available UDC or it's busy [ 476.649313][T11742] hsr_slave_0: entered promiscuous mode [ 476.700901][T11742] hsr_slave_1: entered promiscuous mode [ 476.717601][T11742] debugfs: 'hsr0' already exists in 'hsr' [ 476.717627][T11742] Cannot create hsr debugfs directory [ 478.534649][ T4905] Bluetooth: hci2: unexpected cc 0x2042 length: 2 > 1 [ 478.623452][T11981] syz.5.2207(11981): Attempt to set a LOCK_MAND lock via flock(2). This support has been removed and the request ignored. [ 478.935509][ T5251] 8021q: adding VLAN 0 to HW filter on device eth15 [ 479.449678][ T12] hsr_slave_0: left promiscuous mode [ 479.993756][ T5747] IPVS: starting estimator thread 0... [ 480.116659][T12007] IPVS: using max 4 ests per chain, 9600 per kthread [ 480.334036][ T12] hsr_slave_1: left promiscuous mode [ 480.349662][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 480.349710][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 480.402495][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 480.402599][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 480.587885][ T12] veth1_macvtap: left promiscuous mode [ 480.588331][ T12] veth0_macvtap: left promiscuous mode [ 480.642830][ T12] veth1_vlan: left promiscuous mode [ 480.643135][ T12] veth0_vlan: left promiscuous mode [ 481.777101][ T12] team0 (unregistering): Port device team_slave_1 removed [ 481.828833][ T12] team0 (unregistering): Port device team_slave_0 removed [ 483.211513][T11742] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 483.348667][T11742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 483.352776][T11742] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 483.459748][T11742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 483.467052][T11742] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 483.530830][T11742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 483.539696][T11742] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 483.647304][T11742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 483.986991][ T5251] 8021q: adding VLAN 0 to HW filter on device eth16 [ 484.190848][T11742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 484.282302][T11742] 8021q: adding VLAN 0 to HW filter on device team0 [ 484.330485][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.330964][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 484.376745][ T1542] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.380157][ T1542] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.147781][T12109] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2247'. [ 485.631807][T11742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 486.079257][T11742] veth0_vlan: entered promiscuous mode [ 486.132411][T11742] veth1_vlan: entered promiscuous mode [ 486.353088][T11742] veth0_macvtap: entered promiscuous mode [ 486.387932][T11742] veth1_macvtap: entered promiscuous mode [ 486.552800][T11742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 486.617413][T11742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 486.731746][ T1542] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.734050][ T1542] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.734465][ T1542] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.734515][ T1542] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 487.853414][ T1474] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 487.853435][ T1474] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 487.988374][ T4905] Bluetooth: hci0: unexpected event for opcode 0x2011 [ 488.272367][ T1351] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 488.272386][ T1351] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.905339][ T4905] Bluetooth: hci4: command 0x0406 tx timeout [ 491.061511][ T4905] Bluetooth: hci1: connection err: -111 [ 491.278820][T12218] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2281'. [ 491.510686][ T4905] Bluetooth: hci0: unexpected event for opcode 0x1009 [ 492.515852][T12246] netlink: 'syz.7.2294': attribute type 25 has an invalid length. [ 495.052543][T12282] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2306'. [ 495.069914][T12282] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2306'. [ 495.114908][T12282] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2306'. [ 496.898042][ T4905] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 496.898326][ T4905] Bluetooth: hci1: Injecting HCI hardware error event [ 496.900166][ T4905] Bluetooth: hci1: hardware error 0x00 [ 496.936534][T12311] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2319'. [ 496.960165][T12311] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2319'. [ 497.026937][T12311] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2319'. [ 499.213735][ T4905] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 501.470879][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.471000][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.062648][T12411] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2349'. [ 502.555597][ T38] audit: type=1326 audit(1785218323.384:372): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7fbaed1ef0f3 code=0x7ffc0000 [ 502.555959][ T38] audit: type=1326 audit(1785218323.384:373): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 502.556858][ T38] audit: type=1326 audit(1785218323.384:374): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 502.560051][ T38] audit: type=1326 audit(1785218323.384:375): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7fbaed1ef0f3 code=0x7ffc0000 [ 502.562570][ T38] audit: type=1326 audit(1785218323.384:376): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 502.562614][ T38] audit: type=1326 audit(1785218323.384:377): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7fbaed1ef0f3 code=0x7ffc0000 [ 502.562646][ T38] audit: type=1326 audit(1785218323.384:378): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 502.562679][ T38] audit: type=1326 audit(1785218323.384:379): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 502.574211][ T38] audit: type=1326 audit(1785218323.384:380): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=228 compat=0 ip=0x7fbaed1ef0f3 code=0x7ffc0000 [ 502.577517][ T38] audit: type=1326 audit(1785218323.404:381): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12423 comm="syz.4.2354" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbaecf8de99 code=0x7ffc0000 [ 503.118563][T12439] fuse: Bad value for 'user_id' [ 503.118582][T12439] fuse: Bad value for 'user_id' [ 503.176408][T12440] tun0: tun_chr_ioctl cmd 1074025675 [ 503.176430][T12440] tun0: persist enabled [ 505.209378][T12503] netlink: 'syz.4.2381': attribute type 4 has an invalid length. [ 507.509850][T12575] configfs-gadget.g1 gadget.32: Error: no playback and capture channels [ 507.510281][T12575] udc usbip-vudc.0: failed to start g1: -22 [ 507.510306][T12575] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 507.511428][T12575] UDC core: g1: couldn't find an available UDC or it's busy [ 507.957341][ T4905] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 508.118743][T12603] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2424'. [ 508.143337][T12603] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2424'. [ 508.144625][T12603] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2424'. [ 508.621079][ T4905] Bluetooth: hci4: Received unexpected HCI Event 0x00 [ 508.677425][T12624] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2433'. [ 508.683608][T12624] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2433'. [ 508.700734][T12624] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2433'. [ 508.906098][T12633] configfs-gadget.g1 gadget.32: Error: no playback and capture channels [ 508.906283][T12633] udc usbip-vudc.0: failed to start g1: -22 [ 508.906325][T12633] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 508.911708][T12633] UDC core: g1: couldn't find an available UDC or it's busy [ 509.261302][ T4905] Bluetooth: hci4: ACL packet for unknown connection handle 200 [ 510.025562][ T4905] Bluetooth: hci0: ACL packet for unknown connection handle 200 [ 510.264663][T12676] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 511.399403][T12718] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2478'. [ 511.402054][T12718] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2478'. [ 511.426247][T12718] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2478'. [ 512.156613][T12739] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2488'. [ 512.356033][T12744] usbip-vudc usbip-vudc.0: gadget not bound [ 513.822685][T12771] usbip-vudc usbip-vudc.0: gadget not bound [ 514.156400][T12787] __nla_validate_parse: 5 callbacks suppressed [ 514.156498][T12787] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2507'. [ 514.160614][T12787] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2507'. [ 514.162225][T12787] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2507'. [ 514.799544][T12803] fuse: Bad value for 'fd' [ 515.008503][T12809] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2518'. [ 515.010859][T12809] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2518'. [ 515.034047][T12809] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2518'. [ 515.594585][T12833] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2529'. [ 515.596271][T12833] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2529'. [ 515.601783][T12833] netlink: 60 bytes leftover after parsing attributes in process `syz.7.2529'. [ 516.446468][T12854] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2538'. [ 519.499756][T12949] __nla_validate_parse: 4 callbacks suppressed [ 519.499791][T12949] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2578'. [ 520.078884][T12967] usbip-vudc usbip-vudc.0: gadget not bound [ 520.195984][T12971] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2588'. [ 520.955136][T13002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2601'. [ 521.084193][T13009] usbip-vudc usbip-vudc.0: gadget not bound [ 521.553165][T13027] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2614'. [ 522.350020][T13055] kvm: emulating exchange as write [ 522.761244][T13077] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2638'. [ 523.438395][T13100] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2649'. [ 525.034745][T13147] fuse: fd is not a fuse device [ 525.125123][T13143] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2668'. [ 525.762819][T13172] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2682'. [ 526.598929][T13200] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2694'. [ 527.552595][T13225] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2706'. [ 528.273954][T13246] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2716'. [ 529.427558][T13277] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2729'. [ 530.009951][ T32] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 530.128933][T13301] netlink: 'syz.7.2738': attribute type 4 has an invalid length. [ 530.196154][ T32] usb 6-1: Using ep0 maxpacket: 16 [ 530.210841][ T32] usb 6-1: config 0 has an invalid interface number: 34 but max is 0 [ 530.210868][ T32] usb 6-1: config 0 has no interface number 0 [ 530.210996][ T32] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 530.211040][ T32] usb 6-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255 [ 530.271312][ T32] usb 6-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 530.271352][ T32] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 530.271386][ T32] usb 6-1: Product: syz [ 530.271408][ T32] usb 6-1: Manufacturer: syz [ 530.271423][ T32] usb 6-1: SerialNumber: syz [ 530.290181][ T32] usb 6-1: config 0 descriptor?? [ 530.291653][T13285] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 530.292042][T13285] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 530.567136][T13285] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 530.567361][T13285] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 530.963247][T13308] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2741'. [ 531.020467][ T32] asix 6-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 531.020498][ T32] asix 6-1:0.34 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 531.020829][ T32] asix 6-1:0.34: probe with driver asix failed with error -71 [ 531.059336][ T32] usb 6-1: USB disconnect, device number 4 [ 531.705332][T13327] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2750'. [ 532.537337][T13357] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2764'. [ 532.674163][T13364] usbip-vudc usbip-vudc.0: gadget not bound [ 532.808813][T13371] fuse: fd is not a fuse device [ 533.590839][T13387] usbip-vudc usbip-vudc.0: gadget not bound [ 534.771426][T13428] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2795'. [ 535.802251][T13453] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2803'. [ 536.576836][T13461] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2807'. [ 536.576881][T13461] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2807'. [ 536.865205][T13467] usbip-vudc usbip-vudc.0: gadget not bound [ 537.503050][T13484] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2817'. [ 537.503076][T13484] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2817'. [ 537.581586][T13486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2818'. [ 537.581619][T13486] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2818'. [ 537.783645][ T5697] IPVS: starting estimator thread 0... [ 537.871567][T13498] IPVS: using max 4 ests per chain, 9600 per kthread [ 538.407345][ T5697] IPVS: starting estimator thread 0... [ 538.488549][T13517] IPVS: using max 4 ests per chain, 9600 per kthread [ 538.625741][T13531] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2833'. [ 539.515338][ T6011] tipc: Subscription rejected, illegal request [ 539.901542][T13569] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2845'. [ 541.967091][T13642] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2875'. [ 541.967117][T13642] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2875'. [ 545.166364][T13736] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2918'. [ 550.096250][T13858] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2969'. [ 551.825296][T13909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2992'. [ 551.825321][T13909] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2992'. [ 552.315942][T13925] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3000'. [ 552.459534][T13931] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3003'. [ 552.459567][T13931] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3003'. [ 554.817446][T13993] fuse: fd is not a fuse device [ 556.922190][ T4905] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 557.095111][T14066] fuse: fd is not a fuse device [ 559.998821][ T4905] Bluetooth: hci0: unexpected event for opcode 0x0004 [ 560.323362][T14169] picdev_read: 4 callbacks suppressed [ 560.323382][T14169] kvm: pic: non byte read [ 560.323612][T14169] kvm: pic: non byte read [ 560.341183][T14169] kvm: pic: non byte read [ 560.341612][T14169] kvm: pic: non byte read [ 560.341800][T14169] kvm: pic: non byte read [ 560.342726][T14169] kvm: pic: non byte read [ 560.343019][T14169] kvm: pic: non byte read [ 560.344451][T14169] kvm: pic: non byte read [ 560.344720][T14169] kvm: pic: non byte read [ 560.379625][T14169] kvm: pic: non byte read [ 560.971388][ T4905] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 560.971778][ T4905] Bluetooth: hci0: Injecting HCI hardware error event [ 560.985852][ T4905] Bluetooth: hci0: hardware error 0x00 [ 561.549189][T14178] Bluetooth: hci4: unexpected event for opcode 0x0004 [ 562.567376][T14178] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 562.567759][T14178] Bluetooth: hci2: Injecting HCI hardware error event [ 562.571183][T14178] Bluetooth: hci2: hardware error 0x00 [ 562.899185][ T1336] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.899300][ T1336] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.205415][ T4905] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 564.895026][T14178] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 565.060847][T14294] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3144'. [ 565.606680][T14178] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 565.607682][T14178] Bluetooth: hci4: Injecting HCI hardware error event [ 565.618293][T14178] Bluetooth: hci4: hardware error 0x00 [ 566.356574][T14333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3160'. [ 566.491935][T14340] configfs-gadget.g1 gadget.32: Error: no playback and capture channels [ 566.492028][T14340] udc usbip-vudc.0: failed to start g1: -22 [ 566.492042][T14340] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -22 [ 566.492853][T14340] UDC core: g1: couldn't find an available UDC or it's busy [ 567.844716][T14178] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 574.036102][T14551] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3243'. [ 575.884801][T14603] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3262'. [ 578.176033][ T4905] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 578.218339][ T4905] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 578.237118][ T4905] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 578.278260][ T4905] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 578.280023][ T4905] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 580.582705][T14178] Bluetooth: hci3: command tx timeout [ 581.061777][T14737] binder: 14736:14737 ioctl c0306201 0 returned -14 [ 581.644484][T14682] bridge0: port 1(bridge_slave_0) entered blocking state [ 581.644937][T14682] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.645535][T14682] bridge_slave_0: entered allmulticast mode [ 581.649479][T14682] bridge_slave_0: entered promiscuous mode [ 582.006132][T14682] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.006407][T14682] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.006616][T14682] bridge_slave_1: entered allmulticast mode [ 582.010176][T14682] bridge_slave_1: entered promiscuous mode [ 582.539361][ T1351] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 582.644548][T14682] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 582.644694][T14178] Bluetooth: hci3: command tx timeout [ 582.705416][T14682] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 582.948322][T14682] team0: Port device team_slave_0 added [ 582.960700][T14682] team0: Port device team_slave_1 added [ 583.187273][T14796] binder: 14793:14796 ioctl c0306201 0 returned -14 [ 583.414991][ T1351] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 583.670030][T14682] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 583.670044][T14682] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 583.670065][T14682] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 583.697338][T14682] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 583.697388][T14682] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 583.697469][T14682] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 583.977512][ T1351] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.419344][ T1351] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 584.521086][T14682] hsr_slave_0: entered promiscuous mode [ 584.526653][T14682] hsr_slave_1: entered promiscuous mode [ 584.732265][T14178] Bluetooth: hci3: command tx timeout [ 586.086853][T14854] binder: 14852:14854 ioctl c0306201 0 returned -14 [ 586.366979][ T1351] bridge_slave_1: left allmulticast mode [ 586.367016][ T1351] bridge_slave_1: left promiscuous mode [ 586.367308][ T1351] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.561605][ T1351] bridge_slave_0: left allmulticast mode [ 586.561643][ T1351] bridge_slave_0: left promiscuous mode [ 586.577090][ T1351] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.813034][T14178] Bluetooth: hci3: command tx timeout [ 587.722779][ T1351] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 587.802556][ T1351] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 587.828638][ T1351] bond0 (unregistering): Released all slaves [ 588.077887][ T5251] 8021q: adding VLAN 0 to HW filter on device eth17 [ 588.817054][T14901] FAULT_INJECTION: forcing a failure. [ 588.817054][T14901] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 588.817099][T14901] CPU: 1 UID: 0 PID: 14901 Comm: syz.7.3366 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 588.817125][T14901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 588.817142][T14901] Call Trace: [ 588.817226][T14901] [ 588.817296][T14901] dump_stack_lvl+0xe8/0x150 [ 588.817379][T14901] should_fail_ex+0x467/0x600 [ 588.817413][T14901] _copy_from_user+0x2d/0xb0 [ 588.817435][T14901] ___sys_sendmsg+0x1c6/0x360 [ 588.817466][T14901] ? __lock_acquire+0x6df/0x2e40 [ 588.817519][T14901] ? __pfx____sys_sendmsg+0x10/0x10 [ 588.817589][T14901] ? __fget_files+0x2a/0x420 [ 588.817611][T14901] ? __fget_files+0x3a8/0x420 [ 588.817645][T14901] __x64_sys_sendmsg+0x1b7/0x290 [ 588.817690][T14901] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 588.817744][T14901] do_syscall_64+0x17b/0x530 [ 588.817766][T14901] ? irqentry_exit+0x10f/0x8f0 [ 588.817788][T14901] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.817810][T14901] ? clear_bhb_loop+0x40/0x90 [ 588.817836][T14901] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.817890][T14901] RIP: 0033:0x7f5eff16de99 [ 588.817983][T14901] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 588.818034][T14901] RSP: 002b:00007f5efd3c6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 588.818085][T14901] RAX: ffffffffffffffda RBX: 00007f5eff3f5fa0 RCX: 00007f5eff16de99 [ 588.818101][T14901] RDX: 0000000000000000 RSI: 0000200000000740 RDI: 0000000000000003 [ 588.818116][T14901] RBP: 00007f5efd3c6090 R08: 0000000000000000 R09: 0000000000000000 [ 588.818129][T14901] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 588.818142][T14901] R13: 00007f5eff3f6038 R14: 00007f5eff3f5fa0 R15: 00007ffca0ca0778 [ 588.818176][T14901] [ 591.105855][T14964] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 591.151243][T14964] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 591.204293][ T1351] hsr_slave_0: left promiscuous mode [ 591.237836][ T1351] hsr_slave_1: left promiscuous mode [ 591.240324][ T1351] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 591.240351][ T1351] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 591.293742][ T1351] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 591.293771][ T1351] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 591.350272][ T1351] veth1_macvtap: left promiscuous mode [ 591.350351][ T1351] veth0_macvtap: left promiscuous mode [ 591.350692][ T1351] veth1_vlan: left promiscuous mode [ 591.350845][ T1351] veth0_vlan: left promiscuous mode [ 592.292761][ T1351] team0 (unregistering): Port device team_slave_1 removed [ 592.351798][ T1351] team0 (unregistering): Port device team_slave_0 removed [ 594.158733][T15007] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3392'. [ 594.735851][ T1351] IPVS: stop unused estimator thread 0... [ 594.770992][T14682] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 594.882860][T14682] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.902557][T14682] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 595.114045][T14682] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 595.115911][T14682] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 595.163229][T14682] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 595.165212][T14682] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 595.222362][T14682] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 595.934683][T14682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 596.123600][T14682] 8021q: adding VLAN 0 to HW filter on device team0 [ 596.142799][ T5696] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 596.173469][ T1427] bridge0: port 1(bridge_slave_0) entered blocking state [ 596.177339][ T1427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 596.262325][ T1427] bridge0: port 2(bridge_slave_1) entered blocking state [ 596.262499][ T1427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 596.290591][ T5696] usb 6-1: Using ep0 maxpacket: 16 [ 596.295403][ T5696] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 596.295427][ T5696] usb 6-1: config 0 interface 0 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 596.295451][ T5696] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 596.295474][ T5696] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 596.295499][ T5696] usb 6-1: config 0 interface 0 has no altsetting 0 [ 596.362537][ T5696] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 596.362615][ T5696] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.362637][ T5696] usb 6-1: Product: syz [ 596.362652][ T5696] usb 6-1: Manufacturer: syz [ 596.362667][ T5696] usb 6-1: SerialNumber: syz [ 596.412103][ T5696] usb 6-1: config 0 descriptor?? [ 596.432872][T15045] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 596.575054][T15061] netlink: 'syz.7.3400': attribute type 2 has an invalid length. [ 596.575084][T15061] netlink: 16174 bytes leftover after parsing attributes in process `syz.7.3400'. [ 596.697874][T15045] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 596.744326][ T5696] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input9 [ 597.069022][T15045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 597.092333][T15045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 597.453908][ T5696] usb 6-1: USB disconnect, device number 5 [ 597.454023][ C1] synaptics_usb 6-1:0.0: synusb_irq - usb_submit_urb failed with result: -19 [ 598.565593][T15099] FAULT_INJECTION: forcing a failure. [ 598.565593][T15099] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 598.565630][T15099] CPU: 0 UID: 0 PID: 15099 Comm: syz.5.3409 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 598.565654][T15099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 598.565667][T15099] Call Trace: [ 598.565676][T15099] [ 598.565684][T15099] dump_stack_lvl+0xe8/0x150 [ 598.565717][T15099] should_fail_ex+0x467/0x600 [ 598.565750][T15099] _copy_from_user+0x2d/0xb0 [ 598.565772][T15099] ___sys_sendmsg+0x1c6/0x360 [ 598.565805][T15099] ? __lock_acquire+0x6df/0x2e40 [ 598.565830][T15099] ? __pfx____sys_sendmsg+0x10/0x10 [ 598.565905][T15099] ? __fget_files+0x2a/0x420 [ 598.565942][T15099] ? __fget_files+0x3a8/0x420 [ 598.565980][T15099] __x64_sys_sendmsg+0x1b7/0x290 [ 598.566023][T15099] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 598.566103][T15099] do_syscall_64+0x17b/0x530 [ 598.566125][T15099] ? irqentry_exit+0x10f/0x8f0 [ 598.566145][T15099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.566177][T15099] ? clear_bhb_loop+0x40/0x90 [ 598.566202][T15099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.566222][T15099] RIP: 0033:0x7fe5639ede99 [ 598.566243][T15099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.566261][T15099] RSP: 002b:00007fe561c46028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 598.566282][T15099] RAX: ffffffffffffffda RBX: 00007fe563c75fa0 RCX: 00007fe5639ede99 [ 598.566298][T15099] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 598.566311][T15099] RBP: 00007fe561c46090 R08: 0000000000000000 R09: 0000000000000000 [ 598.566323][T15099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 598.566334][T15099] R13: 00007fe563c76038 R14: 00007fe563c75fa0 R15: 00007ffc405dedb8 [ 598.566365][T15099] [ 599.007616][T15106] netlink: 376 bytes leftover after parsing attributes in process `syz.5.3410'. [ 599.407385][T14682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 600.318647][T14682] veth0_vlan: entered promiscuous mode [ 600.383226][T14682] veth1_vlan: entered promiscuous mode [ 600.498481][T14682] veth0_macvtap: entered promiscuous mode [ 600.537507][T14682] veth1_macvtap: entered promiscuous mode [ 600.694538][T15160] 9pnet_fd: p9_fd_create_unix (15160): problem connecting socket: ./file0: -111 [ 600.698287][T14682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 600.771326][T14682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 600.827641][ T1351] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.855995][ T1351] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.905563][ T1351] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.905739][ T1351] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 602.124723][ T1542] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 602.124744][ T1542] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 602.485757][T15187] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3433'. [ 602.537065][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3432'. [ 602.537102][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3432'. [ 602.588692][ T1542] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 602.588714][ T1542] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 602.969749][ T9] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 603.123650][ T9] usb 6-1: unable to get BOS descriptor or descriptor too short [ 603.126587][ T9] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 603.126612][ T9] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 603.182233][ T9] usb 6-1: New USB device found, idVendor=1235, idProduct=821d, bcdDevice= 0.40 [ 603.182266][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.182288][ T9] usb 6-1: Product: Ѕ [ 603.182303][ T9] usb 6-1: Manufacturer: ᛯℭꊷ氂還抖쪨쏼츫垎蝼㦶듔ꐛኾı⿶ꨛ喣㼈뤽펓䈈ᛧ깹ὴ댸娙烃烷凍⊤㝣䂳㦣ᅤ숼෠䇥渐値絡ԯ뢷ℳ◊Ṛษ啗⫞ᮙ䮴鶬쑑ౌꆽ䷼巀촷뤞苇ꊒ㈷꾇€粊盳렲奟曞쁳ཹ䄏Ჳ㙓쬃뤭Ṏ췸붴ᛛ菏ꪸ⏹뼹㰰ⱚ暏䃜↟㛬৸쳇朵⟍롉囏熱䊬 [ 603.182340][ T9] usb 6-1: SerialNumber: И [ 603.606898][ T9] usb 6-1: Focusrite vendor-specific interface not found [ 603.739009][ T9] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 603.755310][ T9] usb 6-1: USB disconnect, device number 6 [ 604.014002][T15068] udevd[15068]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 604.224925][T15210] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3442'. [ 605.389539][ T10] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 605.541543][T15246] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3453'. [ 605.558921][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 605.569772][ T10] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 605.569803][ T10] usb 6-1: config 0 has no interface number 0 [ 605.577778][ T10] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 605.577811][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.577833][ T10] usb 6-1: Product: syz [ 605.577848][ T10] usb 6-1: Manufacturer: syz [ 605.577864][ T10] usb 6-1: SerialNumber: syz [ 605.641907][ T10] usb 6-1: config 0 descriptor?? [ 605.687459][ T10] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 605.884065][ T10] usb 6-1: qt2_attach - failed to power on unit: -71 [ 605.884485][ T10] quatech2 6-1:0.51: probe with driver quatech2 failed with error -71 [ 605.920950][ T10] usb 6-1: USB disconnect, device number 7 [ 606.384830][T15271] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3463'. [ 606.764061][T15279] FAULT_INJECTION: forcing a failure. [ 606.764061][T15279] name failslab, interval 1, probability 0, space 0, times 1 [ 606.764105][T15279] CPU: 0 UID: 0 PID: 15279 Comm: syz.4.3467 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 606.764129][T15279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 606.764142][T15279] Call Trace: [ 606.764150][T15279] [ 606.764159][T15279] dump_stack_lvl+0xe8/0x150 [ 606.764193][T15279] should_fail_ex+0x467/0x600 [ 606.764227][T15279] should_failslab+0xa8/0x100 [ 606.764251][T15279] __kmalloc_noprof+0xfb/0x790 [ 606.764284][T15279] ? kernfs_fop_write_iter+0x158/0x540 [ 606.764313][T15279] ? kernfs_fop_write_iter+0x158/0x540 [ 606.764351][T15279] kernfs_fop_write_iter+0x158/0x540 [ 606.764387][T15279] vfs_write+0x61e/0xbb0 [ 606.764422][T15279] ? __pfx_vfs_write+0x10/0x10 [ 606.764451][T15279] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 606.764475][T15279] ? lockdep_hardirqs_on+0x7a/0x110 [ 606.764500][T15279] ? mutex_lock_nested+0x152/0x1d0 [ 606.764528][T15279] ? fdget_pos+0x252/0x320 [ 606.764561][T15279] ksys_write+0x156/0x270 [ 606.764590][T15279] ? __pfx_ksys_write+0x10/0x10 [ 606.764629][T15279] do_syscall_64+0x17b/0x530 [ 606.764651][T15279] ? irqentry_exit+0x10f/0x8f0 [ 606.764672][T15279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.764696][T15279] ? clear_bhb_loop+0x40/0x90 [ 606.764731][T15279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.764753][T15279] RIP: 0033:0x7f9eb5cfde99 [ 606.764774][T15279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 606.764793][T15279] RSP: 002b:00007f9eb3f56028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 606.764817][T15279] RAX: ffffffffffffffda RBX: 00007f9eb5f85fa0 RCX: 00007f9eb5cfde99 [ 606.764834][T15279] RDX: 000000000000001a RSI: 0000200000000200 RDI: 0000000000000003 [ 606.764848][T15279] RBP: 00007f9eb3f56090 R08: 0000000000000000 R09: 0000000000000000 [ 606.764863][T15279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 606.764876][T15279] R13: 00007f9eb5f86038 R14: 00007f9eb5f85fa0 R15: 00007fff7fcb7bc8 [ 606.764912][T15279] [ 607.211597][T15286] cgroup: Invalid name [ 607.215854][T15286] program syz.4.3468 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 607.512200][T15295] netlink: 56 bytes leftover after parsing attributes in process `syz.5.3473'. [ 607.616853][T15290] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3471'. [ 607.747086][T15298] overlayfs: failed to clone upperpath [ 607.753064][T15296] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3471'. [ 608.230845][T15305] netlink: 'syz.5.3477': attribute type 2 has an invalid length. [ 608.230895][T15305] netlink: 'syz.5.3477': attribute type 8 has an invalid length. [ 608.230917][T15305] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3477'. [ 608.615758][T15312] FAULT_INJECTION: forcing a failure. [ 608.615758][T15312] name failslab, interval 1, probability 0, space 0, times 0 [ 608.615796][T15312] CPU: 1 UID: 0 PID: 15312 Comm: syz.7.3480 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 608.615822][T15312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 608.615836][T15312] Call Trace: [ 608.615845][T15312] [ 608.615854][T15312] dump_stack_lvl+0xe8/0x150 [ 608.615889][T15312] should_fail_ex+0x467/0x600 [ 608.615924][T15312] should_failslab+0xa8/0x100 [ 608.615949][T15312] __kvmalloc_node_noprof+0x176/0x880 [ 608.615986][T15312] ? do_semtimedop+0x1cb/0x3a0 [ 608.616027][T15312] ? do_semtimedop+0x1cb/0x3a0 [ 608.616066][T15312] do_semtimedop+0x1cb/0x3a0 [ 608.616102][T15312] ? __pfx_do_semtimedop+0x10/0x10 [ 608.616193][T15312] ? __pfx_ksys_write+0x10/0x10 [ 608.616241][T15312] do_syscall_64+0x17b/0x530 [ 608.616264][T15312] ? irqentry_exit+0x10f/0x8f0 [ 608.616285][T15312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.616308][T15312] ? clear_bhb_loop+0x40/0x90 [ 608.616341][T15312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.616379][T15312] RIP: 0033:0x7f5eff16de99 [ 608.616400][T15312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 608.616420][T15312] RSP: 002b:00007f5efd3c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000041 [ 608.616444][T15312] RAX: ffffffffffffffda RBX: 00007f5eff3f5fa0 RCX: 00007f5eff16de99 [ 608.616475][T15312] RDX: 00000000000001f4 RSI: 0000200000000200 RDI: 0000000000000000 [ 608.616490][T15312] RBP: 00007f5efd3c6090 R08: 0000000000000000 R09: 0000000000000000 [ 608.616511][T15312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 608.616532][T15312] R13: 00007f5eff3f6038 R14: 00007f5eff3f5fa0 R15: 00007ffca0ca0778 [ 608.616580][T15312] [ 608.917065][T15317] netlink: 56 bytes leftover after parsing attributes in process `syz.6.3483'. [ 609.648899][ T32] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 609.788828][ T5691] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 609.839087][ T32] usb 8-1: Using ep0 maxpacket: 32 [ 609.842871][ T32] usb 8-1: config 0 has an invalid interface number: 132 but max is 0 [ 609.842899][ T32] usb 8-1: config 0 has no interface number 0 [ 609.842961][ T32] usb 8-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 609.847493][ T32] usb 8-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 609.847520][ T32] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.847539][ T32] usb 8-1: Product: syz [ 609.847552][ T32] usb 8-1: Manufacturer: syz [ 609.847566][ T32] usb 8-1: SerialNumber: syz [ 609.919990][ T32] usb 8-1: config 0 descriptor?? [ 609.948323][ T32] em28xx 8-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 609.948456][ T32] em28xx 8-1:0.132: Video interface 132 found: [ 610.030866][ T5691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 610.030920][ T5691] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 610.031118][ T5691] usb 5-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 610.031145][ T5691] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.211598][ T5691] usb 5-1: config 0 descriptor?? [ 610.388229][ T32] em28xx 8-1:0.132: unknown em28xx chip ID (0) [ 610.573221][T15328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.581398][T15328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.716927][ T5691] hid_parser_main: 4 callbacks suppressed [ 610.716990][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717033][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717062][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717091][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717120][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717147][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.717175][ T5691] hid-thrustmaster 0003:044F:B65D.000B: unknown main item tag 0x0 [ 610.835830][ T5691] hid-thrustmaster 0003:044F:B65D.000B: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.4-1/input0 [ 610.836293][ T5691] hid-thrustmaster 0003:044F:B65D.000B: Wrong number of endpoints? [ 610.886046][ C1] hid-thrustmaster 0003:044F:B65D.000B: URB to get model id failed with error -71 [ 610.925444][ T5691] usb 5-1: USB disconnect, device number 5 [ 611.278333][T15341] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3493'. [ 611.323392][T15339] fido_id[15339]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 611.586590][ T32] em28xx 8-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 611.586757][ T32] em28xx 8-1:0.132: board has no eeprom [ 611.668878][ T32] em28xx 8-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 611.668980][ T32] em28xx 8-1:0.132: analog set to bulk mode. [ 611.669448][ T5691] em28xx 8-1:0.132: Registering V4L2 extension [ 611.793902][ T32] usb 8-1: USB disconnect, device number 2 [ 611.796599][ T32] em28xx 8-1:0.132: Disconnecting em28xx [ 612.260160][ T5691] em28xx 8-1:0.132: Config register raw data: 0xffffffed [ 612.260218][ T5691] em28xx 8-1:0.132: AC97 chip type couldn't be determined [ 612.260233][ T5691] em28xx 8-1:0.132: No AC97 audio processor [ 612.468486][ T5697] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 612.567503][ T5691] usb 8-1: Decoder not found [ 612.567562][ T5691] em28xx 8-1:0.132: failed to create media graph [ 612.567683][ T5691] em28xx 8-1:0.132: V4L2 device video103 deregistered [ 612.665936][ T5691] INFO: trying to register non-static key. [ 612.666022][ T5691] The code is fine but needs lockdep annotation, or maybe [ 612.666022][ T5691] The code is fine but needs lockdep annotation, or maybe [ 612.666030][ T5691] you didn't initialize this object before use? [ 612.666083][ T5691] turning off the locking correctness validator. [ 612.666129][ T5691] CPU: 1 UID: 0 PID: 5691 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 612.666154][ T5691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 612.666168][ T5691] Workqueue: events request_module_async [ 612.666223][ T5691] Call Trace: [ 612.666245][ T5691] [ 612.666261][ T5691] dump_stack_lvl+0xe8/0x150 [ 612.666304][ T5691] assign_lock_key+0x133/0x150 [ 612.666342][ T5691] register_lock_class+0xcc/0x2e0 [ 612.666379][ T5691] __lock_acquire+0xaf/0x2e40 [ 612.666414][ T5691] ? ret_from_fork_asm+0x1a/0x30 [ 612.666452][ T5691] ? stack_trace_save+0xa9/0x100 [ 612.666483][ T5691] ? __pfx_stack_trace_save+0x10/0x10 [ 612.666519][ T5691] lock_acquire+0x115/0x350 [ 612.666572][ T5691] ? __wake_up_common_lock+0x2f/0x1f0 [ 612.666629][ T5691] rt_spin_lock+0x83/0x400 [ 612.666663][ T5691] ? __wake_up_common_lock+0x2f/0x1f0 [ 612.666693][ T5691] ? __pfx_rt_spin_lock+0x10/0x10 [ 612.666732][ T5691] __wake_up_common_lock+0x2f/0x1f0 [ 612.666786][ T5691] __vb2_queue_cancel+0x2de/0xdc0 [ 612.666838][ T5691] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 612.666879][ T5691] ? lockdep_hardirqs_on+0x7a/0x110 [ 612.666912][ T5691] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 612.666979][ T5691] vb2_core_queue_release+0x2f/0x150 [ 612.667041][ T5691] vb2_video_unregister_device+0x15b/0x200 [ 612.667077][ T5691] em28xx_v4l2_init+0x1c60/0x3140 [ 612.667107][ T5691] em28xx_init_extension+0x120/0x1d0 [ 612.667165][ T5691] ? process_one_work+0x7fd/0x1480 [ 612.667215][ T5691] process_one_work+0xaaf/0x1480 [ 612.667269][ T5691] ? irqentry_exit+0x218/0x8f0 [ 612.667299][ T5691] ? __pfx_process_one_work+0x10/0x10 [ 612.667320][ T5691] ? do_raw_spin_lock+0x12b/0x2f0 [ 612.667358][ T5691] ? assign_work+0x3cf/0x5d0 [ 612.667406][ T5691] worker_thread+0xb05/0x10d0 [ 612.667449][ T5691] kthread+0x388/0x470 [ 612.667475][ T5691] ? __pfx_worker_thread+0x10/0x10 [ 612.667502][ T5691] ? __pfx_kthread+0x10/0x10 [ 612.667519][ T5697] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 612.667527][ T5691] ret_from_fork+0x514/0xb70 [ 612.667555][ T5691] ? __pfx_ret_from_fork+0x10/0x10 [ 612.667561][ T5697] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 612.667581][ T5691] ? __switch_to+0xc89/0x1420 [ 612.667588][ T5697] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 612.667604][ T5691] ? __pfx_kthread+0x10/0x10 [ 612.667610][ T5697] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196 [ 612.667630][ T5691] ret_from_fork_asm+0x1a/0x30 [ 612.667647][ T5697] usb 5-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 612.667664][ T5691] [ 612.667670][ T5697] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.667740][ T5691] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 612.667876][ T5691] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 612.667899][ T5691] CPU: 1 UID: 0 PID: 5691 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 612.667921][ T5691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 612.667934][ T5691] Workqueue: events request_module_async [ 612.667956][ T5691] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 612.667986][ T5691] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 612.668003][ T5691] RSP: 0018:ffffc90005f6f908 EFLAGS: 00010246 [ 612.668020][ T5691] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 612.668032][ T5691] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 612.668046][ T5691] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 612.668058][ T5691] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88805e819b14 [ 612.668072][ T5691] R13: ffff88805e819c28 R14: 0000000000000000 R15: 0000000000000000 [ 612.668085][ T5691] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 612.668101][ T5691] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 612.668115][ T5691] CR2: 0000001b31723ffc CR3: 000000002a638000 CR4: 00000000003526f0 [ 612.668131][ T5691] DR0: 0000000000000000 DR1: 0000000000006800 DR2: 0000000000009951 [ 612.668144][ T5691] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 612.668158][ T5691] Call Trace: [ 612.668172][ T5691] [ 612.668194][ T5691] __vb2_queue_cancel+0x2de/0xdc0 [ 612.668230][ T5691] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 612.668262][ T5691] ? lockdep_hardirqs_on+0x7a/0x110 [ 612.668288][ T5691] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 612.668320][ T5691] vb2_core_queue_release+0x2f/0x150 [ 612.668359][ T5691] vb2_video_unregister_device+0x15b/0x200 [ 612.668412][ T5691] em28xx_v4l2_init+0x1c60/0x3140 [ 612.668442][ T5691] em28xx_init_extension+0x120/0x1d0 [ 612.668486][ T5691] ? process_one_work+0x7fd/0x1480 [ 612.668506][ T5691] process_one_work+0xaaf/0x1480 [ 612.668524][ T5691] ? irqentry_exit+0x218/0x8f0 [ 612.668551][ T5691] ? __pfx_process_one_work+0x10/0x10 [ 612.668569][ T5691] ? do_raw_spin_lock+0x12b/0x2f0 [ 612.668597][ T5691] ? assign_work+0x3cf/0x5d0 [ 612.668618][ T5691] worker_thread+0xb05/0x10d0 [ 612.668668][ T5691] kthread+0x388/0x470 [ 612.668696][ T5691] ? __pfx_worker_thread+0x10/0x10 [ 612.668717][ T5691] ? __pfx_kthread+0x10/0x10 [ 612.668745][ T5691] ret_from_fork+0x514/0xb70 [ 612.668774][ T5691] ? __pfx_ret_from_fork+0x10/0x10 [ 612.668802][ T5691] ? __switch_to+0xc89/0x1420 [ 612.668827][ T5691] ? __pfx_kthread+0x10/0x10 [ 612.668853][ T5691] ret_from_fork_asm+0x1a/0x30 [ 612.668888][ T5691] [ 612.668901][ T5691] Modules linked in: [ 612.669001][ T5691] ---[ end trace 0000000000000000 ]--- [ 612.677049][T15372] ------------[ cut here ]------------ [ 612.677088][T15372] mas->ld_seq != lock_sequence(map) [ 612.677119][T15372] WARNING: lib/maple_tree.c:1188 at mas_find+0xa02/0xca0, CPU#0: syz.5.3502/15372 [ 612.677221][T15372] Modules linked in: [ 612.677261][T15372] CPU: 0 UID: 0 PID: 15372 Comm: syz.5.3502 Tainted: G D syzkaller #0 PREEMPT_{RT,(full)} [ 612.677351][T15372] Tainted: [D]=DIE [ 612.677377][T15372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 612.677435][T15372] RIP: 0010:mas_find+0xa02/0xca0 [ 612.677502][T15372] Code: 74 08 4c 89 f7 e8 5e 39 e9 f6 49 c7 06 ff ff ff ff 31 c0 e9 16 fd ff ff e8 7b e1 7c f6 31 c0 e9 0a fd ff ff e8 6f e1 7c f6 90 <0f> 0b 90 e9 65 f7 ff ff e8 61 e1 7c f6 31 c0 e9 f0 fc ff ff e8 55 [ 612.677555][T15372] RSP: 0018:ffffc90007127778 EFLAGS: 00010293 [ 612.677606][T15372] RAX: ffffffff8b48c241 RBX: 1ffff92000e24f29 RCX: ffff88803a599f40 [ 612.677649][T15372] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 612.677690][T15372] RBP: 0000000000000030 R08: 0000000000000000 R09: 0000000000000000 [ 612.677724][T15372] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: 00000000ffffffff [ 612.677781][T15372] R13: ffffc90007127954 R14: ffffc90007127900 R15: ffffc90007127948 [ 612.677823][T15372] FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000 [ 612.677872][T15372] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 612.677927][T15372] CR2: 00007f3a2a5d7a90 CR3: 000000003baa8000 CR4: 00000000003526f0 [ 612.677973][T15372] DR0: 0000000000000000 DR1: 0000000000006800 DR2: 0000000000009951 [ 612.678000][T15372] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 612.678046][T15372] Call Trace: [ 612.678073][T15372] [ 612.678105][T15372] tear_down_vmas+0x339/0x520 [ 612.678337][T15372] exit_mmap+0x4ca/0x9f0 [ 612.678428][T15372] ? __pfx_exit_mmap+0x10/0x10 [ 612.678509][T15372] ? do_raw_spin_lock+0x12b/0x2f0 [ 612.678601][T15372] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 612.678665][T15372] ? __pfx_exit_aio+0x10/0x10 [ 612.678756][T15372] ? uprobe_clear_state+0x2a7/0x3e0 [ 612.678848][T15372] __mmput+0xcb/0x3e0 [ 612.678902][T15372] exit_mm+0x186/0x240 [ 612.678984][T15372] do_exit+0x6cd/0x2360 [ 612.679057][T15372] ? lockdep_hardirqs_on+0x7a/0x110 [ 612.679115][T15372] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 612.679176][T15372] ? __pfx_do_exit+0x10/0x10 [ 612.679281][T15372] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 612.679400][T15372] ? rt_spin_unlock+0x157/0x200 [ 612.679481][T15372] do_group_exit+0x22d/0x2f0 [ 612.679561][T15372] ? rt_spin_unlock+0x163/0x200 [ 612.679634][T15372] get_signal+0x121b/0x12c0 [ 612.679718][T15372] arch_do_signal_or_restart+0xbb/0x860 [ 612.679802][T15372] ? put_timespec64+0xd8/0x130 [ 612.679863][T15372] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 612.679965][T15372] exit_to_user_mode_loop+0x104/0x730 [ 612.680056][T15372] ? rcu_is_watching+0x15/0xb0 [ 612.680120][T15372] do_syscall_64+0x33d/0x530 [ 612.680180][T15372] ? irqentry_exit+0x10f/0x8f0 [ 612.680249][T15372] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.680303][T15372] ? clear_bhb_loop+0x40/0x90 [ 612.680366][T15372] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.680431][T15372] RIP: 0033:0x7fe5639ede99 [ 612.680484][T15372] Code: Unable to access opcode bytes at 0x7fe5639ede6f. [ 612.680577][T15372] RSP: 002b:00007fe561c460e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 612.680631][T15372] RAX: fffffffffffffe00 RBX: 00007fe563c75fa8 RCX: 00007fe5639ede99 [ 612.680687][T15372] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe563c75fa8 [ 612.680750][T15372] RBP: 00007fe563c75fa0 R08: 0000000000000000 R09: 0000000000000000 [ 612.680796][T15372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 612.680835][T15372] R13: 00007fe563c76038 R14: 00007ffc405decd0 R15: 00007ffc405dedb8 [ 612.680897][T15372] [ 612.680927][T15372] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 612.681526][T15372] Kernel Offset: disabled