last executing test programs: 2m2.63565455s ago: executing program 3 (id=19): syz_emit_vhci(&(0x7f0000000180)=@HCI_EVENT_PKT={0x4, @inquiry_info_with_rssi={{0x22, 0x1d}, {0x2, [{@none, 0x2, 0x81, "1b4513", 0x1, 0xe2}, {@none, 0x9, 0x4, '{C9', 0x5, 0x6}]}}}, 0x20) 2m2.393812587s ago: executing program 3 (id=24): semctl$SETALL(0x0, 0x0, 0x11, &(0x7f0000000180)=[0x7, 0xfff9, 0x3]) 2m2.358844559s ago: executing program 1 (id=25): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x8}, [@ldst={0x3, 0x3, 0x3, 0x1c10a1, 0x0, 0x98}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xf7}, 0x48) 2m2.111287556s ago: executing program 3 (id=27): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000680)={'lo\x00', &(0x7f0000000080)=@ethtool_cmd={0xa, 0x2000, 0x3, 0xfffe, 0x4, 0x2, 0x0, 0xff, 0x0, 0xc, 0x20000000, 0x7882, 0x0, 0x1, 0x1, 0x6, [0x0, 0x80000000]}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000b80)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SIOCSIFHWADDR(r4, 0x8b26, &(0x7f0000000000)={'wlan1\x00'}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x25dfdbfd, {{0x2}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x177f}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x4011}, 0x20004810) 2m1.421138328s ago: executing program 1 (id=30): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) pipe2$9p(&(0x7f0000001900), 0x0) mprotect(&(0x7f0000916000/0x2000)=nil, 0x2000, 0x1) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r4, r4, r4}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={'streebog256\x00'}}) 2m1.419979288s ago: executing program 3 (id=31): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b1052, 0x0) unshare(0x2a060400) mount$bind(0x0, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2020) 2m1.128775107s ago: executing program 3 (id=33): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x709f, 0x6361, 0x8, 0xc, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40804) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56561, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x2, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@getqdisc={0x24, 0x26, 0x1, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r10, {0xfff1, 0xffe0}, {0xf, 0xd}, {0xffe0, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x0) 2m0.38995581s ago: executing program 1 (id=35): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000240)={0x2, &(0x7f00000001c0)=[{0x20, 0xff, 0x3f, 0xfffff004}, {0x16, 0x4, 0x2, 0xfffffffe}]}) 1m59.941289184s ago: executing program 3 (id=37): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200400dc}, 0x0) 1m59.840119447s ago: executing program 32 (id=37): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x200400dc}, 0x0) 1m58.46453171s ago: executing program 1 (id=43): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b1052, 0x0) unshare(0x2a060400) mount$bind(0x0, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f0000002380)={0x2020}, 0x2020) 1m58.359500244s ago: executing program 1 (id=44): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000140)=r0) 1m57.424212623s ago: executing program 1 (id=46): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x100, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000016c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xb, 0x8, 0x9}, {0x4, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0x7, 0x8, 0x0, 0x0, 0x1fffffff}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000300)={r2, r0}, 0xc) getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) socket(0x1e, 0x805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r5, 0x3) accept4$bt_l2cap(r5, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$TIOCSETD(r6, 0x5423, 0x0) 1m57.287493307s ago: executing program 33 (id=46): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x100, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000016c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xb, 0x8, 0x9}, {0x4, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0x7, 0x8, 0x0, 0x0, 0x1fffffff}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000300)={r2, r0}, 0xc) getdents64(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) socket(0x1e, 0x805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r5, 0x3) accept4$bt_l2cap(r5, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$TIOCSETD(r6, 0x5423, 0x0) 7.99502117s ago: executing program 6 (id=729): r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_MODULATOR(r0, 0xc0445636, &(0x7f0000000040)={0x6, "9ab868af49f599a34ac3d487c303daad9866b72a58f91bf394050b6475cafc2c", 0x100, 0x7, 0x0, 0x2, 0x2}) r1 = semget$private(0x0, 0x6, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$cont(0x1f, r2, 0x200, 0xfffffffffffffffe) semtimedop(r1, &(0x7f00000003c0)=[{0x2, 0x4, 0x1800}], 0x1, 0x0) semop(r1, &(0x7f00000000c0)=[{0x4}, {0x2}], 0x2) semctl$GETZCNT(r1, 0x0, 0xf, &(0x7f0000001280)=""/4096) semop(r1, &(0x7f0000001240)=[{0x0, 0xffff, 0x1000}], 0x1) semtimedop(r1, &(0x7f0000000100)=[{0x3, 0x8000}], 0x1, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000140)={r0, 0x9, 0x3, 0xbcbf}) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000000)) 7.684236659s ago: executing program 6 (id=731): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_usb_connect$uac3(0x5, 0x89, &(0x7f0000000600)=ANY=[@ANYBLOB="1201010200000010e8092100400001020301090277"], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000740)='westwood', 0x8) sendmmsg$inet(r0, &(0x7f00000024c0)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000180)="cb", 0x1}], 0x1}}], 0x1, 0x2090) 6.456318128s ago: executing program 6 (id=735): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_UPDATE_FT_IES(0xffffffffffffffff, 0x0, 0x8811) socket$inet_sctp(0x2, 0x1, 0x84) close(0x3) 6.169320377s ago: executing program 6 (id=742): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000200)=ANY=[@ANYBLOB="12011001000000108a25330000000000000109022d000100000000090400060103000100092104000e0122280009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="00073f0000003f31f70ba381030000000000000000cb4fdca056905da3a73fdc623bd4"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 3.957266216s ago: executing program 6 (id=756): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000000)=0x200000ff, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 3.955720976s ago: executing program 0 (id=757): r0 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@remote, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x0, 0x4e20, 0x0, 0x2, 0x0, 0x0, 0x16}, {0x0, 0x4, 0x1, 0x0, 0x0, 0x9}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x4, 0x1, 0x1, 0x0, 0x1, 0x1}, {{@in=@empty, 0x1, 0x32}, 0xa, @in=@local, 0x3102, 0x1, 0x0, 0x0, 0x6, 0xfffffffd}}, 0xe8) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) getpid() timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) msgsnd(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="02"], 0x401, 0x0) 3.913674548s ago: executing program 0 (id=758): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000240), r0) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) 3.846713099s ago: executing program 0 (id=759): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x2, 0x5, 0x9, 0x7, 0xc, 0x2, 0x4, 0x2, 0xf, 0x6, 0x0, 0x2, 0x0, 0x6, 0x4, 0x4], 0x3, [0x8b, 0x101, 0x200, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xfffe, 0xfff5, 0x3, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x8, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 3.764239232s ago: executing program 6 (id=760): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120100001d9167204f17316a3f26010203010902120001000000000904"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 3.111182893s ago: executing program 0 (id=761): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="6880a642beaf34317f0dd3122a90", 0xe}], 0x1}, 0x20000840) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) 3.055422364s ago: executing program 5 (id=763): r0 = userfaultfd(0x80001) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x1) recvmsg$unix(0xffffffffffffffff, 0x0, 0x60000021) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2e8}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}, 0x1}) 2.948382768s ago: executing program 5 (id=764): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd00, 0xfbfffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x0, 0x0, 0x4, 0x4, 0x7, 0x8000, 0x1, 0x0, 0x0, 0xf0ee, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000002f00090027bd70000000000004"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x80000) 2.87232042s ago: executing program 5 (id=768): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000002200)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0x0, 0x4c, 0x1a, 0x0, 0x73, 0x390, 0x258, 0x258, 0x390, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'rose0\x00', 'macvlan1\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00', 0xa, {{}, {0x0, 0x0, 0x5}}}}, {{@uncond, 0x0, 0xd0, 0x108, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x2}, {}, {}, 0xfffffffd}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) sendfile(r5, r4, 0x0, 0x20fffe82) 2.692229156s ago: executing program 2 (id=771): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x2, 0x5, 0x9, 0x7, 0xc, 0x2, 0x4, 0x2, 0xf, 0x6, 0x0, 0x2, 0x0, 0x6, 0x4, 0x4], 0x3, [0x8b, 0x101, 0x200, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xfffe, 0xfff5, 0x3, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x8, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 2.034399166s ago: executing program 2 (id=772): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc080}, 0x4040) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) 1.979628149s ago: executing program 5 (id=773): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$PPPIOCGFLAGS1(0xffffffffffffffff, 0x8004745a, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7c, 0x0, &(0x7f0000000280)="87466f9cd4b3ff0ecf976ef31519f737a47ba037e130bbf9db180e02dcb01397666e1ac5715214921d5d450600c2db066013a545d6cee9aac75c5eae28e48b446148c10262d2a84365420e2e0f55c37c72979d0a4a21831bfba7a8f9a23f535064f30ef186005e8e20ddeca95f2f6362733a3eed8ca270d9b63bec8e", 0x2, 0x0, 0x4}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b18, &(0x7f0000000000)={'wlan0\x00'}) 1.92019017s ago: executing program 2 (id=774): syz_emit_vhci(0x0, 0xf8) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time\x00', 0x275a, 0x0) write$uinput_user_dev(r2, &(0x7f0000000f80)={'syz0\x00', {0x5, 0xfff7, 0x3, 0x7}, 0x50, [0x800006, 0x9, 0x0, 0x1, 0x8, 0xea45, 0xe, 0x1, 0x63, 0x0, 0x7f, 0xc, 0x4, 0x8, 0x1, 0x4, 0x8001000, 0x80000002, 0x1, 0x200008, 0x40, 0xa4d, 0x3ff, 0x5, 0x6, 0x10001, 0xffff, 0x0, 0x4, 0x6, 0x401, 0x100, 0x9, 0x4, 0x2, 0x0, 0x2, 0x4, 0x1, 0x4, 0xa, 0x6, 0x3, 0x9, 0x804d7f, 0x2, 0x8c00, 0x6, 0x939, 0x5, 0x9, 0x2, 0x2, 0x8, 0xfffffff7, 0x7fff, 0x6, 0x5, 0x80000001, 0xd77, 0x5, 0x2a, 0x1, 0x23], [0x8, 0x401, 0x9, 0x9, 0x8, 0x12, 0x7fc, 0xc, 0x0, 0x2729, 0xfd8, 0x6010, 0x7, 0x5, 0x0, 0x24a, 0x2, 0xfffffff7, 0x2, 0x3, 0x5, 0x4009, 0x401, 0xb, 0x8001, 0x40, 0xa1, 0x10000, 0xffffffff, 0x5, 0x10004, 0x9e, 0x8, 0x7ff, 0x4, 0x7, 0x0, 0x6, 0xffff3f16, 0xa, 0x2, 0x9, 0xa, 0x5, 0xfffffeff, 0x9, 0x800, 0x5, 0xc5, 0x3, 0x1, 0x9, 0x8, 0x3, 0xffff7ff7, 0x3, 0x24c, 0x1ff, 0x2a0, 0x5, 0x6, 0x6, 0x200007, 0x8], [0x2, 0x9, 0x1a9e1bfa, 0xfffffffc, 0x8, 0x9, 0x2, 0x5, 0x7aae, 0x80000000, 0x2, 0x7ffffff7, 0x8000, 0x1, 0x1, 0x5, 0x400, 0x80000002, 0x2b0, 0xfffffff4, 0x97f82544, 0x8, 0xfffffffd, 0x0, 0x1, 0x5, 0x4, 0x9, 0xc90, 0xffffff3c, 0xd, 0x3, 0x4, 0xff, 0x140, 0x4, 0x2, 0x1000000c, 0x0, 0x2, 0x3, 0x8007c12, 0x5, 0x1, 0x17, 0x8000, 0xe, 0xf3, 0x4, 0x8, 0x1, 0xffffff00, 0x100, 0x1fff80, 0x3, 0x0, 0x8, 0xdd, 0x1, 0x1400, 0xc3, 0x20ffff, 0x79c], [0x9, 0x3a8e, 0xffff9a7f, 0x200, 0x6, 0x2001, 0x6, 0xfffffff3, 0xd077, 0x2, 0xffffffff, 0x21, 0x200, 0xa, 0x6, 0x2, 0x1ff, 0xfe, 0x2, 0x66608000, 0x5e82, 0x7fb, 0x6, 0x0, 0x3, 0x5, 0x80000001, 0xffff, 0xd, 0x40, 0xfffffffd, 0x3, 0x10001, 0x61, 0x10, 0x1000, 0xc, 0x100, 0x8, 0x20000000, 0x8, 0x15, 0xb32a, 0xec000000, 0x8001, 0x1900, 0x4, 0xc, 0x8, 0x7ff, 0x280, 0x5, 0xffffffff, 0x7, 0x6e79, 0x0, 0xc, 0x9371, 0x4f89, 0x7, 0xf, 0x2d1, 0x83, 0x8]}, 0x45c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x4, 0xffffffffffffffff, 0x0, 0x0, 'syz0\x00', 0x0}) 1.91986696s ago: executing program 4 (id=775): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x109d02, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f000001e000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000000)="f00fc7484d36f08266060266b9800000c00f326635000400000f308bc1de780066b9aa0200000f3266b9ab0900000f32f2f031b3e759dc2c", 0x38}], 0x1, 0x9f6a364b3fac2a63, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.844081453s ago: executing program 2 (id=776): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, 0x0) 1.773761205s ago: executing program 4 (id=777): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x4, @empty, 0x2, 0x3}, 0x20) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100050005000700000000000800090003e400001400200000000000000000000000e1ffe000000108000a0000000000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) 1.700227667s ago: executing program 4 (id=778): msgrcv(0x0, 0x0, 0x0, 0x2, 0x7000) 1.061664247s ago: executing program 2 (id=779): pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) connect$inet(r1, &(0x7f00000006c0)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) sendmmsg$inet(r1, &(0x7f0000000f00)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000080)="b5", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002dc0)=[{&(0x7f0000000a40)="db", 0x1}, {0x0}], 0x2}}], 0x2, 0x4008440) 1.023248418s ago: executing program 5 (id=780): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00220f00"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGNAME(r1, 0x80404806, &(0x7f0000000040)) 972.23439ms ago: executing program 4 (id=781): syz_mount_image$vfat(&(0x7f0000001800), &(0x7f0000000080)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="00631dda01aef2b0bad477a11d13ec0c19456795dd9b2620df1c0f624854ea3dd5a00bd6df44035f5c3ae796fec6d633a0ffad0569794acfef7da01767fd4175f2cd82df769aa2ee7bfe3640554507d24c60c9f9e222a72e1e3e71145c480657d2864e5e276f028d64701ae31cde0ceaf408fdb05c0f4142da00e9000001001d0149e6d308cbe315789f4baffe39bbced9b1d4db174c6121d2e290e9fc561a62225f002ee310e1fa7321000000000000d6231001a4b2d467825f3abb0c167e129cf1fa0e7854103f4bf2d3a0194983bc86cbd3d75ccef3c8ac4516dac10222664bbc980b4e99027c53ae2c6cc05d3be246e5837cbf286225d43e8c1d2e3fda86b86906b79fdedae7f3bbe362e8ad7f2b370442013de1788be93a3d553c2e1f5b559393d964df51bf393f52ecbe6f832b222231fbb9fee9e0343c2d3d567f7cff6d0b25303bcbcc99c879d3bc"], 0x4, 0x279, &(0x7f0000000380)="$eJzs281qE18Yx/FfX/59/bcTrVZbER90o5uhjVcQSgtiQKmN+ALC1E40ZJqUTKhExHbn1usoLt0J4g104xW4cNeNyy7EkU5im7QpvoAZNd/P5jzl9Jecw3MGziKzc+flajEfunmvqt4eU780oF0ppV71qa6nMfbG9YCaberKRPbD+Vt3713PZLPzi2YLmaWraTMbv/D2ybNXF99VR2+/Hn8zqO3Ug51P6Y/bk9tTO1+WHhdCK4RWKlfNs+VyueotB76tFMKia3Yz8L3Qt0Ip9Cst8/mgvLZWM6+0MjayVvHD0LxSzYp+zaplq1Zq5j3yCiVzXdfGRoTvyW0tLnqZpFeB36tSyXhzkqaPzOS2ElkQAABIVJv7/yb3/27B/b8b7N3/7zee31bc/wEAAAAAAAAAAAAAAAAAAAAA+BvsRpETRZHzbfxPit/wiRp/D0sakTQq6X9JY5LGJTmSUpJOSDopaULSKUmnJU1KOiPprKSpps9Keq846rj+99H/rsDz393of3drenF3SFp9sZ5bz9XH+nwmr4IC+ZqRo89xLxvq9cK17PyMxVI6t7rRyG+s5/pa87Ny9g5Mu/xsPW+t+cH43O3n03L2Dli7fLptfkiXLzXlXTl6/1BlBVqJz+RB/vms2dyN7KH8dPx//zrX9rXtn+seN1/P/8D5iGba9qdf0/3J7h1SWHta9ILAr3SwGE7iSyl+sdCfsQyKTvcdXeCg6UmvBAAAAAAAAAAAAAAAAADwMzrxc8Kk9wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwGFfAwAA///eJF68") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) ftruncate(r0, 0x81ff) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x824851, 0x0, 0x1, 0x0, &(0x7f0000000d40)) 962.84833ms ago: executing program 2 (id=782): connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0xc12, 0x30, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x30, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x1, 0x1, {0x22, 0x2c}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, &(0x7f0000000100)={0x20, 0xc, 0x2c, {0x2c, 0x23, "e75bcf47a88a34d2dd23ee248c36105a7e746fb14005902f6b7103bd4f114e1f79d4873562bf95562a60"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 485.162805ms ago: executing program 5 (id=783): syz_usb_connect$midi(0x5, 0x32, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x15ca, 0x1806, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x2, 0x80, 0x6, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x20, 0x2, [], [{{0x9, 0x5, 0xe, 0x2, 0x10, 0x6, 0x7, 0x8, {0x5, 0x25, 0x1, 0x1, "11"}}}]}}}}}]}}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0}) 294.418541ms ago: executing program 0 (id=784): socket$can_j1939(0x1d, 0x2, 0x7) socket$alg(0x26, 0x5, 0x0) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, &(0x7f0000000240)={{0x1, 0x1, 0x18, r3}, './file0/file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189378, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) 204.344774ms ago: executing program 0 (id=785): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) 83.085608ms ago: executing program 4 (id=786): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r0, 0x1) ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, 0x0) 0s ago: executing program 4 (id=787): write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040)='FROZEN\x00', 0x7) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) kernel console output (not intermixed with test programs): 53.777801][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 53.785847][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.794855][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.803147][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.810234][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.821908][ T4190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.854029][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 53.862720][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.879224][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.886340][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.901586][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 53.911235][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 53.921547][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.930547][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.940497][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.947594][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.957433][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 53.970130][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 53.978980][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 53.994250][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.003457][ T4199] device veth0_macvtap entered promiscuous mode [ 54.014634][ T4199] device veth1_macvtap entered promiscuous mode [ 54.058500][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 54.068117][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 54.076985][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.086919][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 54.095923][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.105285][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.114182][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.122631][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.131229][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.141292][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.149558][ T4234] Bluetooth: hci3: command 0x041b tx timeout [ 54.151762][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 54.155835][ T4234] Bluetooth: hci2: command 0x041b tx timeout [ 54.169419][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.169600][ T4234] Bluetooth: hci1: command 0x041b tx timeout [ 54.179270][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 54.183890][ T4234] Bluetooth: hci0: command 0x041b tx timeout [ 54.194041][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.197932][ T4234] Bluetooth: hci4: command 0x041b tx timeout [ 54.209904][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.218936][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.227326][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.242115][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.257690][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.285904][ T4190] device veth0_vlan entered promiscuous mode [ 54.292474][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.302247][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.311459][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.320335][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.329210][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 54.337703][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 54.346146][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 54.354804][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 54.362943][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.370476][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.378051][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.388518][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 54.408678][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 54.418110][ T4189] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 54.438234][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 54.447977][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 54.468158][ T4199] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.484148][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 54.500815][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 54.521922][ T4190] device veth1_vlan entered promiscuous mode [ 54.542480][ T4199] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.566899][ T4199] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.586520][ T4199] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.605117][ T4199] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.616397][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 54.626709][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 54.635722][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 54.681591][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 54.705750][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 54.714875][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.722367][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.737354][ T4192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 54.752267][ T4191] device veth0_vlan entered promiscuous mode [ 54.762422][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 54.770186][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 54.780021][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 54.790559][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 54.804610][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 54.812066][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 54.822828][ T4191] device veth1_vlan entered promiscuous mode [ 54.836190][ T4189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 54.873688][ T4190] device veth0_macvtap entered promiscuous mode [ 54.887465][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 54.902540][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 54.913837][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 54.922022][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 54.931180][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 54.985334][ T4190] device veth1_macvtap entered promiscuous mode [ 54.995239][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 55.010067][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 55.020327][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.035195][ T4191] device veth0_macvtap entered promiscuous mode [ 55.044674][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.052987][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.062359][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 55.072871][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 55.082490][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 55.091061][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 55.110416][ T4191] device veth1_macvtap entered promiscuous mode [ 55.123651][ T4192] device veth0_vlan entered promiscuous mode [ 55.130727][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 55.140130][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.148468][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.176236][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.189528][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.200914][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.217282][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.228271][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.238670][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.249756][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.260605][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.271652][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.280658][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.289790][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.298649][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.309465][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.320215][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.331546][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.344647][ T4190] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.353462][ T4190] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.362141][ T4190] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.371141][ T4190] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.384214][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.396155][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.406164][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.416631][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.429479][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.437113][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.445915][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.455415][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.464956][ T1176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 55.475327][ T4192] device veth1_vlan entered promiscuous mode [ 55.495981][ T4257] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.508073][ T4191] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.518578][ T4257] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.531275][ T4191] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.540063][ T4191] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.548827][ T4191] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 55.559449][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 55.568545][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 55.576669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 55.587345][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 55.596338][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 55.658159][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 55.667589][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 55.682810][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.691346][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.716991][ T4189] device veth0_vlan entered promiscuous mode [ 55.725831][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 55.740740][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.816908][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.848501][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.886267][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 55.901650][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 55.918416][ T4189] device veth1_vlan entered promiscuous mode [ 55.930322][ T4192] device veth0_macvtap entered promiscuous mode [ 55.941205][ T4192] device veth1_macvtap entered promiscuous mode [ 55.957799][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.968285][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.979576][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.990770][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.001012][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 56.069631][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.130802][ T4270] loop3: detected capacity change from 0 to 512 [ 56.192273][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 56.315662][ T4270] EXT4-fs (loop3): revision level too high, forcing read-only mode [ 56.323709][ T4270] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 56.331818][ T4270] System zones: 0-1, 15-15, 18-18, 34-34 [ 56.338743][ T4270] EXT4-fs (loop3): orphan cleanup on readonly fs [ 56.345345][ T4270] Quota error (device loop3): v2_read_header: Failed header read: expected=8 got=0 [ 56.355221][ T4270] EXT4-fs warning (device loop3): ext4_enable_quotas:6488: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 56.369810][ T4270] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 56.381337][ T4270] EXT4-fs error (device loop3): ext4_orphan_get:1432: comm syz.3.4: bad orphan inode 16 [ 56.393341][ T4270] ext4_test_bit(bit=15, block=18) = 1 [ 56.398725][ T4270] is_bad_inode(inode)=0 [ 56.403074][ T4270] NEXT_ORPHAN(inode)=0 [ 56.407241][ T4270] max_ino=32 [ 56.410435][ T4270] i_nlink=2 [ 56.413673][ T4270] EXT4-fs (loop3): mounted filesystem without journal. Opts: resgid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 56.444369][ T4236] Bluetooth: hci0: command 0x040f tx timeout [ 56.450608][ T4236] Bluetooth: hci1: command 0x040f tx timeout [ 56.456745][ T4236] Bluetooth: hci2: command 0x040f tx timeout [ 56.462962][ T4236] Bluetooth: hci3: command 0x040f tx timeout [ 56.474793][ T4236] Bluetooth: hci4: command 0x040f tx timeout [ 56.486060][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 56.497350][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 56.507801][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 56.516215][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.524422][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 56.532966][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 56.555416][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.573902][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.583985][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.594670][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.604730][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 56.615363][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 56.640495][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 56.703959][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 56.712558][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 56.733082][ T4192] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.742669][ T4192] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.752079][ T4192] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.761042][ T4192] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.837154][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 56.865258][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 56.907607][ T4281] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1'. [ 56.939564][ T4281] mmap: syz.0.1 (4281) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 56.981885][ T4189] device veth0_macvtap entered promiscuous mode [ 56.994802][ T4189] device veth1_macvtap entered promiscuous mode [ 57.011243][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.021847][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.033974][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.044957][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.054818][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.066476][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.077135][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 57.088371][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.105543][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.171645][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 57.345262][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 57.470236][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 57.552382][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 57.740235][ T4289] binder: 4287:4289 ioctl c0306201 200000000080 returned -14 [ 57.767006][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.784163][ T4289] binder: 4287:4289 ioctl c0306201 2000000003c0 returned -14 [ 57.791646][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.812297][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.839658][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.849923][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.861197][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.871171][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.881730][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.892619][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 57.903585][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 57.921063][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 58.274181][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 58.365203][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 58.513441][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 58.810325][ T4236] Bluetooth: hci2: command 0x0419 tx timeout [ 58.826881][ T4236] Bluetooth: hci1: command 0x0419 tx timeout [ 58.876604][ T4236] Bluetooth: hci0: command 0x0419 tx timeout [ 58.892498][ T4300] loop3: detected capacity change from 0 to 512 [ 58.900109][ T4236] Bluetooth: hci4: command 0x0419 tx timeout [ 58.914651][ T4236] Bluetooth: hci3: command 0x0419 tx timeout [ 58.914655][ T4300] EXT4-fs (loop3): Ignoring removed nobh option [ 58.936390][ T4189] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.966950][ T4189] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.998457][ T4189] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.029484][ T4189] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 59.048345][ T4300] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,nobh,,errors=continue. Quota mode: writeback. [ 59.105766][ T4268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.114599][ T4300] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 59.145438][ T4268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.200732][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.279790][ T4268] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.307589][ T4268] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.329912][ T4273] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.376167][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.391559][ T4308] loop2: detected capacity change from 0 to 256 [ 59.398947][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.439324][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 59.444065][ T4308] ======================================================= [ 59.444065][ T4308] WARNING: The mand mount option has been deprecated and [ 59.444065][ T4308] and is ignored by this kernel. Remove the mand [ 59.444065][ T4308] option from the mount to silence this warning. [ 59.444065][ T4308] ======================================================= [ 59.485988][ T4268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.499577][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 59.529358][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.540322][ T4268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 59.577272][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.621821][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 59.851646][ T4308] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 60.840516][ T4324] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15'. [ 61.986020][ T4336] binder: 4335:4336 ioctl c0306201 200000000080 returned -14 [ 62.046331][ T4336] binder: 4335:4336 ioctl c0306201 2000000003c0 returned -14 [ 62.207632][ T4351] loop4: detected capacity change from 0 to 256 [ 62.438924][ T4351] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 62.827680][ T4359] loop2: detected capacity change from 0 to 512 [ 63.044794][ T4364] wg2 speed is unknown, defaulting to 1000 [ 63.068584][ T4359] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 63.077119][ T4359] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e040e018, mo2=0002] [ 63.085336][ T4359] System zones: 0-1, 15-15, 18-18, 34-34 [ 63.086743][ T4364] wg2 speed is unknown, defaulting to 1000 [ 63.092023][ T4359] EXT4-fs (loop2): orphan cleanup on readonly fs [ 63.098464][ T4364] wg2 speed is unknown, defaulting to 1000 [ 63.103330][ T4359] Quota error (device loop2): v2_read_header: Failed header read: expected=8 got=0 [ 63.103393][ T4359] EXT4-fs warning (device loop2): ext4_enable_quotas:6488: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 63.133003][ T4359] EXT4-fs (loop2): Cannot turn on quotas: error -22 [ 63.144850][ T4359] EXT4-fs error (device loop2): ext4_orphan_get:1432: comm syz.2.23: bad orphan inode 16 [ 63.155243][ T4359] ext4_test_bit(bit=15, block=18) = 1 [ 63.160643][ T4359] is_bad_inode(inode)=0 [ 63.164847][ T4359] NEXT_ORPHAN(inode)=0 [ 63.168960][ T4359] max_ino=32 [ 63.172157][ T4359] i_nlink=2 [ 63.175361][ T4359] EXT4-fs (loop2): mounted filesystem without journal. Opts: resgid=0x0000000000000000,,errors=continue. Quota mode: writeback. [ 64.002584][ T4373] loop4: detected capacity change from 0 to 2048 [ 64.111139][ T1107] wg2 speed is unknown, defaulting to 1000 [ 64.110188][ T4364] infiniband syz2: set active [ 64.139458][ T4364] infiniband syz2: added wg2 [ 64.176579][ T4364] infiniband syz2: Couldn't open port 1 [ 64.210400][ T4377] loop2: detected capacity change from 0 to 1024 [ 64.218406][ T4373] EXT4-fs (loop4): mounted filesystem without journal. Opts: bsdgroups,resuid=0x0000000000000000,auto_da_alloc=0x000000000000ffff,noblock_validity,,errors=continue. Quota mode: none. [ 64.228774][ T4377] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 64.347501][ T4377] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 64.411396][ T4364] RDS/IB: syz2: added [ 64.439824][ T4364] smc: adding ib device syz2 with port count 1 [ 64.451032][ T4364] smc: ib device syz2 port 1 has pnetid [ 64.465269][ T1107] wg2 speed is unknown, defaulting to 1000 [ 64.483394][ T4377] EXT4-fs (loop2): mounted filesystem without journal. Opts: minixdf,bsddf,barrier=0x0000000000000009,commit=0x0000000000000005,debug_want_extra_isize=0x0000000000000080,dioread_nolock,nodelalloc,noblock_validity,nomblk_io_submit,,errors=continue. Quota mode: none. [ 64.528002][ T4364] wg2 speed is unknown, defaulting to 1000 [ 64.698557][ T154] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.868545][ T154] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 65.918722][ T4364] wg2 speed is unknown, defaulting to 1000 [ 65.970388][ T154] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.250233][ T154] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 66.935232][ T4364] wg2 speed is unknown, defaulting to 1000 [ 67.050604][ T4417] Bluetooth: hci0: service_discovery: too big uuid_count value 32772 [ 67.355888][ T4398] wg2 speed is unknown, defaulting to 1000 [ 67.550923][ T4364] wg2 speed is unknown, defaulting to 1000 [ 67.961737][ T4427] wg2 speed is unknown, defaulting to 1000 [ 68.356239][ T4398] chnl_net:caif_netlink_parms(): no params data found [ 68.446877][ T4232] Bluetooth: hci4: command 0x0409 tx timeout [ 68.632611][ T4364] wg2 speed is unknown, defaulting to 1000 [ 68.635960][ T4398] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.719951][ T4398] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.749864][ T4398] device bridge_slave_0 entered promiscuous mode [ 68.779019][ T4398] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.802132][ T4398] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.815501][ T4398] device bridge_slave_1 entered promiscuous mode [ 68.988654][ T4398] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.023319][ T4398] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.033436][ T4232] Bluetooth: hci3: command 0x1003 tx timeout [ 69.039502][ T4205] Bluetooth: hci3: sending frame failed (-49) [ 69.218554][ T4398] team0: Port device team_slave_0 added [ 69.255402][ T4398] team0: Port device team_slave_1 added [ 69.356716][ T4398] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.368708][ T4457] loop4: detected capacity change from 0 to 8192 [ 69.375040][ T4398] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.375064][ T4398] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.401059][ C1] vkms_vblank_simulate: vblank timer overrun [ 69.429527][ T4232] Bluetooth: hci5: command 0x0409 tx timeout [ 69.440531][ T4398] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.450228][ T4398] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.481204][ T4386] loop4: p4 < > [ 69.484354][ T4398] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.551365][ T4457] loop4: p4 < > [ 69.561418][ T4427] chnl_net:caif_netlink_parms(): no params data found [ 69.623832][ T4398] device hsr_slave_0 entered promiscuous mode [ 69.671804][ T4398] device hsr_slave_1 entered promiscuous mode [ 69.691251][ T4398] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 69.708452][ T4398] Cannot create hsr debugfs directory [ 69.729853][ T4178] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 69.812561][ T154] device hsr_slave_0 left promiscuous mode [ 69.836144][ T154] device hsr_slave_1 left promiscuous mode [ 69.880891][ T4387] udevd[4387]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 69.892174][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 69.899905][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 69.910780][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 69.925416][ T4387] udevd[4387]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 69.926377][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 69.950758][ T154] device bridge_slave_1 left promiscuous mode [ 69.958638][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.991710][ T154] device bridge_slave_0 left promiscuous mode [ 69.998004][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.020204][ T154] device veth1_macvtap left promiscuous mode [ 70.027280][ T154] device veth0_macvtap left promiscuous mode [ 70.034597][ T154] device veth1_vlan left promiscuous mode [ 70.040502][ T154] device veth0_vlan left promiscuous mode [ 70.093539][ T4178] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 70.102191][ T4178] usb 1-1: config 1 has no interface number 0 [ 70.109343][ T4178] usb 1-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 32 [ 70.119299][ T4178] usb 1-1: config 1 interface 7 altsetting 0 endpoint 0xE has an invalid bInterval 86, changing to 10 [ 70.238938][ T154] team0 (unregistering): Port device team_slave_1 removed [ 70.257013][ T154] team0 (unregistering): Port device team_slave_0 removed [ 70.271530][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 70.283452][ T4178] usb 1-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 70.292578][ T4178] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 70.300763][ T4178] usb 1-1: Product: syz [ 70.301389][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 70.305274][ T4178] usb 1-1: Manufacturer: syz [ 70.318256][ T4178] usb 1-1: SerialNumber: syz [ 70.354452][ T4461] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 70.379389][ T4178] usb 1-1: Error in usbnet_get_endpoints (-22) [ 70.406783][ T154] bond0 (unregistering): Released all slaves [ 70.615921][ T4232] Bluetooth: hci4: command 0x041b tx timeout [ 70.652025][ T4427] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.680763][ T4427] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.689667][ T4427] device bridge_slave_0 entered promiscuous mode [ 70.699000][ T4427] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.720536][ T4232] usb 1-1: USB disconnect, device number 2 [ 70.728955][ T4427] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.747480][ T4427] device bridge_slave_1 entered promiscuous mode [ 70.785896][ T4427] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.808871][ T4427] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.866499][ T4427] team0: Port device team_slave_0 added [ 71.117252][ T4427] team0: Port device team_slave_1 added [ 71.188770][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.195394][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.242850][ T4398] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 71.286398][ T4427] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.299398][ T4427] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.391487][ T1325] Bluetooth: hci3: command 0x1001 tx timeout [ 71.397975][ T4205] Bluetooth: hci3: sending frame failed (-49) [ 71.405927][ T4427] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.418802][ T4427] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.425883][ T4427] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.455551][ T4427] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.505655][ T1325] Bluetooth: hci5: command 0x041b tx timeout [ 71.616016][ T4398] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 71.647215][ T4398] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 71.656459][ T4398] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 72.218175][ T4427] device hsr_slave_0 entered promiscuous mode [ 72.349231][ T4427] device hsr_slave_1 entered promiscuous mode [ 72.380123][ T4427] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.410367][ T4427] Cannot create hsr debugfs directory [ 72.623475][ T4232] Bluetooth: hci4: command 0x040f tx timeout [ 72.702187][ T4511] ODEBUG: Out of memory. ODEBUG disabled [ 72.779821][ T4398] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.829014][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.842524][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.897560][ T4398] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.922589][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.934187][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.952266][ T4412] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.959401][ T4412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.983126][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.994331][ T4525] rdma_rxe: rxe_register_device failed with error -23 [ 73.001907][ T4525] rdma_rxe: failed to add wg2 [ 73.174506][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.206453][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.236225][ T4412] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.243341][ T4412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.676485][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 73.905436][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 73.945743][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 73.986645][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.019171][ T4427] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 74.220312][ T4427] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 74.249888][ T4427] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 74.288826][ T4529] wg2 speed is unknown, defaulting to 1000 [ 74.402794][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.418179][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 74.452064][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.480676][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 74.509353][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.568744][ T4398] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 74.600767][ T4398] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.628629][ T4427] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 74.648179][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 74.663909][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.723175][ C0] sched: RT throttling activated [ 74.725206][ T1107] Bluetooth: hci3: command 0x1009 tx timeout [ 74.743294][ T1325] Bluetooth: hci5: command 0x040f tx timeout [ 74.749758][ T4236] Bluetooth: hci4: command 0x0419 tx timeout [ 74.980114][ T4427] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.092241][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 75.103635][ T4544] Zero length message leads to an empty skb [ 75.120214][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 75.144366][ T4427] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.194876][ T4398] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.202300][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 75.237470][ T4544] loop0: detected capacity change from 0 to 512 [ 75.243561][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 75.263718][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 75.310323][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 75.333230][ T4544] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 75.372180][ T4257] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.379331][ T4257] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.412548][ T4544] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 75.451165][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 75.467571][ T4557] loop4: detected capacity change from 0 to 256 [ 75.493490][ T4544] EXT4-fs (loop0): mount failed [ 75.508223][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 75.532559][ T4257] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.539682][ T4257] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.555008][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 75.582611][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 75.730714][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 75.813109][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.396318][ T1109] cfg80211: failed to load regulatory.db [ 77.134437][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 77.142986][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 77.151386][ T1107] Bluetooth: hci5: command 0x0419 tx timeout [ 77.293145][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 77.343939][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.362547][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.406819][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.442830][ T4427] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.503720][ T4427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.524122][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.532483][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.749864][ T4294] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.773955][ T4294] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.875961][ T4593] Bluetooth: hci0: service_discovery: too big uuid_count value 32772 [ 77.886425][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.900992][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.956365][ T4398] device veth0_vlan entered promiscuous mode [ 77.964743][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 78.003684][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 78.026423][ T4398] device veth1_vlan entered promiscuous mode [ 78.091662][ T4398] device veth0_macvtap entered promiscuous mode [ 78.129432][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 78.137997][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 78.220716][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 78.286612][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 78.331540][ T4398] device veth1_macvtap entered promiscuous mode [ 78.598343][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 78.690729][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 78.918191][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.084436][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.208184][ T4427] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.295441][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.349187][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.409777][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.450004][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.473256][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.487136][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.498869][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.511237][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.524086][ T4398] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.535415][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 79.560419][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 79.599320][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.625437][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.646639][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.680901][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.695968][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.706664][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.716787][ T4398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.736324][ T4398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.765731][ T4398] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.782161][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 79.796180][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 79.829651][ T4398] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.849593][ T4398] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.862750][ T4398] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.871986][ T4398] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.888514][ T154] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.945291][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 79.959364][ T4257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 79.978409][ T154] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.042680][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 80.059116][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 80.075912][ T4257] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.086716][ T4257] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.107714][ T154] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.122179][ T4427] device veth0_vlan entered promiscuous mode [ 80.129841][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 80.140918][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 80.158485][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 80.184545][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.193404][ T4427] device veth1_vlan entered promiscuous mode [ 80.213861][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.253377][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 80.261462][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 80.324764][ T1107] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.344178][ T154] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 80.537250][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 80.559610][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 80.754397][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 80.913663][ T1107] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 81.066825][ T1107] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.233203][ T1107] usb 5-1: Product: syz [ 81.364165][ T4427] device veth0_macvtap entered promiscuous mode [ 81.367565][ T4427] device veth1_macvtap entered promiscuous mode [ 81.400765][ T1107] usb 5-1: Manufacturer: syz [ 81.400786][ T1107] usb 5-1: SerialNumber: syz [ 81.407042][ T4236] Bluetooth: hci1: command 0x2016 tx timeout [ 81.427950][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 81.428577][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 82.189659][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.203017][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.213019][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.224040][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.253612][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.305736][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.326017][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.343543][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.353483][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.364545][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.379158][ T4427] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.407345][ T4681] netlink: 'syz.5.89': attribute type 21 has an invalid length. [ 82.421329][ T4681] IPv6: NLM_F_CREATE should be specified when creating new route [ 82.432917][ T4681] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 82.440582][ T4681] IPv6: NLM_F_CREATE should be set when creating new route [ 82.447899][ T4681] IPv6: NLM_F_CREATE should be set when creating new route [ 82.455147][ T4681] IPv6: NLM_F_CREATE should be set when creating new route [ 82.713206][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #0a!!! [ 82.723218][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 82.740262][ T4683] netlink: 'syz.5.89': attribute type 21 has an invalid length. [ 82.749014][ T4683] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 82.761872][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 82.777615][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 82.789141][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.800762][ T4683] syz.5.89 uses obsolete (PF_INET,SOCK_PACKET) [ 82.831017][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.863511][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.893220][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.912933][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.931893][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.942937][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.955869][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.975399][ T4427] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.986928][ T4427] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.998502][ T4427] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.050025][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 83.092794][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.105582][ T4427] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.121402][ T4427] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.126040][ T4702] loop4: detected capacity change from 0 to 128 [ 83.130424][ T4427] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.151689][ T4427] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.246283][ T4702] EXT4-fs (loop4): Ignoring removed nobh option [ 83.354276][ T4702] EXT4-fs (loop4): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 83.378972][ T4572] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.392813][ T4572] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.409115][ T4572] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 83.429290][ T4711] loop2: detected capacity change from 0 to 1024 [ 83.436222][ T4702] ext4 filesystem being mounted at /32/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 83.474216][ T4668] Bluetooth: hci3: Frame reassembly failed (-84) [ 83.485196][ T4268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.499783][ T4268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.517964][ T4711] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 83.580153][ T4268] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 83.595874][ T4711] EXT4-fs (loop2): mounted filesystem without journal. Opts: user_xattr,bsddf,sysvgroups,resuid=0x000000000000ee01,sysvgroups,nodelalloc,journal_dev=0x0000000000000001,noauto_da_alloc,nomblk_io_submit,,errors=continue. Quota mode: none. [ 83.788216][ T4711] netlink: 104 bytes leftover after parsing attributes in process `syz.2.97'. [ 83.945646][ T4736] loop0: detected capacity change from 0 to 128 [ 84.009257][ T4740] loop5: detected capacity change from 0 to 512 [ 84.015854][ T4736] EXT4-fs (loop0): Unrecognized mount option "fsmagic=0x0000000000000003" or missing value [ 84.084717][ T4743] ubi0: attaching mtd0 [ 84.097754][ T4743] ubi0: scanning is finished [ 84.102417][ T4743] ubi0: empty MTD device detected [ 84.320375][ T4743] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 84.618941][ T4740] EXT4-fs (loop5): mounted filesystem without journal. Opts: dax=inode,grpquota,,errors=continue. Quota mode: writeback. [ 84.640170][ T4759] loop2: detected capacity change from 0 to 128 [ 84.658073][ T4736] loop0: detected capacity change from 0 to 4096 [ 84.678140][ T4740] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 84.709361][ T4736] EXT4-fs (loop0): Ignoring removed mblk_io_submit option [ 85.093526][ T4764] loop6: detected capacity change from 0 to 8192 [ 85.210762][ T4764] loop6: p2 p3 p4 [ 85.214730][ T4736] EXT4-fs (loop0): Test dummy encryption mode enabled [ 85.259824][ T4764] loop6: p2 size 64053 extends beyond EOD, truncated [ 85.294764][ T4764] loop6: p3 start 65280 is beyond EOD, truncated [ 85.317178][ T4764] loop6: p4 size 50331904 extends beyond EOD, truncated [ 85.337108][ T4736] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpid,mblk_io_submit,nodioread_nolock,test_dummy_encryption,inode_readahead_blks=0x0000000000000000,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 85.443625][ T1107] rtl8150 5-1:1.0: couldn't reset the device [ 85.451994][ T1107] rtl8150: probe of 5-1:1.0 failed with error -5 [ 85.503379][ T4205] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 86.252562][ T4736] fscrypt (loop0): Error allocating 'cts(cbc(aes))' transform: -4 [ 86.255484][ T4792] fscrypt (loop0): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 86.965595][ T1107] usb 5-1: USB disconnect, device number 2 [ 88.295343][ T4387] udevd[4387]: inotify_add_watch(7, /dev/loop6p2, 10) failed: No such file or directory [ 88.306475][ T4830] loop4: detected capacity change from 0 to 512 [ 88.315602][ T4836] loop2: detected capacity change from 0 to 128 [ 88.358060][ T4386] udevd[4386]: inotify_add_watch(7, /dev/loop6p4, 10) failed: No such file or directory [ 88.379189][ T4830] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 88.399963][ T4836] EXT4-fs (loop2): Ignoring removed nobh option [ 88.428126][ T4836] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 88.428950][ T4830] EXT4-fs (loop4): 1 truncate cleaned up [ 88.442600][ T4836] ext4 filesystem being mounted at /21/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 88.472875][ T4273] Bluetooth: hci3: Frame reassembly failed (-84) [ 88.485371][ T4830] EXT4-fs (loop4): mounted filesystem without journal. Opts: barrier=0x0000000000000101,errors=remount-ro,noblock_validity,. Quota mode: none. [ 88.517735][ T4846] loop0: detected capacity change from 0 to 128 [ 88.538308][ T4273] Bluetooth: hci3: Frame reassembly failed (-84) [ 88.566601][ T154] device hsr_slave_0 left promiscuous mode [ 88.573651][ T154] device hsr_slave_1 left promiscuous mode [ 88.590347][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.610080][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.618034][ T4848] netlink: 8 bytes leftover after parsing attributes in process `syz.6.125'. [ 88.637861][ T4846] FAT-fs (loop0): bogus logical sector size 0 [ 88.644246][ T4846] FAT-fs (loop0): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 88.654394][ T4846] FAT-fs (loop0): Can't find a valid FAT filesystem [ 88.683853][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.691291][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.780097][ T154] device bridge_slave_1 left promiscuous mode [ 88.799499][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.861333][ T154] device bridge_slave_0 left promiscuous mode [ 88.880593][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.944414][ T154] device veth1_macvtap left promiscuous mode [ 88.970520][ T154] device veth0_macvtap left promiscuous mode [ 89.000225][ T154] device veth1_vlan left promiscuous mode [ 89.036551][ T154] device veth0_vlan left promiscuous mode [ 90.237968][ T154] team0 (unregistering): Port device team_slave_1 removed [ 90.250505][ T154] team0 (unregistering): Port device team_slave_0 removed [ 90.264737][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 90.279451][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 90.333847][ T154] bond0 (unregistering): Released all slaves [ 90.432186][ T4882] netlink: 12 bytes leftover after parsing attributes in process `syz.4.131'. [ 90.558807][ T4887] 9pnet: p9_errstr2errno: server reported unknown error 0x000000 [ 90.604925][ T4205] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 90.859771][ T4900] loop0: detected capacity change from 0 to 256 [ 90.885928][ T4906] loop6: detected capacity change from 0 to 1024 [ 90.895632][ T4907] loop4: detected capacity change from 0 to 256 [ 90.937844][ T4900] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 91.053570][ T4906] EXT4-fs (loop6): Ignoring removed mblk_io_submit option [ 91.658394][ T4906] EXT4-fs (loop6): mounted filesystem without journal. Opts: mblk_io_submit,errors=continue,noquota,delalloc,journal_dev=0x0000000000000008,grpjquota=,,errors=continue. Quota mode: none. [ 91.794115][ T4906] ext4 filesystem being mounted at /9/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 91.961128][ T4922] netlink: 8 bytes leftover after parsing attributes in process `syz.0.142'. [ 92.063137][ T4906] EXT4-fs error (device loop6): ext4_free_blocks:6231: comm syz.6.139: Freeing blocks not in datazone - block = 0, count = 16 [ 92.563810][ T4906] EXT4-fs error (device loop6): ext4_validate_block_bitmap:438: comm syz.6.139: bg 0: block 112: padding at end of block bitmap is not set [ 92.583613][ T4906] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 92.605556][ T4930] loop5: detected capacity change from 0 to 128 [ 92.676169][ T4930] EXT4-fs (loop5): Ignoring removed nobh option [ 92.759569][ T4930] EXT4-fs (loop5): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 92.795287][ T4930] ext4 filesystem being mounted at /14/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 93.657616][ T4956] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 94.619827][ T4977] loop0: detected capacity change from 0 to 256 [ 95.339725][ T4980] loop2: detected capacity change from 0 to 512 [ 95.359016][ T4983] loop4: detected capacity change from 0 to 128 [ 95.485748][ T4980] EXT4-fs error (device loop2): ext4_orphan_get:1406: inode #15: comm syz.2.160: inode has both inline data and extents flags [ 95.542476][ T4992] loop5: detected capacity change from 0 to 1024 [ 95.603633][ T4980] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.160: couldn't read orphan inode 15 (err -117) [ 95.622843][ T4994] loop0: detected capacity change from 0 to 128 [ 95.667161][ T4992] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 95.676175][ T4980] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobarrier,,errors=continue. Quota mode: writeback. [ 95.724550][ T4994] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c028, mo2=0002] [ 95.733573][ T4992] EXT4-fs (loop5): invalid journal inode [ 95.739279][ T4992] EXT4-fs (loop5): can't get journal size [ 95.798098][ T4994] System zones: 1-3, 19-19, 35-36 [ 95.934772][ T4992] EXT4-fs error (device loop5): ext4_map_blocks:631: inode #3: block 17104912: comm syz.5.163: lblock 2 mapped to illegal pblock 17104912 (length 1) [ 95.976922][ T5004] loop6: detected capacity change from 0 to 256 [ 95.986250][ T4994] EXT4-fs (loop0): mounted filesystem without journal. Opts: block_validity,errors=remount-ro,debug,block_validity,. Quota mode: none. [ 96.009455][ T4994] ext4 filesystem being mounted at /37/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 96.027537][ T5011] loop4: detected capacity change from 0 to 512 [ 96.028562][ T4992] EXT4-fs (loop5): failed to initialize system zone (-117) [ 96.041572][ T4994] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.079810][ T5004] FAT-fs (loop6): Directory bread(block 64) failed [ 96.086488][ T5004] FAT-fs (loop6): Directory bread(block 65) failed [ 96.093111][ T5004] FAT-fs (loop6): Directory bread(block 66) failed [ 96.099678][ T5004] FAT-fs (loop6): Directory bread(block 67) failed [ 96.106306][ T5004] FAT-fs (loop6): Directory bread(block 68) failed [ 96.112828][ T5004] FAT-fs (loop6): Directory bread(block 69) failed [ 96.119443][ T5004] FAT-fs (loop6): Directory bread(block 70) failed [ 96.125983][ T5004] FAT-fs (loop6): Directory bread(block 71) failed [ 96.132553][ T5004] FAT-fs (loop6): Directory bread(block 72) failed [ 96.139108][ T5004] FAT-fs (loop6): Directory bread(block 73) failed [ 96.198714][ T4992] EXT4-fs (loop5): mount failed [ 96.223452][ T4994] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 96.408644][ T4994] EXT4-fs (loop0): Remounting filesystem read-only [ 96.424722][ T4994] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.469336][ T4994] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 96.486480][ T4994] EXT4-fs (loop0): Remounting filesystem read-only [ 96.501265][ T5016] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.527200][ T5016] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 96.559897][ T5016] EXT4-fs (loop0): Remounting filesystem read-only [ 96.580304][ T4994] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.624956][ T4994] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 96.669491][ T4994] EXT4-fs (loop0): Remounting filesystem read-only [ 96.701004][ T4994] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.731018][ T4994] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 96.869972][ T5016] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.915334][ T4994] EXT4-fs (loop0): Remounting filesystem read-only [ 96.924764][ T5011] EXT4-fs (loop4): mounted filesystem without journal. Opts: errors=continue,usrquota,,errors=continue. Quota mode: writeback. [ 96.926174][ T5019] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 96.953913][ T5019] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 97.124342][ T5011] ext4 filesystem being mounted at /50/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 97.627671][ T5019] EXT4-fs (loop0): Remounting filesystem read-only [ 97.670831][ T5016] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 97.725295][ T5016] EXT4-fs (loop0): Remounting filesystem read-only [ 97.890831][ T4994] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 98.084173][ T4994] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 98.100685][ T5045] device syzkaller0 entered promiscuous mode [ 98.194390][ T5048] netlink: 8 bytes leftover after parsing attributes in process `syz.5.175'. [ 98.207627][ T4994] EXT4-fs (loop0): Remounting filesystem read-only [ 98.268018][ T5016] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 98.362189][ T5016] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 98.385097][ T5016] EXT4-fs (loop0): Remounting filesystem read-only [ 98.403974][ T5019] EXT4-fs warning (device loop0): ext4_dirblock_csum_verify:406: inode #2: comm syz.0.166: No space for directory leaf checksum. Please run e2fsck -D. [ 98.782512][ T5019] EXT4-fs error (device loop0): __ext4_find_entry:1696: inode #2: comm syz.0.166: checksumming directory block 0 [ 99.068690][ T5019] EXT4-fs (loop0): Remounting filesystem read-only [ 99.199833][ T5062] tipc: Enabling of bearer rejected, failed to enable media [ 100.593696][ T5086] loop2: detected capacity change from 0 to 256 [ 100.742297][ T5096] netlink: 8 bytes leftover after parsing attributes in process `syz.5.187'. [ 100.905652][ T5106] device syzkaller0 entered promiscuous mode [ 100.971475][ T5112] loop2: detected capacity change from 0 to 512 [ 101.279491][ T5112] EXT4-fs (loop2): mounted filesystem without journal. Opts: noauto_da_alloc,min_batch_time=0x0000000000000004,,errors=continue. Quota mode: writeback. [ 101.453494][ T5112] ext4 filesystem being mounted at /32/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 101.614461][ T5112] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 101.965140][ T5139] loop4: detected capacity change from 0 to 1024 [ 102.075229][ T5137] loop6: detected capacity change from 0 to 512 [ 102.176891][ T5139] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 102.522563][ T5137] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 102.596499][ T5137] EXT4-fs (loop6): orphan cleanup on readonly fs [ 102.608920][ T5137] Quota error (device loop6): find_tree_dqentry: Getting block too big (196613 >= 6) [ 102.621758][ T5137] Quota error (device loop6): qtree_read_dquot: Can't read quota structure for id 0 [ 102.632931][ T5137] EXT4-fs error (device loop6): ext4_acquire_dquot:6236: comm syz.6.198: Failed to acquire dquot type 1 [ 102.644495][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 102.659331][ T5137] EXT4-fs error (device loop6): ext4_do_update_inode:5229: inode #16: comm syz.6.198: corrupted inode contents [ 102.685819][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 102.707851][ T5139] EXT4-fs (loop4): mounted filesystem without journal. Opts: mblk_io_submit,errors=continue,noquota,delalloc,journal_dev=0x0000000000000008,grpjquota=,,errors=continue. Quota mode: none. [ 102.715502][ T5137] EXT4-fs error (device loop6): ext4_dirty_inode:6077: inode #16: comm syz.6.198: mark_inode_dirty error [ 102.814657][ T5139] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.903646][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 102.910370][ T5137] EXT4-fs error (device loop6): ext4_do_update_inode:5229: inode #16: comm syz.6.198: corrupted inode contents [ 102.933917][ T5139] EXT4-fs error (device loop4): ext4_free_blocks:6231: comm syz.4.197: Freeing blocks not in datazone - block = 0, count = 16 [ 102.989347][ T5139] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.197: bg 0: block 112: padding at end of block bitmap is not set [ 103.377876][ T5139] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 103.624559][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 103.678711][ T5137] EXT4-fs error (device loop6): __ext4_ext_dirty:183: inode #16: comm syz.6.198: mark_inode_dirty error [ 103.721837][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 103.729791][ T5137] EXT4-fs error (device loop6): ext4_do_update_inode:5229: inode #16: comm syz.6.198: corrupted inode contents [ 103.751500][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 103.767147][ T5137] EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem [ 103.767725][ T5166] netlink: 8 bytes leftover after parsing attributes in process `syz.0.204'. [ 103.954438][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 103.963364][ T5137] EXT4-fs error (device loop6): ext4_do_update_inode:5229: inode #16: comm syz.6.198: corrupted inode contents [ 104.356983][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 104.363799][ T5137] EXT4-fs error (device loop6): ext4_truncate:4286: inode #16: comm syz.6.198: mark_inode_dirty error [ 104.382380][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 104.406130][ T5137] EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem [ 104.435781][ T5137] EXT4-fs (loop6): Remounting filesystem read-only [ 104.451926][ T5137] EXT4-fs (loop6): 1 truncate cleaned up [ 104.469954][ T5137] EXT4-fs (loop6): mounted filesystem without journal. Opts: errors=remount-ro,nodioread_nolock,. Quota mode: writeback. [ 104.501379][ T5181] device syzkaller0 entered promiscuous mode [ 104.875316][ T5190] loop2: detected capacity change from 0 to 256 [ 104.994522][ T5190] FAT-fs (loop2): Directory bread(block 64) failed [ 105.001104][ T5190] FAT-fs (loop2): Directory bread(block 65) failed [ 105.007786][ T5190] FAT-fs (loop2): Directory bread(block 66) failed [ 105.014367][ T5190] FAT-fs (loop2): Directory bread(block 67) failed [ 105.020945][ T5190] FAT-fs (loop2): Directory bread(block 68) failed [ 105.027604][ T5190] FAT-fs (loop2): Directory bread(block 69) failed [ 105.034223][ T5190] FAT-fs (loop2): Directory bread(block 70) failed [ 105.040749][ T5190] FAT-fs (loop2): Directory bread(block 71) failed [ 105.047366][ T5190] FAT-fs (loop2): Directory bread(block 72) failed [ 105.053928][ T5190] FAT-fs (loop2): Directory bread(block 73) failed [ 105.882729][ T5207] loop4: detected capacity change from 0 to 128 [ 106.808413][ T5222] netlink: 8 bytes leftover after parsing attributes in process `syz.0.218'. [ 107.090782][ T5238] loop6: detected capacity change from 0 to 256 [ 108.239044][ T5247] loop2: detected capacity change from 0 to 256 [ 108.700515][ T5247] FAT-fs (loop2): Directory bread(block 64) failed [ 108.707249][ T5247] FAT-fs (loop2): Directory bread(block 65) failed [ 108.713877][ T5247] FAT-fs (loop2): Directory bread(block 66) failed [ 108.720411][ T5247] FAT-fs (loop2): Directory bread(block 67) failed [ 108.727092][ T5247] FAT-fs (loop2): Directory bread(block 68) failed [ 108.733650][ T5247] FAT-fs (loop2): Directory bread(block 69) failed [ 108.740221][ T5247] FAT-fs (loop2): Directory bread(block 70) failed [ 108.746784][ T5247] FAT-fs (loop2): Directory bread(block 71) failed [ 108.753418][ T5247] FAT-fs (loop2): Directory bread(block 72) failed [ 108.759943][ T5247] FAT-fs (loop2): Directory bread(block 73) failed [ 108.808084][ T5238] FAT-fs (loop6): Directory bread(block 64) failed [ 108.875777][ T5238] FAT-fs (loop6): Directory bread(block 65) failed [ 108.920105][ T5238] FAT-fs (loop6): Directory bread(block 66) failed [ 109.016017][ T5238] FAT-fs (loop6): Directory bread(block 67) failed [ 109.723381][ T5238] FAT-fs (loop6): Directory bread(block 68) failed [ 109.729952][ T5238] FAT-fs (loop6): Directory bread(block 69) failed [ 109.785550][ T5238] FAT-fs (loop6): Directory bread(block 70) failed [ 109.809979][ T5238] FAT-fs (loop6): Directory bread(block 71) failed [ 109.989314][ T5238] FAT-fs (loop6): Directory bread(block 72) failed [ 110.070770][ T5238] FAT-fs (loop6): Directory bread(block 73) failed [ 110.585968][ T5293] netlink: 8 bytes leftover after parsing attributes in process `syz.6.232'. [ 111.750594][ T5310] device syzkaller0 entered promiscuous mode [ 111.849787][ T5310] tipc: Started in network mode [ 111.866510][ T5310] tipc: Node identity e6a130897595, cluster identity 4711 [ 111.899109][ T5310] tipc: Enabled bearer , priority 0 [ 111.938303][ T5308] tipc: Resetting bearer [ 112.015192][ T5308] tipc: Disabling bearer [ 112.201140][ T5334] loop6: detected capacity change from 0 to 512 [ 112.421337][ T5351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.245'. [ 112.580681][ T5334] EXT4-fs error (device loop6): ext4_orphan_get:1432: comm syz.6.242: bad orphan inode 15 [ 112.748830][ T5334] EXT4-fs (loop6): mounted filesystem without journal. Opts: quota,delalloc,acl,journal_dev=0x0000000000000011,usrjquota=,bsdgroups,,errors=continue. Quota mode: writeback. [ 113.239820][ T5334] EXT4-fs error (device loop6): __ext4_new_inode:1082: comm syz.6.242: reserved inode found cleared - inode=18 [ 114.939943][ T5383] process 'syz.5.260' launched './file1' with NULL argv: empty string added [ 115.212267][ T5386] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 115.471298][ T5395] device syzkaller0 entered promiscuous mode [ 117.332687][ T5436] loop6: detected capacity change from 0 to 128 [ 117.526519][ T5436] EXT4-fs (loop6): Ignoring removed nobh option [ 117.659079][ T5436] EXT4-fs (loop6): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 117.744655][ T5436] ext4 filesystem being mounted at /35/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 117.796367][ T5448] netlink: 132 bytes leftover after parsing attributes in process `syz.5.267'. [ 117.848077][ T4667] Bluetooth: hci3: Frame reassembly failed (-84) [ 118.673735][ T5457] device syzkaller0 entered promiscuous mode [ 118.903318][ T5459] netlink: 'syz.5.270': attribute type 39 has an invalid length. [ 119.824112][ T4205] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 119.824138][ T4235] Bluetooth: hci3: command 0xfc11 tx timeout [ 120.832826][ T5510] loop6: detected capacity change from 0 to 128 [ 121.002125][ T5514] device syzkaller0 entered promiscuous mode [ 122.966185][ T5551] loop4: detected capacity change from 0 to 512 [ 123.031421][ T5553] device syzkaller0 entered promiscuous mode [ 123.152401][ T5551] EXT4-fs (loop4): mounted filesystem without journal. Opts: i_version,usrquota,errors=remount-ro,. Quota mode: writeback. [ 123.179179][ T5551] ext4 filesystem being mounted at /77/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 123.260261][ T5551] EXT4-fs (loop4): shut down requested (2) [ 123.316125][ T5567] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.324630][ T5567] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.510686][ T5578] device syzkaller0 entered promiscuous mode [ 123.653888][ T5580] netlink: 'syz.5.304': attribute type 13 has an invalid length. [ 123.676204][ T5580] netlink: 24859 bytes leftover after parsing attributes in process `syz.5.304'. [ 123.940835][ T5599] device syzkaller0 entered promiscuous mode [ 125.125644][ T5625] netlink: 'syz.2.318': attribute type 29 has an invalid length. [ 125.182120][ T5625] netlink: 'syz.2.318': attribute type 29 has an invalid length. [ 125.221468][ T5633] loop6: detected capacity change from 0 to 128 [ 125.248446][ T5629] netlink: 'syz.2.318': attribute type 29 has an invalid length. [ 125.277135][ T5635] netlink: 'syz.2.318': attribute type 29 has an invalid length. [ 125.364871][ T5625] netlink: 'syz.2.318': attribute type 29 has an invalid length. [ 125.387710][ T5641] device syzkaller0 entered promiscuous mode [ 126.722563][ T5670] netlink: 'syz.0.331': attribute type 4 has an invalid length. [ 126.901552][ T5682] loop2: detected capacity change from 0 to 128 [ 126.934779][ T5686] device syzkaller0 entered promiscuous mode [ 127.727470][ T5709] loop4: detected capacity change from 0 to 128 [ 130.002182][ T5738] netlink: 65055 bytes leftover after parsing attributes in process `syz.6.354'. [ 130.355575][ T5746] netlink: 'syz.2.357': attribute type 8 has an invalid length. [ 130.373477][ T5746] netlink: 156 bytes leftover after parsing attributes in process `syz.2.357'. [ 130.386620][ T5748] netlink: 36 bytes leftover after parsing attributes in process `syz.6.359'. [ 130.396735][ T5748] netlink: 'syz.6.359': attribute type 1 has an invalid length. [ 130.404719][ T5748] netlink: 6 bytes leftover after parsing attributes in process `syz.6.359'. [ 130.812002][ T5767] netlink: 'syz.4.365': attribute type 16 has an invalid length. [ 130.834159][ T5767] netlink: 'syz.4.365': attribute type 7 has an invalid length. [ 130.842779][ T5767] netlink: 132 bytes leftover after parsing attributes in process `syz.4.365'. [ 132.110910][ T5807] device syzkaller0 entered promiscuous mode [ 132.579828][ T5807] tipc: Started in network mode [ 132.589303][ T5807] tipc: Node identity 86b6d132af51, cluster identity 4711 [ 132.609740][ T5807] tipc: Enabled bearer , priority 0 [ 132.626631][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.633493][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.071662][ T5799] tipc: Resetting bearer [ 133.110005][ T5799] tipc: Disabling bearer [ 133.368837][ T5854] sctp: [Deprecated]: syz.2.386 (pid 5854) Use of struct sctp_assoc_value in delayed_ack socket option. [ 133.368837][ T5854] Use struct sctp_sack_info instead [ 133.660362][ T5878] netlink: 'syz.5.395': attribute type 29 has an invalid length. [ 134.294519][ T5878] netlink: 'syz.5.395': attribute type 29 has an invalid length. [ 134.344986][ T5871] netlink: 'syz.5.395': attribute type 29 has an invalid length. [ 134.353075][ T5885] netlink: 'syz.5.395': attribute type 29 has an invalid length. [ 134.847188][ T5919] syz.2.407 (5919): drop_caches: 0 [ 135.263590][ T4236] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 135.889073][ T4236] usb 7-1: Using ep0 maxpacket: 32 [ 136.041805][ T5942] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.133392][ T4236] usb 7-1: unable to get BOS descriptor or descriptor too short [ 136.166796][ T4178] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 136.235628][ T4236] usb 7-1: config 14 has an invalid interface number: 57 but max is 1 [ 136.252372][ T4236] usb 7-1: config 14 has an invalid interface number: 228 but max is 1 [ 136.281524][ T4236] usb 7-1: config 14 has no interface number 0 [ 136.281659][ T5959] sg_write: data in/out 504197/136 bytes for SCSI command 0x0-- guessing data in; [ 136.281659][ T5959] program syz.0.420 not setting count and/or reply_len properly [ 136.298140][ T4236] usb 7-1: config 14 has no interface number 1 [ 136.329171][ T4236] usb 7-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 136.354276][ T4236] usb 7-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 136.369829][ T4236] usb 7-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 136.383124][ T4236] usb 7-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 136.402546][ T4236] usb 7-1: config 14 interface 57 has no altsetting 0 [ 136.409607][ T4236] usb 7-1: config 14 interface 228 has no altsetting 0 [ 136.543349][ T4178] usb 3-1: Using ep0 maxpacket: 16 [ 136.594171][ T4236] usb 7-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 136.619923][ T4236] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.723302][ T4236] usb 7-1: Product: syz [ 136.781334][ T4236] usb 7-1: Manufacturer: syz [ 136.845044][ T4236] usb 7-1: SerialNumber: syz [ 137.313345][ T4178] usb 3-1: config 0 has an invalid interface number: 34 but max is 0 [ 137.321471][ T4178] usb 3-1: config 0 has no interface number 0 [ 137.343377][ T21] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 137.351284][ T4178] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 137.373365][ T4178] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 137.723469][ T4178] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 137.733237][ T21] usb 5-1: Using ep0 maxpacket: 8 [ 137.890149][ T4236] legousbtower 7-1:14.57: interrupt endpoints not found [ 138.262580][ T4178] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.275042][ T4236] legousbtower 7-1:14.228: interrupt endpoints not found [ 138.324166][ T4178] usb 3-1: Product: syz [ 138.328368][ T4178] usb 3-1: Manufacturer: syz [ 138.332965][ T4178] usb 3-1: SerialNumber: syz [ 138.367546][ T4178] usb 3-1: config 0 descriptor?? [ 138.393399][ T4178] usb 3-1: can't set config #0, error -71 [ 138.420438][ T4178] usb 3-1: USB disconnect, device number 2 [ 138.463760][ T21] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 138.494618][ T21] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 138.518683][ T21] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 138.534197][ T21] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 138.551934][ T21] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 138.565874][ T6004] fuse: root generation should be zero [ 138.573496][ T21] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 138.593121][ T21] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.694570][ T6011] device syzkaller0 entered promiscuous mode [ 138.697338][ T6014] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 138.732656][ T6011] tipc: Started in network mode [ 138.756090][ T6011] tipc: Node identity 7a5ece561aab, cluster identity 4711 [ 138.763962][ T6011] tipc: Enabled bearer , priority 0 [ 138.793513][ T6008] tipc: Resetting bearer [ 138.863689][ T6008] tipc: Disabling bearer [ 138.877801][ T21] usb 5-1: GET_CAPABILITIES returned 0 [ 138.887746][ T21] usbtmc 5-1:16.0: can't read capabilities [ 139.085870][ T4236] usb 5-1: USB disconnect, device number 3 [ 140.123057][ T4236] usb 7-1: USB disconnect, device number 2 [ 140.188631][ T6052] tmpfs: Unknown parameter 'usrquota' [ 140.197846][ T4205] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 140.207764][ T4205] CPU: 0 PID: 4205 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 140.215401][ T4205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 140.225489][ T4205] Workqueue: hci5 hci_rx_work [ 140.230198][ T4205] Call Trace: [ 140.233482][ T4205] [ 140.236414][ T4205] dump_stack_lvl+0x188/0x250 [ 140.241104][ T4205] ? show_regs_print_info+0x20/0x20 [ 140.242980][ T6056] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 140.246310][ T4205] ? load_image+0x400/0x400 [ 140.246383][ T4205] sysfs_create_dir_ns+0x26a/0x290 [ 140.246406][ T4205] ? sysfs_warn_dup+0xa0/0xa0 [ 140.246419][ T4205] ? process_one_work+0x85f/0x1010 [ 140.246442][ T4205] ? do_raw_spin_unlock+0x11d/0x230 [ 140.246463][ T4205] kobject_add_internal+0x6e0/0xd90 [ 140.302179][ T4205] kobject_add+0x160/0x230 [ 140.306615][ T4205] ? kobject_init+0x1d0/0x1d0 [ 140.311304][ T4205] ? klist_children_get+0x50/0x50 [ 140.316347][ T4205] ? get_device_parent+0x121/0x3f0 [ 140.321468][ T4205] device_add+0x48c/0x1000 [ 140.325905][ T4205] hci_conn_add_sysfs+0xd1/0x1e0 [ 140.330854][ T4205] le_conn_complete_evt+0xc4b/0x15c0 [ 140.336157][ T4205] ? cs_le_create_conn+0x5e0/0x5e0 [ 140.341281][ T4205] ? __mutex_trylock_common+0x155/0x260 [ 140.346843][ T4205] hci_le_meta_evt+0x285/0x3cb0 [ 140.351700][ T4205] ? hci_event_packet+0x37e/0x1370 [ 140.356816][ T4205] ? __lock_acquire+0x7d10/0x7d10 [ 140.361860][ T4205] ? hci_remote_host_features_evt+0x290/0x290 [ 140.367930][ T4205] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 140.373570][ T4205] ? mark_lock+0x94/0x320 [ 140.377905][ T4205] ? mutex_unlock+0x10/0x10 [ 140.382421][ T4205] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 140.388412][ T4205] ? lock_chain_count+0x20/0x20 [ 140.392765][ T6056] CIFS mount error: No usable UNC path provided in device string! [ 140.392765][ T6056] [ 140.393265][ T4205] ? __rwlock_init+0x140/0x140 [ 140.393290][ T4205] hci_event_packet+0xe4b/0x1370 [ 140.393316][ T4205] ? lockdep_hardirqs_on+0x94/0x140 [ 140.393342][ T4205] ? rcu_lock_release+0x20/0x20 [ 140.393364][ T4205] ? hci_send_to_monitor+0x9c/0x4a0 [ 140.393386][ T4205] hci_rx_work+0x255/0xa10 [ 140.432637][ T4205] process_one_work+0x85f/0x1010 [ 140.437601][ T4205] ? worker_detach_from_pool+0x240/0x240 [ 140.443240][ T4205] ? lockdep_hardirqs_off+0x70/0x100 [ 140.448539][ T4205] ? _raw_spin_lock_irq+0xb7/0xf0 [ 140.451231][ T6056] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 140.453586][ T4205] ? _raw_spin_lock_irqsave+0x100/0x100 [ 140.453613][ T4205] ? wq_worker_running+0x97/0x170 [ 140.453633][ T4205] worker_thread+0xaa6/0x1290 [ 140.453676][ T4205] kthread+0x436/0x520 [ 140.453692][ T4205] ? rcu_lock_release+0x20/0x20 [ 140.453708][ T4205] ? kthread_blkcg+0xd0/0xd0 [ 140.491190][ T4205] ret_from_fork+0x1f/0x30 [ 140.495629][ T4205] [ 140.501543][ T4205] kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 140.515174][ T4205] Bluetooth: hci5: failed to register connection device [ 141.209934][ T6079] device syzkaller0 entered promiscuous mode [ 141.284243][ T6079] tipc: Started in network mode [ 141.290068][ T6079] tipc: Node identity 0ab681032435, cluster identity 4711 [ 141.298142][ T6079] tipc: Enabled bearer , priority 0 [ 141.307030][ T6076] tipc: Resetting bearer [ 141.325485][ T6076] tipc: Disabling bearer [ 141.523315][ T4178] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 141.763398][ T4178] usb 3-1: Using ep0 maxpacket: 16 [ 141.944068][ T4178] usb 3-1: unable to get BOS descriptor or descriptor too short [ 141.971326][ T6082] block nbd0: shutting down sockets [ 142.066337][ T4178] usb 3-1: config 208 has no interfaces? [ 142.406301][ T4178] usb 3-1: New USB device found, idVendor=05ac, idProduct=12ab, bcdDevice=e4.ac [ 142.424945][ T4178] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.432967][ T4178] usb 3-1: Product: syz [ 142.455289][ T4178] usb 3-1: Manufacturer: syz [ 142.462172][ T4178] usb 3-1: SerialNumber: syz [ 142.680388][ T6139] tipc: Enabling of bearer rejected, failed to enable media [ 142.739815][ T4178] apple-mfi-fastcharge 3-1: USB disconnect, device number 3 [ 142.766859][ T6145] loop0: detected capacity change from 0 to 128 [ 142.819254][ T6148] syz.6.463 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 142.923631][ T6145] EXT4-fs (loop0): Ignoring removed nobh option [ 142.966935][ T6145] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 143.030698][ T6145] ext4 filesystem being mounted at /97/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 143.135852][ T1176] Bluetooth: hci3: Frame reassembly failed (-84) [ 143.142218][ T1176] Bluetooth: hci3: Frame reassembly failed (-84) [ 144.133665][ T6195] device syzkaller0 entered promiscuous mode [ 144.161333][ T6195] tipc: Enabled bearer , priority 0 [ 144.186312][ T6194] tipc: Resetting bearer [ 144.216351][ T6194] tipc: Disabling bearer [ 144.481336][ T4236] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 144.508004][ T6218] netlink: 12 bytes leftover after parsing attributes in process `syz.6.481'. [ 144.793700][ T4236] usb 3-1: Using ep0 maxpacket: 16 [ 144.827409][ T6241] device syzkaller1 entered promiscuous mode [ 144.925634][ T4178] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 144.933403][ T4236] usb 3-1: config 1 has an invalid interface number: 138 but max is 0 [ 144.951778][ T4236] usb 3-1: config 1 has no interface number 0 [ 144.979002][ T4236] usb 3-1: config 1 interface 138 has no altsetting 0 [ 144.991001][ T6252] device syzkaller0 entered promiscuous mode [ 145.002270][ T6252] tipc: Enabled bearer , priority 0 [ 145.016202][ T6251] tipc: Resetting bearer [ 145.038800][ T6251] tipc: Disabling bearer [ 145.173248][ T4178] usb 7-1: Using ep0 maxpacket: 8 [ 145.183501][ T4204] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 145.287715][ T4236] usb 3-1: New USB device found, idVendor=1943, idProduct=2257, bcdDevice=b2.c9 [ 145.300113][ T4236] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.308242][ T4236] usb 3-1: Product: syz [ 145.313348][ T4236] usb 3-1: Manufacturer: syz [ 145.318018][ T4236] usb 3-1: SerialNumber: syz [ 145.503375][ T4178] usb 7-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 145.521757][ T4178] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.563253][ T4178] usb 7-1: Product: syz [ 145.567458][ T4178] usb 7-1: Manufacturer: syz [ 145.606816][ T4178] usb 7-1: SerialNumber: syz [ 145.631324][ T4178] usb 7-1: config 0 descriptor?? [ 145.644858][ T4236] s2255 3-1:1.138: Could not find bulk-in endpoint [ 145.653898][ T4236] Sensoray 2255 driver load failed: 0xfffffff4 [ 145.690006][ T4236] s2255: probe of 3-1:1.138 failed with error -12 [ 145.727776][ T4236] usb 3-1: USB disconnect, device number 4 [ 145.769948][ T150] block nbd4: Attempted send on invalid socket [ 145.781159][ T150] blk_update_request: I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 0 [ 145.795797][ T6292] XFS (nbd4): SB validate failed with error -5. [ 145.938075][ T4178] usb 7-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 146.100584][ T6321] device syzkaller0 entered promiscuous mode [ 146.144188][ T6321] tipc: Enabled bearer , priority 0 [ 146.161290][ T6320] tipc: Resetting bearer [ 146.187396][ T6320] tipc: Disabling bearer [ 146.193443][ T21] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 146.436885][ T21] usb 1-1: Using ep0 maxpacket: 32 [ 146.498778][ T4236] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 146.618919][ T21] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 146.627428][ T21] usb 1-1: config 0 has no interface number 0 [ 146.633639][ T21] usb 1-1: config 0 interface 12 has no altsetting 0 [ 146.813458][ T21] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 146.822930][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.831044][ T21] usb 1-1: Product: syz [ 146.835380][ T21] usb 1-1: Manufacturer: syz [ 146.839987][ T21] usb 1-1: SerialNumber: syz [ 146.858916][ T21] usb 1-1: config 0 descriptor?? [ 146.874234][ T4236] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 146.885287][ T4236] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 146.895150][ T4236] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 146.904350][ T4236] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.914110][ T4236] usb 3-1: config 0 descriptor?? [ 147.416875][ T4236] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 147.429682][ T4236] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 147.447618][ T4236] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 147.457781][ T4236] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 147.475970][ T4236] playstation 0003:054C:0DF2.0001: unknown main item tag 0x0 [ 147.496779][ T4236] playstation 0003:054C:0DF2.0001: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.2-1/input0 [ 147.514086][ T6363] tipc: Enabling of bearer rejected, failed to enable media [ 147.694339][ T4236] playstation 0003:054C:0DF2.0001: Invalid byte count transferred, expected 20 got 0 [ 147.709427][ T4178] usb write operation failed. (-71) [ 147.740243][ T4178] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 147.757484][ T4178] dvbdev: DVB: registering new adapter (Terratec H7) [ 147.767792][ T4178] usb 7-1: media controller created [ 147.788904][ T4178] usb read operation failed. (-71) [ 147.791862][ T4236] playstation 0003:054C:0DF2.0001: Failed to retrieve DualSense pairing info: -22 [ 147.811976][ T4236] playstation 0003:054C:0DF2.0001: Failed to get MAC address from DualSense [ 147.814630][ T4178] usb write operation failed. (-71) [ 147.820792][ T4236] playstation 0003:054C:0DF2.0001: Failed to create dualsense. [ 147.849427][ T4178] dvb_usb_az6007: probe of 7-1:0.0 failed with error -5 [ 147.853820][ T4236] playstation: probe of 0003:054C:0DF2.0001 failed with error -22 [ 147.879173][ T4178] usb 7-1: USB disconnect, device number 3 [ 147.934822][ T4236] usb 3-1: USB disconnect, device number 5 [ 148.014314][ T6386] fido_id[6386]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 148.183328][ T21] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 148.190844][ T21] f81534 1-1:0.12: f81534_find_config_idx: read failed: -71 [ 148.201442][ T21] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 148.209186][ T21] f81534: probe of 1-1:0.12 failed with error -71 [ 148.225085][ T21] usb 1-1: USB disconnect, device number 3 [ 148.244010][ T6407] device syzkaller0 entered promiscuous mode [ 148.261913][ T6407] tipc: Enabled bearer , priority 0 [ 148.270112][ T6406] tipc: Resetting bearer [ 148.301016][ T6406] tipc: Disabling bearer [ 149.143440][ T6439] device syzkaller0 entered promiscuous mode [ 149.170450][ T6439] tipc: Enabled bearer , priority 0 [ 149.182539][ T6438] tipc: Resetting bearer [ 149.212101][ T6438] tipc: Disabling bearer [ 149.423622][ T21] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 149.673487][ T21] usb 5-1: Using ep0 maxpacket: 32 [ 149.689969][ C1] vcan0: j1939_tp_rxtimer: 0xffff888027470800: rx timeout, send abort [ 149.701277][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888027470800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 149.843782][ T21] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 149.861106][ T21] usb 5-1: config 0 has no interface number 0 [ 150.053953][ T21] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 150.091056][ T21] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.231048][ T21] usb 5-1: Product: syz [ 150.235526][ T21] usb 5-1: Manufacturer: syz [ 150.243447][ T4236] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 150.405938][ T21] usb 5-1: SerialNumber: syz [ 150.422886][ T21] usb 5-1: config 0 descriptor?? [ 150.438305][ T6464] block device autoloading is deprecated and will be removed. [ 150.467681][ T21] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 150.729723][ T6441] udc-core: couldn't find an available UDC or it's busy [ 150.801941][ T6441] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 151.143738][ T21] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 151.168855][ T21] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 151.493237][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 151.523422][ T4178] usb 5-1: USB disconnect, device number 4 [ 151.548659][ T4178] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 151.576878][ T4178] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 151.640871][ T4178] quatech2 5-1:0.51: device disconnected [ 152.353391][ T4275] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 152.373522][ T4236] usb 3-1: device descriptor read/all, error -71 [ 152.733612][ T4275] usb 7-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 152.753434][ T1107] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 152.859621][ T4275] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.088509][ T4275] usb 7-1: config 0 descriptor?? [ 153.328719][ T4275] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 153.383620][ T4275] gp8psk: usb in 128 operation failed. [ 153.413509][ T4275] gp8psk: usb in 137 operation failed. [ 153.419021][ T4275] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 153.478842][ T4275] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 153.503621][ T1107] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 153.508726][ T6512] loop2: detected capacity change from 0 to 128 [ 153.524170][ T4275] usb 7-1: USB disconnect, device number 4 [ 153.533393][ T1107] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.562524][ T1107] usb 5-1: Product: syz [ 153.584178][ T1107] usb 5-1: Manufacturer: syz [ 153.588809][ T1107] usb 5-1: SerialNumber: syz [ 153.625041][ T1107] usb 5-1: config 0 descriptor?? [ 153.648777][ T6518] ufs: You didn't specify the type of your ufs filesystem [ 153.648777][ T6518] [ 153.648777][ T6518] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 153.648777][ T6518] [ 153.648777][ T6518] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 153.721617][ T6518] ufs: ufstype=old is supported read-only [ 153.750462][ T6518] ufs: ufs_fill_super(): bad magic number [ 154.658517][ T6531] loop6: detected capacity change from 0 to 128 [ 154.717779][ T6531] EXT4-fs (loop6): Ignoring removed nobh option [ 154.761751][ T6531] EXT4-fs (loop6): mounted filesystem without journal. Opts: nobh,max_dir_size_kb=0x0000000000000004,,errors=continue. Quota mode: none. [ 154.830548][ T6531] ext4 filesystem being mounted at /83/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 154.942427][ T1107] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 154.967485][ T6540] netlink: 48 bytes leftover after parsing attributes in process `syz.0.577'. [ 156.346193][ T7] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 156.627152][ T7] usb 7-1: Using ep0 maxpacket: 8 [ 156.696600][ T4275] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 156.763600][ T7] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 156.779910][ T7] usb 7-1: config 0 has no interfaces? [ 156.943404][ T7] usb 7-1: New USB device found, idVendor=110a, idProduct=1450, bcdDevice=62.cb [ 156.956990][ T7] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.966028][ T7] usb 7-1: Product: syz [ 156.970603][ T7] usb 7-1: Manufacturer: syz [ 156.975879][ T7] usb 7-1: SerialNumber: syz [ 156.990313][ T7] usb 7-1: config 0 descriptor?? [ 156.995552][ T4275] usb 1-1: Using ep0 maxpacket: 32 [ 157.053497][ T1107] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 157.063480][ T1107] usb 5-1: USB disconnect, device number 5 [ 157.123348][ T4275] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 157.240302][ T7] usb 7-1: USB disconnect, device number 5 [ 157.323384][ T4275] usb 1-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 157.332627][ T4275] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.340717][ T4275] usb 1-1: Product: syz [ 157.345101][ T4275] usb 1-1: Manufacturer: syz [ 157.349732][ T4275] usb 1-1: SerialNumber: syz [ 157.356950][ T4275] usb 1-1: config 0 descriptor?? [ 157.405081][ T4275] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 157.790300][ T6596] autofs4:pid:6596:autofs_fill_super: called with bogus options [ 157.903249][ T21] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 158.193239][ T4178] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 158.325838][ T4275] input: gspca_pac7302 as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 158.423666][ T21] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 158.423695][ T21] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.423715][ T21] usb 5-1: Product: syz [ 158.423730][ T21] usb 5-1: Manufacturer: syz [ 158.423744][ T21] usb 5-1: SerialNumber: syz [ 158.427493][ T21] usb 5-1: config 0 descriptor?? [ 158.562731][ T1109] usb 1-1: USB disconnect, device number 4 [ 158.568978][ T4178] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 158.569061][ T4178] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 158.569085][ T4178] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.570848][ T4178] usb 7-1: config 0 descriptor?? [ 158.618036][ T4178] pwc: Askey VC010 type 2 USB webcam detected. [ 158.695921][ T21] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 158.815401][ T4178] pwc: send_video_command error -71 [ 158.822161][ T4178] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 158.842457][ T4178] Philips webcam: probe of 7-1:0.0 failed with error -71 [ 158.886081][ T4178] usb 7-1: USB disconnect, device number 6 [ 159.523306][ T4178] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 159.894057][ T4178] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 159.923273][ T4178] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 159.953296][ T4178] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.988233][ T4178] usb 7-1: config 0 descriptor?? [ 160.035448][ T4178] pwc: Askey VC010 type 2 USB webcam detected. [ 160.483568][ T4178] pwc: recv_control_msg error -32 req 02 val 2b00 [ 160.544299][ T4178] pwc: recv_control_msg error -32 req 02 val 2700 [ 160.643687][ T4178] pwc: recv_control_msg error -32 req 02 val 2c00 [ 160.774618][ T21] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -71 [ 160.796149][ T4178] pwc: recv_control_msg error -32 req 04 val 1000 [ 160.820507][ T21] usb 5-1: USB disconnect, device number 6 [ 160.866878][ T4178] pwc: recv_control_msg error -32 req 04 val 1300 [ 160.928741][ T4178] pwc: recv_control_msg error -32 req 04 val 1400 [ 160.973292][ T4178] pwc: recv_control_msg error -32 req 02 val 2000 [ 161.013348][ T4178] pwc: recv_control_msg error -32 req 02 val 2100 [ 161.263368][ T7] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 161.273314][ T4178] pwc: recv_control_msg error -71 req 02 val 2500 [ 161.295002][ T4178] pwc: recv_control_msg error -71 req 02 val 2400 [ 161.314264][ T4178] pwc: recv_control_msg error -71 req 02 val 2600 [ 161.340451][ T4178] pwc: recv_control_msg error -71 req 02 val 2900 [ 161.363318][ T4178] pwc: recv_control_msg error -71 req 02 val 2800 [ 161.383482][ T4178] pwc: recv_control_msg error -71 req 04 val 1100 [ 161.403311][ T4178] pwc: recv_control_msg error -71 req 04 val 1200 [ 161.418073][ T4178] pwc: Registered as video103. [ 161.424868][ T4178] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input6 [ 161.454249][ T4178] usb 7-1: USB disconnect, device number 7 [ 161.613341][ T7] usb 3-1: Using ep0 maxpacket: 32 [ 162.208740][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807d54b000: rx timeout, send abort [ 162.217320][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88807d54b000: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 162.587140][ T7] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 162.599261][ T7] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 162.725115][ T7] usb 3-1: config 0 interface 0 has no altsetting 0 [ 163.406548][ T1107] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 163.513256][ T7] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 163.522327][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.541556][ T7] usb 3-1: Product: syz [ 163.546228][ T7] usb 3-1: Manufacturer: syz [ 163.551278][ T7] usb 3-1: SerialNumber: syz [ 163.569281][ T7] usb 3-1: config 0 descriptor?? [ 163.597068][ T6692] loop0: detected capacity change from 0 to 128 [ 163.673345][ T1107] usb 7-1: Using ep0 maxpacket: 32 [ 163.823685][ T1107] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 163.842027][ T1107] usb 7-1: config 0 has no interface number 0 [ 164.033611][ T1107] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 164.052938][ T1107] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 164.063884][ T1107] usb 7-1: Product: syz [ 164.068075][ T1107] usb 7-1: Manufacturer: syz [ 164.089510][ T1107] usb 7-1: SerialNumber: syz [ 164.101401][ T1107] usb 7-1: config 0 descriptor?? [ 164.154951][ T1107] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 164.848542][ T6675] udc-core: couldn't find an available UDC or it's busy [ 164.856695][ T6675] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 165.175542][ T4274] usb 3-1: USB disconnect, device number 8 [ 165.263904][ T1107] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 165.276817][ T1107] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 165.514769][ T4274] usb 7-1: USB disconnect, device number 8 [ 165.533216][ C0] usb 7-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 165.546780][ T4274] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 165.720831][ T4274] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 165.733694][ T4274] quatech2 7-1:0.51: device disconnected [ 166.113358][ T4274] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 166.393235][ T4274] usb 1-1: Using ep0 maxpacket: 8 [ 166.673923][ T4274] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 166.701158][ T4274] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.771048][ T4274] usb 1-1: Product: syz [ 166.795522][ T6750] binder: BINDER_SET_CONTEXT_MGR already set [ 166.798665][ T4274] usb 1-1: Manufacturer: syz [ 166.802055][ T6750] binder: 6749:6750 ioctl 4018620d 200000000540 returned -16 [ 166.839366][ T6753] loop2: detected capacity change from 0 to 128 [ 166.866842][ T4274] usb 1-1: SerialNumber: syz [ 167.184325][ T4235] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 167.230175][ T6770] device syzkaller0 entered promiscuous mode [ 167.247564][ T6770] tipc: Enabled bearer , priority 0 [ 167.260989][ T6769] tipc: Resetting bearer [ 167.281990][ T6769] tipc: Disabling bearer [ 167.389806][ T4204] Bluetooth: hci4: Ignoring connect complete event for invalid link type [ 167.603743][ T4274] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 167.613423][ T4235] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.649197][ T4274] usb 1-1: clock source 0 is not valid, cannot use [ 167.668852][ T4235] usb 5-1: config 0 has no interfaces? [ 167.718842][ T4235] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 167.773686][ T4274] usb 1-1: 1:1: cannot get freq (v2/v3): err -32 [ 167.818321][ T4235] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 167.936456][ T4235] usb 5-1: config 0 descriptor?? [ 168.073721][ T4274] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 168.085171][ T4232] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 168.109816][ T4274] usb 1-1: clock source 0 is not valid, cannot use [ 168.143607][ T4274] usb 1-1: 2:1: cannot get freq (v2/v3): err -71 [ 168.173395][ T4274] usb 1-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 168.213443][ T6790] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 168.239309][ T4178] usb 5-1: USB disconnect, device number 7 [ 168.295057][ T4274] usb 1-1: USB disconnect, device number 5 [ 168.356456][ T4232] usb 7-1: Using ep0 maxpacket: 16 [ 168.493439][ T4232] usb 7-1: config 0 has an invalid interface number: 34 but max is 0 [ 168.493469][ T4232] usb 7-1: config 0 has no interface number 0 [ 168.493498][ T4232] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 168.493524][ T4232] usb 7-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 168.585650][ T4385] udevd[4385]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 168.673422][ T4232] usb 7-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 168.673453][ T4232] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.673474][ T4232] usb 7-1: Product: syz [ 168.673488][ T4232] usb 7-1: Manufacturer: syz [ 168.673504][ T4232] usb 7-1: SerialNumber: syz [ 168.675964][ T4232] usb 7-1: config 0 descriptor?? [ 168.743625][ T6768] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 168.743772][ T6768] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 168.803398][ T4178] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 168.910552][ T6800] tipc: Enabling of bearer rejected, failed to enable media [ 169.001160][ T6768] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 169.001246][ T6768] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 169.164225][ T4178] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 169.164252][ T4178] usb 5-1: config 0 has no interfaces? [ 169.164278][ T4178] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 169.164302][ T4178] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.242797][ T4178] usb 5-1: config 0 descriptor?? [ 169.424044][ T4232] asix 7-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 169.575773][ T6760] kvm: pic: non byte read [ 169.612836][ T6760] kvm: pic: non byte read [ 169.819728][ T6760] kvm: pic: single mode not supported [ 169.819943][ T6760] kvm: pic: level sensitive irq not supported [ 170.259756][ T4274] usb 5-1: USB disconnect, device number 8 [ 170.268245][ T6829] mmap: syz.2.682 (6829): VmData 37597184 exceed data ulimit 32767. Update limits or use boot option ignore_rlimit_data. [ 170.366523][ T6834] tipc: Enabled bearer , priority 0 [ 170.380551][ T6833] tipc: Disabling bearer [ 170.478456][ T6842] loop0: detected capacity change from 0 to 128 [ 170.913470][ T21] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 171.293617][ T21] usb 1-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 171.338903][ T21] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 171.713495][ T21] usb 1-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 171.738111][ T21] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.767459][ T21] usb 1-1: Product: syz [ 171.778139][ T21] usb 1-1: Manufacturer: syz [ 171.788524][ T21] usb 1-1: SerialNumber: syz [ 171.801691][ T21] usb 1-1: config 0 descriptor?? [ 171.858571][ T21] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 171.903382][ T4232] asix 7-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 171.919634][ T4232] asix: probe of 7-1:0.34 failed with error -71 [ 171.947296][ T4232] usb 7-1: USB disconnect, device number 9 [ 172.352210][ T6867] device syzkaller1 entered promiscuous mode [ 173.087301][ T6891] wg2 speed is unknown, defaulting to 1000 [ 173.133340][ T21] gspca_sunplus: reg_r err -71 [ 173.140494][ T21] sunplus: probe of 1-1:0.0 failed with error -71 [ 173.171401][ T21] usb 1-1: USB disconnect, device number 6 [ 174.191017][ T6899] fuse: Bad value for 'fd' [ 174.597577][ T6917] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.718'. [ 174.608126][ T6917] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.718'. [ 174.643287][ T4274] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 174.683431][ T4232] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 174.743295][ T4178] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 174.953298][ T4232] usb 5-1: Using ep0 maxpacket: 8 [ 175.003422][ T4274] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 175.021884][ T4274] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 175.136855][ T4232] usb 5-1: unable to get BOS descriptor or descriptor too short [ 175.223485][ T4274] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 175.232543][ T4274] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 175.240893][ T4274] usb 3-1: Manufacturer: syz [ 175.247238][ T4232] usb 5-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 175.247438][ T4232] usb 5-1: config 5 has 1 interface, different from the descriptor's value: 2 [ 175.424566][ T4232] usb 5-1: New USB device found, idVendor=0c45, idProduct=628f, bcdDevice=4d.e2 [ 175.424726][ T4232] usb 5-1: New USB device strings: Mfr=77, Product=47, SerialNumber=112 [ 175.424842][ T4232] usb 5-1: Product: syz [ 175.424922][ T4232] usb 5-1: Manufacturer: syz [ 175.425026][ T4232] usb 5-1: SerialNumber: syz [ 175.871619][ T4274] usb 3-1: config 0 descriptor?? [ 175.873457][ T21] Bluetooth: hci1: command 0x0406 tx timeout [ 175.873519][ T21] Bluetooth: hci0: command 0x0406 tx timeout [ 175.873564][ T21] Bluetooth: hci2: command 0x0406 tx timeout [ 175.905374][ T4274] igorplugusb 3-1:0.0: incorrect number of endpoints [ 176.003530][ T4178] usb 1-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 176.053346][ T4178] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.061582][ T4178] usb 1-1: Product: syz [ 176.078282][ T4178] usb 1-1: Manufacturer: syz [ 176.088384][ T4178] usb 1-1: SerialNumber: syz [ 176.111121][ T4178] usb 1-1: config 0 descriptor?? [ 176.117661][ T1107] usb 3-1: USB disconnect, device number 9 [ 176.146323][ T4178] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 176.225666][ T4232] gspca_main: gspca_sn9c20x-2.14.0 probing 0c45:628f [ 176.258173][ T4232] gspca_sn9c20x: Write register 1000 failed -71 [ 176.273472][ T4232] gspca_sn9c20x: Device initialization failed [ 176.279787][ T4232] gspca_sn9c20x: probe of 5-1:5.0 failed with error -71 [ 176.281589][ T4232] usb 5-1: USB disconnect, device number 9 [ 176.516994][ T6946] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 176.516994][ T6946] The task syz.6.729 (6946) triggered the difference, watch for misbehavior. [ 177.034332][ T4274] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 177.283616][ T4274] usb 7-1: Using ep0 maxpacket: 16 [ 177.403486][ T4274] usb 7-1: unable to get BOS descriptor or descriptor too short [ 177.493975][ T4274] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 177.544073][ T4274] usb 7-1: can't read configurations, error -71 [ 178.493318][ T4235] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 178.733542][ T4235] usb 5-1: Using ep0 maxpacket: 8 [ 178.754004][ T4274] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 178.853855][ T4235] usb 5-1: config 0 has an invalid interface number: 249 but max is 0 [ 178.871725][ T4235] usb 5-1: config 0 has no interface number 0 [ 178.907133][ T4235] usb 5-1: too many endpoints for config 0 interface 249 altsetting 89: 187, using maximum allowed: 30 [ 178.992558][ T4235] usb 5-1: config 0 interface 249 altsetting 89 has 0 endpoint descriptors, different from the interface descriptor's value: 187 [ 179.013232][ T4274] usb 7-1: Using ep0 maxpacket: 16 [ 179.074495][ T4235] usb 5-1: config 0 interface 249 has no altsetting 0 [ 179.085814][ T4232] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 179.133367][ T4274] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 179.143765][ T4274] usb 7-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 179.154767][ T4274] usb 7-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid wMaxPacketSize 0 [ 179.169855][ T4274] usb 7-1: config 0 interface 0 has no altsetting 0 [ 179.176798][ T4274] usb 7-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.00 [ 179.186600][ T4274] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.221880][ T4274] usb 7-1: config 0 descriptor?? [ 179.262089][ T6999] fuse: Bad value for 'fd' [ 179.263615][ T4235] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 179.280160][ T4235] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.295344][ T4235] usb 5-1: Product: syz [ 179.299540][ T4235] usb 5-1: Manufacturer: syz [ 179.304220][ T4235] usb 5-1: SerialNumber: syz [ 179.311313][ T4235] usb 5-1: config 0 descriptor?? [ 179.318597][ T7001] netlink: 'syz.5.747': attribute type 62 has an invalid length. [ 179.506260][ T4178] gspca_stk1135: reg_w 0x353 err -71 [ 179.512616][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.522554][ T4178] gspca_stk1135: Sensor write failed [ 179.526262][ T4232] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 179.532612][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.553393][ T4232] usb 3-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 179.556712][ T4178] gspca_stk1135: Sensor write failed [ 179.569994][ T4232] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.575441][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.594894][ T4235] gspca_main: se401-2.14.0 probing 047d:5003 [ 179.601665][ T4178] gspca_stk1135: Sensor read failed [ 179.610346][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.629816][ T4178] gspca_stk1135: Sensor read failed [ 179.635392][ T4178] gspca_stk1135: Detected sensor type unknown (0x0) [ 179.645575][ T4232] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 179.648943][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.658331][ T4178] gspca_stk1135: Sensor read failed [ 179.671012][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.677694][ T4178] gspca_stk1135: Sensor read failed [ 179.682933][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.698919][ T4178] gspca_stk1135: Sensor write failed [ 179.717010][ T4274] hid (null): unknown global tag 0xd [ 179.725557][ T4178] gspca_stk1135: serial bus timeout: status=0x00 [ 179.731898][ T4178] gspca_stk1135: Sensor write failed [ 179.743605][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.750770][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.766390][ T4178] stk1135: probe of 1-1:0.0 failed with error -71 [ 179.776769][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.798846][ T4178] usb 1-1: USB disconnect, device number 7 [ 179.808666][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.820994][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.839699][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.848065][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.855552][ T4274] glorious 0003:258A:0033.0002: unknown main item tag 0x0 [ 179.866210][ T4274] glorious 0003:258A:0033.0002: unknown global tag 0xd [ 179.873132][ T4274] glorious 0003:258A:0033.0002: item 0 0 1 13 parsing failed [ 179.880822][ T4274] glorious: probe of 0003:258A:0033.0002 failed with error -22 [ 179.920629][ T4275] usb 7-1: USB disconnect, device number 11 [ 180.063270][ T4235] usb 5-1: reset high-speed USB device number 10 using dummy_hcd [ 180.753671][ T4232] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 180.819311][ T7032] tipc: Enabled bearer , priority 0 [ 180.829989][ T4232] stv0680 3-1:4.0: STV(e): camera ping failed!! [ 180.913979][ T4232] stv0680 3-1:4.0: last error: 71, command = 0xd [ 180.934129][ T7031] tipc: Disabling bearer [ 181.147443][ T4232] usb 3-1: USB disconnect, device number 10 [ 181.270606][ T4235] usb 5-1: failed to restore interface 249 altsetting 89 (error=-71) [ 181.281604][ T4235] gspca_se401: read req failed req 0x06 error -19 [ 181.380777][ T4235] usb 5-1: USB disconnect, device number 10 [ 181.463469][ T7043] netlink: 12 bytes leftover after parsing attributes in process `syz.5.764'. [ 181.533427][ T1109] usb 7-1: new full-speed USB device number 12 using dummy_hcd [ 181.675671][ T4274] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 181.848114][ T7058] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 181.894663][ T7056] tipc: Enabled bearer , priority 0 [ 181.953438][ T4274] usb 1-1: Using ep0 maxpacket: 32 [ 182.002525][ T7055] tipc: Disabling bearer [ 182.074041][ T4274] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 182.083711][ T1109] usb 7-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 182.107009][ T4274] usb 1-1: config 0 has no interface number 0 [ 182.119832][ T1109] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.163150][ T1109] usb 7-1: Product: syz [ 182.189381][ T1109] usb 7-1: Manufacturer: syz [ 182.219402][ T1109] usb 7-1: SerialNumber: syz [ 182.303850][ T4274] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 182.322304][ T1109] usb 7-1: config 0 descriptor?? [ 182.327579][ T4274] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.336734][ T4274] usb 1-1: Product: syz [ 182.340977][ T4274] usb 1-1: Manufacturer: syz [ 182.345659][ T4274] usb 1-1: SerialNumber: syz [ 182.352044][ T4274] usb 1-1: config 0 descriptor?? [ 182.375268][ T1109] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 182.464699][ T4274] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 182.636198][ T4274] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 182.647767][ T4274] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 183.481600][ T7084] loop4: detected capacity change from 0 to 128 [ 183.623152][ T21] usb 1-1: USB disconnect, device number 8 [ 183.633351][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -108 [ 183.644184][ T21] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 183.657644][ T21] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 183.669198][ T21] quatech2 1-1:0.51: device disconnected [ 183.763296][ T4235] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 184.123446][ T4235] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 184.135064][ T4235] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 184.148793][ T4235] usb 3-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 184.172263][ T4235] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 184.188974][ T4235] usb 3-1: config 0 descriptor?? [ 184.213557][ T7086] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 184.477377][ T4205] ================================================================== [ 184.485777][ T4205] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x1333/0x3cb0 [ 184.493600][ T4205] Read of size 1 at addr ffff888077e14c0a by task kworker/u5:6/4205 [ 184.501581][ T4205] [ 184.503908][ T4205] CPU: 1 PID: 4205 Comm: kworker/u5:6 Not tainted syzkaller #0 [ 184.511458][ T4205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 184.521508][ T4205] Workqueue: hci0 hci_rx_work [ 184.526196][ T4205] Call Trace: [ 184.529778][ T4205] [ 184.532699][ T4205] dump_stack_lvl+0x188/0x250 [ 184.537381][ T4205] ? show_regs_print_info+0x20/0x20 [ 184.542574][ T4205] ? load_image+0x400/0x400 [ 184.547064][ T4205] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 184.552510][ T4205] ? mutex_lock_io_nested+0x60/0x60 [ 184.557704][ T4205] print_address_description+0x60/0x2d0 [ 184.563238][ T4205] ? hci_le_meta_evt+0x1333/0x3cb0 [ 184.568334][ T4205] kasan_report+0xdf/0x130 [ 184.572740][ T4205] ? hci_le_meta_evt+0x1333/0x3cb0 [ 184.577836][ T4205] hci_le_meta_evt+0x1333/0x3cb0 [ 184.582769][ T4205] ? hci_remote_host_features_evt+0x290/0x290 [ 184.588824][ T4205] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 184.594444][ T4205] ? mark_lock+0x94/0x320 [ 184.598756][ T4205] ? mutex_unlock+0x10/0x10 [ 184.603244][ T4205] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 184.609211][ T4205] ? lock_chain_count+0x20/0x20 [ 184.614047][ T4205] ? __rwlock_init+0x140/0x140 [ 184.618799][ T4205] hci_event_packet+0xe4b/0x1370 [ 184.623722][ T4205] ? lockdep_hardirqs_on+0x94/0x140 [ 184.628911][ T4205] ? rcu_lock_release+0x20/0x20 [ 184.633751][ T4205] ? hci_send_to_monitor+0x9c/0x4a0 [ 184.638936][ T4205] hci_rx_work+0x255/0xa10 [ 184.643348][ T4205] process_one_work+0x85f/0x1010 [ 184.648281][ T4205] ? worker_detach_from_pool+0x240/0x240 [ 184.653895][ T4205] ? lockdep_hardirqs_off+0x70/0x100 [ 184.659169][ T4205] ? _raw_spin_lock_irq+0xb7/0xf0 [ 184.664178][ T4205] ? _raw_spin_lock_irqsave+0x100/0x100 [ 184.669712][ T4205] ? wq_worker_running+0x97/0x170 [ 184.674731][ T4205] worker_thread+0xaa6/0x1290 [ 184.679421][ T4205] kthread+0x436/0x520 [ 184.683476][ T4205] ? rcu_lock_release+0x20/0x20 [ 184.688322][ T4205] ? kthread_blkcg+0xd0/0xd0 [ 184.692897][ T4205] ret_from_fork+0x1f/0x30 [ 184.697311][ T4205] [ 184.700321][ T4205] [ 184.702627][ T4205] Allocated by task 7097: [ 184.706941][ T4205] __kasan_kmalloc+0xb5/0xf0 [ 184.711519][ T4205] __alloc_skb+0x22c/0x750 [ 184.715917][ T4205] vhci_write+0xbc/0x450 [ 184.720146][ T4205] vfs_write+0x745/0xd60 [ 184.724369][ T4205] ksys_write+0x152/0x260 [ 184.728683][ T4205] do_syscall_64+0x4c/0xa0 [ 184.733081][ T4205] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 184.738958][ T4205] [ 184.741274][ T4205] The buggy address belongs to the object at ffff888077e14800 [ 184.741274][ T4205] which belongs to the cache kmalloc-1k of size 1024 [ 184.755325][ T4205] The buggy address is located 10 bytes to the right of [ 184.755325][ T4205] 1024-byte region [ffff888077e14800, ffff888077e14c00) [ 184.769133][ T4205] The buggy address belongs to the page: [ 184.774751][ T4205] page:ffffea0001df8400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77e10 [ 184.784881][ T4205] head:ffffea0001df8400 order:3 compound_mapcount:0 compound_pincount:0 [ 184.793195][ T4205] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 184.801167][ T4205] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41dc0 [ 184.809731][ T4205] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 184.818290][ T4205] page dumped because: kasan: bad access detected [ 184.824684][ T4205] page_owner tracks the page as allocated [ 184.830379][ T4205] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1f2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_MEMALLOC|__GFP_HARDWALL), pid 1176, ts 60688540984, free_ts 58271508735 [ 184.851549][ T4205] get_page_from_freelist+0x1bbd/0x1ca0 [ 184.857084][ T4205] __alloc_pages+0x1ee/0x480 [ 184.861658][ T4205] new_slab+0xc0/0x4b0 [ 184.865710][ T4205] ___slab_alloc+0x80a/0xdd0 [ 184.870284][ T4205] __kmalloc_node_track_caller+0x1fc/0x3a0 [ 184.876074][ T4205] __alloc_skb+0x22c/0x750 [ 184.880478][ T4205] __netdev_alloc_skb+0x110/0x4c0 [ 184.885488][ T4205] batadv_iv_ogm_queue_add+0x7e8/0xd90 [ 184.890934][ T4205] batadv_iv_ogm_schedule+0xae2/0xec0 [ 184.896288][ T4205] batadv_iv_send_outstanding_bat_ogm_packet+0x726/0x830 [ 184.903292][ T4205] process_one_work+0x85f/0x1010 [ 184.908215][ T4205] worker_thread+0xaa6/0x1290 [ 184.912872][ T4205] kthread+0x436/0x520 [ 184.916930][ T4205] ret_from_fork+0x1f/0x30 [ 184.921329][ T4205] page last free stack trace: [ 184.925983][ T4205] free_unref_page_prepare+0x637/0x6c0 [ 184.931425][ T4205] free_unref_page+0x8f/0x2a0 [ 184.936083][ T4205] __unfreeze_partials+0x1a5/0x200 [ 184.941175][ T4205] put_cpu_partial+0x12d/0x190 [ 184.945918][ T4205] qlist_free_all+0x35/0x90 [ 184.950404][ T4205] kasan_quarantine_reduce+0x150/0x160 [ 184.955845][ T4205] __kasan_slab_alloc+0x2f/0xd0 [ 184.960680][ T4205] slab_post_alloc_hook+0x4c/0x380 [ 184.965774][ T4205] kmem_cache_alloc_trace+0x103/0x2a0 [ 184.971124][ T4205] nsim_fib6_rt_nh_add+0x53/0x210 [ 184.976129][ T4205] nsim_fib_event_work+0x1ca4/0x33e0 [ 184.981397][ T4205] process_one_work+0x85f/0x1010 [ 184.986315][ T4205] worker_thread+0xd60/0x1290 [ 184.990974][ T4205] kthread+0x436/0x520 [ 184.995022][ T4205] ret_from_fork+0x1f/0x30 [ 184.999421][ T4205] [ 185.001726][ T4205] Memory state around the buggy address: [ 185.007335][ T4205] ffff888077e14b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 185.015381][ T4205] ffff888077e14b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 185.023425][ T4205] >ffff888077e14c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 185.031462][ T4205] ^ [ 185.035769][ T4205] ffff888077e14c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 185.043812][ T4205] ffff888077e14d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 185.051850][ T4205] ================================================================== [ 185.059890][ T4205] Disabling lock debugging due to kernel taint [ 185.070046][ T4275] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 185.074275][ T4205] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 185.084707][ T4205] CPU: 1 PID: 4205 Comm: kworker/u5:6 Tainted: G B syzkaller #0 [ 185.093640][ T4205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 185.103691][ T4205] Workqueue: hci0 hci_rx_work [ 185.108357][ T4205] Call Trace: [ 185.111619][ T4205] [ 185.114530][ T4205] dump_stack_lvl+0x188/0x250 [ 185.119188][ T4205] ? show_regs_print_info+0x20/0x20 [ 185.124373][ T4205] ? load_image+0x400/0x400 [ 185.128876][ T4205] panic+0x2e5/0x810 [ 185.132755][ T4205] ? bpf_jit_dump+0xd0/0xd0 [ 185.137238][ T4205] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 185.143202][ T4205] ? _raw_spin_unlock+0x40/0x40 [ 185.148033][ T4205] ? hci_le_meta_evt+0x1333/0x3cb0 [ 185.153124][ T4205] check_panic_on_warn+0x80/0xa0 [ 185.158045][ T4205] ? hci_le_meta_evt+0x1333/0x3cb0 [ 185.163133][ T4205] end_report+0x6d/0xf0 [ 185.167276][ T4205] kasan_report+0x102/0x130 [ 185.171760][ T4205] ? hci_le_meta_evt+0x1333/0x3cb0 [ 185.176851][ T4205] hci_le_meta_evt+0x1333/0x3cb0 [ 185.181772][ T4205] ? hci_remote_host_features_evt+0x290/0x290 [ 185.187820][ T4205] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 185.193432][ T4205] ? mark_lock+0x94/0x320 [ 185.197737][ T4205] ? mutex_unlock+0x10/0x10 [ 185.202219][ T4205] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 185.208177][ T4205] ? lock_chain_count+0x20/0x20 [ 185.213005][ T4205] ? __rwlock_init+0x140/0x140 [ 185.217750][ T4205] hci_event_packet+0xe4b/0x1370 [ 185.222668][ T4205] ? lockdep_hardirqs_on+0x94/0x140 [ 185.227849][ T4205] ? rcu_lock_release+0x20/0x20 [ 185.232681][ T4205] ? hci_send_to_monitor+0x9c/0x4a0 [ 185.237887][ T4205] hci_rx_work+0x255/0xa10 [ 185.242288][ T4205] process_one_work+0x85f/0x1010 [ 185.247216][ T4205] ? worker_detach_from_pool+0x240/0x240 [ 185.252832][ T4205] ? lockdep_hardirqs_off+0x70/0x100 [ 185.258101][ T4205] ? _raw_spin_lock_irq+0xb7/0xf0 [ 185.263118][ T4205] ? _raw_spin_lock_irqsave+0x100/0x100 [ 185.268651][ T4205] ? wq_worker_running+0x97/0x170 [ 185.273675][ T4205] worker_thread+0xaa6/0x1290 [ 185.278359][ T4205] kthread+0x436/0x520 [ 185.282409][ T4205] ? rcu_lock_release+0x20/0x20 [ 185.287240][ T4205] ? kthread_blkcg+0xd0/0xd0 [ 185.291812][ T4205] ret_from_fork+0x1f/0x30 [ 185.296221][ T4205] [ 185.299339][ T4205] Kernel Offset: disabled [ 185.303657][ T4205] Rebooting in 86400 seconds..