last executing test programs: 6.286352905s ago: executing program 2 (id=918): syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) socket(0x10, 0x803, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r1, 0x0, 0xffffffdb) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) setpriority(0x2, 0x0, 0x8) socket$pppoe(0x18, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240), 0x0}) 5.39195536s ago: executing program 1 (id=928): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000100)={0x2b, 0x22, 0x0, 0x2, 0x8, 0xa9, 0x5, 0x2, 0x1}) 5.258197627s ago: executing program 1 (id=929): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000001c0)={{0xffffffffffffffff, &(0x7f0000000080)='^\x00', 0x200000, &(0x7f00000000c0)={@align, {0x40, 0x4, 0x4, 0x8000000000000001}}, 0xfffffffa, 0x0, &(0x7f0000000140)=0x4}, {[0xa, 0x9, 0x10001, 0x7f]}, 0x1, 0x0, &(0x7f0000000180)}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f00000002c0)={0x8000000000003ff, 0x6, 0xffffffffffffffff, 0x5, 0x0, 0x0, 0x80000006, 0x3a08}, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000040) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x4) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000b0, 0x0, 0x7fff}]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ec) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000180)={&(0x7f00000003c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000001c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r5, 0xc06864a2, &(0x7f0000000600)={0x0, 0x0, r7, r8, 0x5, 0x200, 0x4, 0x5, {0x200007, 0x9, 0x5, 0xa, 0x8000, 0x9, 0x5, 0x5, 0x0, 0xfffc, 0x7, 0x60b, 0x71, 0xfffb, "6f4f1b1330d057b30bd15586b7445443c528a97436419c2cd5ae7297dceeb0be"}}) write(0xffffffffffffffff, &(0x7f0000001000)='A', 0x1) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x852}, 0x4) r9 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r9, 0x800448d2, &(0x7f0000000680)={0x2, &(0x7f0000000400)=[{}, {}]}) 4.287441538s ago: executing program 0 (id=933): unshare(0x2a060400) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4c, 0x0, &(0x7f0000000440)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x1000000, &(0x7f00000004c0)="84"}) 4.025880284s ago: executing program 3 (id=935): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x40001a2) r4 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r4, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r4, r4, &(0x7f0000000100)=0x4, 0x8112) 3.983379123s ago: executing program 0 (id=936): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14}}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b7080000000000007b", @ANYBLOB="0000000000000000b702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a", 0x27}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.421939332s ago: executing program 3 (id=939): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nfs/parameters/callback_tcpport\x00', 0x2, 0x0) r1 = dup2(r0, r0) write(r1, &(0x7f0000000140)='20c', 0x3) 2.414649508s ago: executing program 0 (id=949): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14}}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b7080000000000007b", @ANYBLOB="0000000000000000b702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.137224464s ago: executing program 3 (id=941): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) creat(&(0x7f0000000980)='./tracing/uprobe_events\x00', 0x2b) 2.137048045s ago: executing program 1 (id=942): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f00000042c0)=[{{&(0x7f00000000c0)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000001a80)}, 0x9}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x20, 0x0) 2.130421514s ago: executing program 0 (id=944): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000200)='%pi6 \x00'}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001600)=ANY=[@ANYBLOB="2c000000680001070000000000000000000000000000000008000100020000"], 0x2c}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r1}, 0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'ip6gre0\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x2f, 0x7, 0x80, 0xfffffffc, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, 0x40, 0x8, 0x20000, 0x136b819b}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) r5 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r5, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r4, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1b}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, 0x0, 0x0, 0x0) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r7, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x6, 0x0, 0x8100, 0x0, {0xc3, 0x3}, {}, {0xe, 0xd}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}}, 0x0) 2.031085652s ago: executing program 2 (id=945): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x10, 0x572, 0x8000, 0x9, "ff000d00009a468e0cd912098d00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x13) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000040)={0xa482, 0x2, 0x5, 0xf3, 0xd, "03e20000c3d794c1"}) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000140)=0x9) 1.948777826s ago: executing program 1 (id=946): unshare(0x2a060400) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000300)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x4c, 0x0, &(0x7f0000000440)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x1000000, &(0x7f00000004c0)="84"}) 1.899820173s ago: executing program 3 (id=947): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r0, 0x5412, 0x0) 1.815161279s ago: executing program 0 (id=950): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40080) openat(0xffffffffffffff9c, 0x0, 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc) keyctl$clear(0x11, 0xfffffffffffffffd) listen(r0, 0xa) add_key$keyring(&(0x7f0000000100), 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat(0xffffffffffffff9c, 0x0, 0x40, 0x1) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) sendfile(r2, r2, 0x0, 0x1002000ff) 1.677938982s ago: executing program 3 (id=951): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(r0, 0x4b52, &(0x7f0000000000)=""/14) 1.434484564s ago: executing program 2 (id=953): r0 = creat(&(0x7f0000000200)='./file0\x00', 0x109) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) open_by_handle_at(r1, 0x0, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) 1.338062215s ago: executing program 2 (id=954): setns(0xc9, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) socket(0x8, 0x5, 0x5) openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/failslab/space\x00', 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 1.152122876s ago: executing program 4 (id=956): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14}}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b7080000000000007b", @ANYBLOB="0000000000000000b702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.01731074s ago: executing program 4 (id=957): ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18}, './file1\x00'}) socket$alg(0x26, 0x5, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000200)=@hci={0x1f, 0xe00, 0xe}, 0x80, 0x0}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) write$P9_RFSYNC(0xffffffffffffffff, &(0x7f0000000180)={0x7, 0x33, 0x2}, 0x7) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f00000003c0)={{0x2, 0x4e22, @empty}, {0x20000010304, @local}, 0x0, {0x2, 0x4e20, @private=0xa010100}}) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f0000000100)=0x3) close(0x3) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a0000000400000008000000"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000700), &(0x7f0000000800), 0x4eaa, r3}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="180000000300000000000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300, 0x600}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}}, 0x6000) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB="04181cc967f6f6661360e795c004488acf02"], 0xfa) r5 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r5, r5}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) 861.24647ms ago: executing program 4 (id=958): semctl$IPC_SET(0x0, 0x0, 0x13, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0xee00, 0x0, 0x18, 0x2}, 0x457, 0xffffffff}) socket$inet_tcp(0x2, 0x1, 0x0) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mount(0x0, 0x0, &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys/bus/pci/rescan\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)="1d", 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x2) socket$inet6(0xa, 0x5, 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) userfaultfd(0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) socket$netlink(0x10, 0x3, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) chdir(&(0x7f0000000000)='./bus\x00') lchown(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x9, 0x3}, 0x30, 0x0) landlock_restrict_self(r2, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r3, 0x5) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) 843.704872ms ago: executing program 0 (id=959): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$nci(0xffffffffffffff9c, &(0x7f0000001640), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) socket$tipc(0x1e, 0x5, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000240), &(0x7f00000003c0)=@udp6=r3, 0x1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 833.158379ms ago: executing program 1 (id=960): bpf$PROG_LOAD(0x5, &(0x7f0000003a40)={0x1c, 0xf, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000001000000000000000400000018110000", @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008300bf0900000000000055090100000000000a432c279500000000000000bf91000000000000b7020000010000008500000084000000b700000000ffff0095"], 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14}}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b7080000000000007b", @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 687.499804ms ago: executing program 2 (id=961): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000200)='%pi6 \x00'}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001600)=ANY=[@ANYBLOB="2c000000680001070000000000000000000000000000000008000100020000"], 0x2c}}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r1}, 0x8) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000440)={'ip6gre0\x00', &(0x7f00000003c0)={'ip6gre0\x00', 0x0, 0x2f, 0x7, 0x80, 0xfffffffc, 0x12, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, 0x40, 0x8, 0x20000, 0x136b819b}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) r5 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000568000/0x2000)=nil, 0x2000, 0x0, 0x11, r5, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r4, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1b}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) r7 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r7, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) 674.252505ms ago: executing program 3 (id=962): pwrite64(0xffffffffffffffff, 0x0, 0x0, 0xfecc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0xdbee7000) 599.476011ms ago: executing program 4 (id=963): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r0, 0x5412, 0x0) 458.463169ms ago: executing program 1 (id=964): syz_usb_connect(0x2, 0x68, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904fb0002"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x34000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x0, 0x12000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0xeeee8000, 0x102000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 383.461291ms ago: executing program 4 (id=965): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 59.061096ms ago: executing program 4 (id=966): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') socket$igmp(0x2, 0x3, 0x2) socket$inet(0x2, 0x4000000000000001, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a69702c6d61726b"], 0x60}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x8c, 0x44, 0x1, 0x70bd29, 0x25dfdbff, {0x1}, [@nested={0x4, 0x48}, @nested={0x71, 0x1, 0x0, 0x1, [@generic="c78c42412853ec1e921ede6c39658fb028fcee3547aa485e20bea0210f8ffbe4dcf77806dbf6e042b498445afeb5e4a91de8bc7b72377be5fb59ff6b03b640d7bd736308b725e7fa1e2fc71ca09de48d27f4529f315fa1aeab3018edc394863c02db7fc8d899cc5ec2cfc8a94d"]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r3], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) 0s ago: executing program 2 (id=967): sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14}}, 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b7080000000000007b", @ANYBLOB="0000000000000000b702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed88", 0x3a}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts. [ 90.715364][ T5587] cgroup: Unknown subsys name 'net' [ 90.958683][ T5587] cgroup: Unknown subsys name 'cpuset' [ 91.010125][ T5587] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.410051][ T10] cfg80211: failed to load regulatory.db [ 93.293492][ T5587] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.135949][ T59] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.195259][ T5614] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.208020][ T5614] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.244310][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.246750][ T5618] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.270277][ T5618] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.272426][ T5614] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.294584][ T5618] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.302574][ T5614] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 97.308427][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.320611][ T5618] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 97.331919][ T5620] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.336184][ T5620] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 97.341287][ T5619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.348798][ T5619] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.351900][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.355485][ T5619] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.376386][ T4917] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.378605][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.386212][ T59] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.395477][ T59] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.406092][ T5619] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.423916][ T59] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.450630][ T59] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 97.455990][ T59] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 99.481859][ T59] Bluetooth: hci1: command tx timeout [ 99.560554][ T5609] Bluetooth: hci0: command tx timeout [ 99.560733][ T59] Bluetooth: hci4: command tx timeout [ 99.639532][ T5609] Bluetooth: hci3: command tx timeout [ 99.639717][ T59] Bluetooth: hci2: command tx timeout [ 100.380469][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.381821][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.382003][ T5601] bridge_slave_0: entered allmulticast mode [ 100.384626][ T5601] bridge_slave_0: entered promiscuous mode [ 100.388004][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.388127][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.388299][ T5603] bridge_slave_0: entered allmulticast mode [ 100.399213][ T5603] bridge_slave_0: entered promiscuous mode [ 100.478144][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.478265][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.478615][ T5602] bridge_slave_0: entered allmulticast mode [ 100.493447][ T5602] bridge_slave_0: entered promiscuous mode [ 100.510253][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.510435][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.510828][ T5601] bridge_slave_1: entered allmulticast mode [ 100.514764][ T5601] bridge_slave_1: entered promiscuous mode [ 100.515803][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.515921][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.516109][ T5603] bridge_slave_1: entered allmulticast mode [ 100.517953][ T5603] bridge_slave_1: entered promiscuous mode [ 100.593185][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.593309][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.593479][ T5602] bridge_slave_1: entered allmulticast mode [ 100.595703][ T5602] bridge_slave_1: entered promiscuous mode [ 100.659216][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.659999][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.660744][ T5604] bridge_slave_0: entered allmulticast mode [ 100.668757][ T5604] bridge_slave_0: entered promiscuous mode [ 100.687517][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.687642][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.687821][ T5606] bridge_slave_0: entered allmulticast mode [ 100.694406][ T5606] bridge_slave_0: entered promiscuous mode [ 100.768502][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.768635][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.768808][ T5604] bridge_slave_1: entered allmulticast mode [ 100.781628][ T5604] bridge_slave_1: entered promiscuous mode [ 100.795917][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.796090][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.796287][ T5606] bridge_slave_1: entered allmulticast mode [ 100.805168][ T5606] bridge_slave_1: entered promiscuous mode [ 100.842875][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.846160][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.892281][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.896192][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.898788][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.959874][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.000582][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.006299][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.072115][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.074882][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.109222][ T5601] team0: Port device team_slave_0 added [ 101.116945][ T5603] team0: Port device team_slave_0 added [ 101.154481][ T5602] team0: Port device team_slave_0 added [ 101.156932][ T5601] team0: Port device team_slave_1 added [ 101.158896][ T5603] team0: Port device team_slave_1 added [ 101.223559][ T5602] team0: Port device team_slave_1 added [ 101.260040][ T5604] team0: Port device team_slave_0 added [ 101.262989][ T5606] team0: Port device team_slave_0 added [ 101.318317][ T5604] team0: Port device team_slave_1 added [ 101.325127][ T5606] team0: Port device team_slave_1 added [ 101.348959][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.348973][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.348994][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.384664][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.384769][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.384836][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.463306][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.463320][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.463340][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.465024][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.465042][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.465072][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.466259][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.466269][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.466289][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.569909][ T59] Bluetooth: hci1: command tx timeout [ 101.624880][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.624898][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.624927][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.649513][ T5609] Bluetooth: hci0: command tx timeout [ 101.649594][ T59] Bluetooth: hci4: command tx timeout [ 101.697201][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.697215][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.697236][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.698475][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.698490][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.698520][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.729399][ T59] Bluetooth: hci2: command tx timeout [ 101.729437][ T59] Bluetooth: hci3: command tx timeout [ 101.814109][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.814127][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.814157][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.815388][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.815399][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.815419][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.476460][ T5601] hsr_slave_0: entered promiscuous mode [ 102.478959][ T5601] hsr_slave_1: entered promiscuous mode [ 102.499138][ T5603] hsr_slave_0: entered promiscuous mode [ 102.505563][ T5603] hsr_slave_1: entered promiscuous mode [ 102.506453][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 102.506573][ T5603] Cannot create hsr debugfs directory [ 102.558590][ T5602] hsr_slave_0: entered promiscuous mode [ 102.561610][ T5602] hsr_slave_1: entered promiscuous mode [ 102.564679][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 102.564749][ T5602] Cannot create hsr debugfs directory [ 102.623052][ T5604] hsr_slave_0: entered promiscuous mode [ 102.624150][ T5604] hsr_slave_1: entered promiscuous mode [ 102.624820][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 102.624837][ T5604] Cannot create hsr debugfs directory [ 102.652538][ T5606] hsr_slave_0: entered promiscuous mode [ 102.653604][ T5606] hsr_slave_1: entered promiscuous mode [ 102.654285][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 102.654302][ T5606] Cannot create hsr debugfs directory [ 103.652830][ T5609] Bluetooth: hci1: command tx timeout [ 103.720060][ T59] Bluetooth: hci0: command tx timeout [ 103.720180][ T5609] Bluetooth: hci4: command tx timeout [ 103.752408][ T5601] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 103.801019][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.811171][ T59] Bluetooth: hci2: command tx timeout [ 103.811324][ T5609] Bluetooth: hci3: command tx timeout [ 103.831067][ T5601] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 103.861720][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.866520][ T5601] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 103.917660][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.946091][ T5601] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 103.967212][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.097581][ T5602] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.126209][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.145872][ T5602] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.186816][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.201548][ T5602] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.238545][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.273684][ T5602] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.315232][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.507250][ T5603] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.535615][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.552295][ T5603] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.597051][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.609881][ T5603] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.634330][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.675736][ T5603] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.703085][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.852794][ T5604] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.885527][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.906790][ T5604] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.935347][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.959007][ T5604] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.995137][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.043192][ T5604] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.076674][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.255467][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.294756][ T5606] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.323260][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.344434][ T5606] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.385101][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.396775][ T5606] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.428636][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.447423][ T5606] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.484159][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.553373][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.598072][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.634578][ T1077] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.634751][ T1077] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.710640][ T1077] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.710749][ T1077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.725136][ T5609] Bluetooth: hci1: command tx timeout [ 105.787191][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.815626][ T5609] Bluetooth: hci4: command tx timeout [ 105.815673][ T5609] Bluetooth: hci0: command tx timeout [ 105.864363][ T2264] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.864530][ T2264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.879715][ T59] Bluetooth: hci3: command tx timeout [ 105.879748][ T59] Bluetooth: hci2: command tx timeout [ 105.932623][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.972022][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.972141][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.082508][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.127571][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.144164][ T2264] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.144316][ T2264] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.212858][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.213070][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.339061][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.408651][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.430999][ T3324] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.431218][ T3324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.540270][ T3324] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.540446][ T3324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.710865][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.821943][ T2304] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.822131][ T2304] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.885435][ T2304] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.885660][ T2304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.736616][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.075461][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.461759][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.557453][ T5602] veth0_vlan: entered promiscuous mode [ 108.638472][ T5602] veth1_vlan: entered promiscuous mode [ 108.737905][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.896682][ T5603] veth0_vlan: entered promiscuous mode [ 108.924985][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.926416][ T5601] veth0_vlan: entered promiscuous mode [ 108.948942][ T5602] veth0_macvtap: entered promiscuous mode [ 108.986265][ T5602] veth1_macvtap: entered promiscuous mode [ 109.024351][ T5603] veth1_vlan: entered promiscuous mode [ 109.039079][ T5601] veth1_vlan: entered promiscuous mode [ 109.124556][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.124882][ T5604] veth0_vlan: entered promiscuous mode [ 109.158046][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.234306][ T5604] veth1_vlan: entered promiscuous mode [ 109.336012][ T5603] veth0_macvtap: entered promiscuous mode [ 109.347975][ T5606] veth0_vlan: entered promiscuous mode [ 109.415605][ T5601] veth0_macvtap: entered promiscuous mode [ 109.446172][ T5603] veth1_macvtap: entered promiscuous mode [ 109.507120][ T5601] veth1_macvtap: entered promiscuous mode [ 109.536722][ T5606] veth1_vlan: entered promiscuous mode [ 109.796298][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.831199][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.854588][ T5604] veth0_macvtap: entered promiscuous mode [ 109.924841][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.932533][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.934977][ T5604] veth1_macvtap: entered promiscuous mode [ 110.002954][ T1028] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.002983][ T1028] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.126391][ T2264] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.126414][ T2264] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.129077][ T5606] veth0_macvtap: entered promiscuous mode [ 110.204863][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.330977][ T5606] veth1_macvtap: entered promiscuous mode [ 110.368912][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.968664][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.090625][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.373278][ T2264] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.373299][ T2264] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.570530][ T2264] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.570551][ T2264] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.591034][ T1028] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.002327][ T1077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.002347][ T1077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.417218][ T1077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.417243][ T1077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.684567][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.689051][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.934365][ T5808] capability: warning: `syz.1.6' uses deprecated v2 capabilities in a way that may be insecure [ 112.973053][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.973074][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.973395][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.393945][ T1028] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.393968][ T1028] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.168841][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.168864][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.282086][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.694279][ T5818] kernel profiling enabled (shift: 5) [ 115.304517][ T1181] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351495][ T3324] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351546][ T3324] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351586][ T3324] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351624][ T3324] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351662][ T3324] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351701][ T3324] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351740][ T3324] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351779][ T3324] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351817][ T3324] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351856][ T3324] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351895][ T3324] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351933][ T3324] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.351972][ T3324] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.352010][ T3324] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.352050][ T3324] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.352089][ T3324] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.774701][ T5706] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 118.121043][ T5706] usb 4-1: Using ep0 maxpacket: 16 [ 118.190154][ T5706] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 118.190192][ T5706] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 118.190219][ T5706] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 118.190267][ T5706] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 118.190293][ T5706] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.315748][ T5706] usb 4-1: config 0 descriptor?? [ 119.026790][ T5836] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 122.136288][ T5706] usbhid 4-1:0.0: can't add hid device: -71 [ 122.136430][ T5706] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 122.463486][ T5706] usb 4-1: USB disconnect, device number 2 [ 122.619379][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.639367][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.649378][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.659362][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.669375][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.679358][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.689363][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.699361][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.709362][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 122.719360][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 125.356576][ T5886] warning: `syz.3.20' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 126.760523][ T5707] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 126.881049][ T5892] Zero length message leads to an empty skb [ 126.958083][ T5707] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 126.958115][ T5707] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.958137][ T5707] usb 3-1: config 0 has no interface number 0 [ 126.958184][ T5707] usb 3-1: config 0 interface 251 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 127.017768][ T5707] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 127.017802][ T5707] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.017824][ T5707] usb 3-1: Product: syz [ 127.017840][ T5707] usb 3-1: Manufacturer: syz [ 127.017856][ T5707] usb 3-1: SerialNumber: syz [ 127.155565][ T5707] usb 3-1: config 0 descriptor?? [ 127.324090][ T5707] asix 3-1:0.251: probe with driver asix failed with error -22 [ 127.482017][ T5888] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 128.109602][ T5829] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 128.142773][ T198] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 128.229833][ T5862] usb 3-1: USB disconnect, device number 2 [ 128.300257][ T5829] usb 4-1: Using ep0 maxpacket: 16 [ 128.318427][ T5829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.318465][ T5829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.318491][ T5829] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 128.318540][ T5829] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 128.318567][ T5829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.330927][ T198] usb 1-1: Using ep0 maxpacket: 16 [ 128.361960][ T198] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.362027][ T198] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.362113][ T198] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 128.362225][ T198] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 128.362290][ T198] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.582873][ T5829] usb 4-1: config 0 descriptor?? [ 128.674955][ T198] usb 1-1: config 0 descriptor?? [ 129.776009][ T198] usbhid 1-1:0.0: can't add hid device: -71 [ 129.776168][ T198] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 129.809124][ T5829] usbhid 4-1:0.0: can't add hid device: -71 [ 129.809257][ T5829] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 129.920584][ T198] usb 1-1: USB disconnect, device number 2 [ 129.922410][ T5829] usb 4-1: USB disconnect, device number 3 [ 134.112760][ T5940] netlink: 20 bytes leftover after parsing attributes in process `syz.0.36'. [ 134.504169][ T5951] netlink: 12 bytes leftover after parsing attributes in process `syz.4.40'. [ 137.056783][ T5971] netlink: 20 bytes leftover after parsing attributes in process `syz.2.44'. [ 138.531331][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.531432][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 139.856030][ T5989] netlink: 28 bytes leftover after parsing attributes in process `syz.0.49'. [ 139.885140][ T37] audit: type=1800 audit(1785934951.762:2): pid=5960 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.42" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 139.925868][ T5960] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 139.928041][ T5960] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 139.928068][ T5960] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 139.980203][ T66] Bluetooth: hci5: Frame reassembly failed (-84) [ 140.235875][ T5960] syz.4.42 (5960) used greatest stack depth: 18624 bytes left [ 141.237380][ T6001] netlink: 12 bytes leftover after parsing attributes in process `syz.0.52'. [ 141.879478][ T5612] Bluetooth: hci5: command 0x1003 tx timeout [ 141.879539][ T5609] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 143.648835][ T59] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 144.835968][ T6017] syz.2.58 (6017) used greatest stack depth: 18408 bytes left [ 146.587166][ T6030] binder: BINDER_SET_CONTEXT_MGR already set [ 146.587183][ T6030] binder: 6028:6030 ioctl 4018620d 200000000300 returned -16 [ 150.105749][ T6047] netlink: 12 bytes leftover after parsing attributes in process `syz.1.68'. [ 154.326579][ T6074] netlink: 32 bytes leftover after parsing attributes in process `syz.2.76'. [ 154.777258][ T6091] netlink: 12 bytes leftover after parsing attributes in process `syz.1.81'. [ 165.640057][ T6164] netlink: 36 bytes leftover after parsing attributes in process `syz.0.102'. [ 165.779194][ T59] Bluetooth: hci4: link tx timeout [ 165.812140][ T59] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 166.790688][ T6195] netlink: 28 bytes leftover after parsing attributes in process `syz.4.114'. [ 166.889534][ T5610] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 167.052963][ T5610] usb 1-1: config 0 has an invalid interface number: 127 but max is 1 [ 167.052995][ T5610] usb 1-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 48 [ 167.053018][ T5610] usb 1-1: config 0 has no interface number 1 [ 167.053078][ T5610] usb 1-1: config 0 interface 127 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 167.053123][ T5610] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 29 [ 167.089483][ T5610] usb 1-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 167.089517][ T5610] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 167.089540][ T5610] usb 1-1: Product: syz [ 167.089556][ T5610] usb 1-1: Manufacturer: syz [ 167.089572][ T5610] usb 1-1: SerialNumber: syz [ 167.180505][ T5610] usb 1-1: config 0 descriptor?? [ 167.201229][ T5610] usb-storage 1-1:0.127: USB Mass Storage device detected [ 167.243698][ T5610] usb-storage 1-1:0.127: Quirks match for vid 1908 pid 1315: 20000 [ 167.383093][ T5610] usb-storage 1-1:0.0: USB Mass Storage device detected [ 167.465071][ T5610] usb-storage 1-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 167.888887][ T59] Bluetooth: hci4: command 0x0406 tx timeout [ 168.467664][ T5706] usb 1-1: USB disconnect, device number 3 [ 171.599636][ T5610] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 171.751166][ T5610] usb 3-1: Using ep0 maxpacket: 16 [ 171.753805][ T5610] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 171.753840][ T5610] usb 3-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 171.753865][ T5610] usb 3-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 28 [ 171.753894][ T5610] usb 3-1: config 0 interface 0 has no altsetting 0 [ 171.753928][ T5610] usb 3-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 171.753953][ T5610] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.845998][ T5610] usb 3-1: config 0 descriptor?? [ 172.108527][ T6276] netlink: 16 bytes leftover after parsing attributes in process `syz.1.143'. [ 173.795175][ T5610] usb 3-1: USB disconnect, device number 3 [ 175.269468][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 175.335778][ T5610] kernel read not supported for file /syz1 (pid: 5610 comm: kworker/0:4) [ 175.430129][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 175.438778][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 175.438807][ T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 175.438859][ T9] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 175.438904][ T9] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 175.438948][ T9] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 175.438977][ T9] usb 4-1: config 1 interface 1 has no altsetting 0 [ 175.531369][ T9] usb 4-1: string descriptor 0 read error: -22 [ 175.531556][ T9] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 175.531584][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 176.227144][ T9] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 176.979720][ T9] usb 4-1: USB disconnect, device number 4 [ 178.360006][ T6376] kvm: kvm [6371]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000005) = 0x100000801 [ 178.856628][ T6382] kvm: kvm [6380]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100000080 [ 178.872692][ T6382] kvm: kvm [6380]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x80 [ 179.491467][ T6394] FAULT_INJECTION: forcing a failure. [ 179.491467][ T6394] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 179.491529][ T6394] CPU: 1 UID: 0 PID: 6394 Comm: syz.4.182 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 179.491564][ T6394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 179.491587][ T6394] Call Trace: [ 179.491596][ T6394] [ 179.491613][ T6394] dump_stack_lvl+0xe8/0x150 [ 179.491669][ T6394] should_fail_ex+0x467/0x600 [ 179.491713][ T6394] _copy_from_user+0x2d/0xb0 [ 179.491745][ T6394] __sys_bpf+0x2e7/0xd90 [ 179.491780][ T6394] ? __pfx___sys_bpf+0x10/0x10 [ 179.491810][ T6394] ? do_futex+0x458/0x4e0 [ 179.491871][ T6394] ? rcu_is_watching+0x15/0xb0 [ 179.491908][ T6394] __x64_sys_bpf+0xba/0xd0 [ 179.491945][ T6394] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.491971][ T6394] do_syscall_64+0x174/0x580 [ 179.492003][ T6394] ? trace_irq_disable+0x3b/0x140 [ 179.492027][ T6394] ? clear_bhb_loop+0x40/0x90 [ 179.492056][ T6394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 179.492081][ T6394] RIP: 0033:0x7f2371e0e0d9 [ 179.492107][ T6394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 179.492126][ T6394] RSP: 002b:00007f2370045028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 179.492159][ T6394] RAX: ffffffffffffffda RBX: 00007f2372096090 RCX: 00007f2371e0e0d9 [ 179.492176][ T6394] RDX: 0000000000000050 RSI: 0000200000000340 RDI: 0000000000000000 [ 179.492192][ T6394] RBP: 00007f2371ea5024 R08: 0000000000000000 R09: 0000000000000000 [ 179.492207][ T6394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 179.492221][ T6394] R13: 00007f2372096128 R14: 00007f2372096090 R15: 00007ffdc06ebde8 [ 179.492257][ T6394] [ 183.491730][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 183.669437][ T9] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 183.669501][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 183.669531][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 183.669556][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 183.669602][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 183.669627][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.773552][ T9] usb 3-1: config 0 descriptor?? [ 184.652033][ T9] plantronics 0003:047F:FFFF.0002: reserved main item tag 0xd [ 185.203358][ T5706] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 185.269412][ T9] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 185.354969][ T9] usb 3-1: USB disconnect, device number 4 [ 185.361970][ T6439] netlink: 96 bytes leftover after parsing attributes in process `syz.1.187'. [ 185.388740][ T5706] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 185.388774][ T5706] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.628441][ T5706] usb 1-1: config 0 descriptor?? [ 185.789230][ T5706] cp210x 1-1:0.0: cp210x converter detected [ 186.004659][ T6457] fido_id[6457]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 186.142154][ T5706] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 186.949182][ T5706] usb 1-1: cp210x converter now attached to ttyUSB0 [ 187.074170][ T5706] usb 1-1: USB disconnect, device number 4 [ 187.248267][ T5706] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 187.369533][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 188.753597][ T5706] cp210x 1-1:0.0: device disconnected [ 188.789423][ T9] usb 3-1: device descriptor read/64, error -71 [ 189.058110][ T6481] Bluetooth: MGMT ver 1.23 [ 189.241278][ T6483] capability: warning: `syz.2.213' uses 32-bit capabilities (legacy support in use) [ 190.930122][ T6472] syz.3.210 (6472) used greatest stack depth: 17632 bytes left [ 191.918568][ T6524] syzkaller0: entered promiscuous mode [ 191.918597][ T6524] syzkaller0: entered allmulticast mode [ 192.106930][ T6526] input: syz0 as /devices/virtual/input/input7 [ 192.839242][ T6535] pim6reg1: entered promiscuous mode [ 192.840608][ T6535] pim6reg1: entered allmulticast mode [ 193.161315][ T6554] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.241'. [ 193.664317][ T6563] netlink: 12 bytes leftover after parsing attributes in process `syz.1.243'. [ 193.697426][ T6563] netlink: 48 bytes leftover after parsing attributes in process `syz.1.243'. [ 193.697741][ T6563] netlink: 48 bytes leftover after parsing attributes in process `syz.1.243'. [ 194.806964][ T6583] netlink: 1624 bytes leftover after parsing attributes in process `syz.4.254'. [ 196.335814][ T6608] netlink: 12 bytes leftover after parsing attributes in process `syz.4.260'. [ 196.355769][ T6608] netlink: 48 bytes leftover after parsing attributes in process `syz.4.260'. [ 196.356088][ T6608] netlink: 48 bytes leftover after parsing attributes in process `syz.4.260'. [ 196.990822][ T6590] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 198.908508][ T6650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.273'. [ 199.231387][ T6650] netlink: 48 bytes leftover after parsing attributes in process `syz.0.273'. [ 199.257408][ T6650] netlink: 48 bytes leftover after parsing attributes in process `syz.0.273'. [ 199.885290][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.885357][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 201.096394][ T6686] netlink: 12 bytes leftover after parsing attributes in process `syz.0.292'. [ 201.122739][ T6686] netlink: 48 bytes leftover after parsing attributes in process `syz.0.292'. [ 201.123040][ T6686] netlink: 48 bytes leftover after parsing attributes in process `syz.0.292'. [ 201.291596][ T6691] binder_alloc: 6690: binder_alloc_buf, no vma [ 201.295018][ T6691] binder: 6690:6691 ioctl c0306201 200000000580 returned -14 [ 201.411157][ T5733] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 201.559498][ T5733] usb 2-1: Using ep0 maxpacket: 16 [ 201.561965][ T5733] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.562001][ T5733] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 201.562026][ T5733] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 201.562073][ T5733] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 201.562098][ T5733] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.640571][ T5733] usb 2-1: config 0 descriptor?? [ 203.352643][ T5733] usbhid 2-1:0.0: can't add hid device: -71 [ 203.352775][ T5733] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 203.405605][ T6725] netlink: 48 bytes leftover after parsing attributes in process `syz.3.306'. [ 203.405809][ T6725] netlink: 48 bytes leftover after parsing attributes in process `syz.3.306'. [ 203.512336][ T5733] usb 2-1: USB disconnect, device number 2 [ 203.578102][ T6728] binder_alloc: 6726: binder_alloc_buf, no vma [ 203.578201][ T6728] binder: 6726:6728 ioctl c0306201 200000000580 returned -14 [ 203.610139][ T6729] netlink: 12 bytes leftover after parsing attributes in process `syz.3.307'. [ 203.663851][ T6729] netlink: 48 bytes leftover after parsing attributes in process `syz.3.307'. [ 207.834270][ T6767] __nla_validate_parse: 1 callbacks suppressed [ 207.834342][ T6767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.322'. [ 208.157501][ T6767] netlink: 8 bytes leftover after parsing attributes in process `syz.4.322'. [ 208.157525][ T6767] netlink: 4 bytes leftover after parsing attributes in process `syz.4.322'. [ 208.217966][ T6771] binder_alloc: 6769: binder_alloc_buf, no vma [ 208.218069][ T6771] binder: 6769:6771 ioctl c0306201 200000000580 returned -14 [ 208.368542][ T6767] netlink: 'syz.4.322': attribute type 13 has an invalid length. [ 208.368567][ T6767] netlink: 'syz.4.322': attribute type 17 has an invalid length. [ 210.457275][ T6805] netlink: 36 bytes leftover after parsing attributes in process `syz.2.338'. [ 212.172254][ T6834] netlink: 12 bytes leftover after parsing attributes in process `syz.3.351'. [ 212.219002][ T6834] netlink: 8 bytes leftover after parsing attributes in process `syz.3.351'. [ 212.219035][ T6834] netlink: 4 bytes leftover after parsing attributes in process `syz.3.351'. [ 212.610614][ T6834] netlink: 'syz.3.351': attribute type 13 has an invalid length. [ 212.610639][ T6834] netlink: 'syz.3.351': attribute type 17 has an invalid length. [ 215.047549][ T6855] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 215.047588][ T6855] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 215.047607][ T6855] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 215.475069][ T6886] binder: 6884:6886 ioctl 4018620d 0 returned -22 [ 215.488319][ T6886] binder: 6884:6886 ioctl c0306201 200000000580 returned -14 [ 215.505155][ T6882] nvme_fcloop: unknown parameter or missing value 'wwpn' [ 216.197925][ T6897] binder: BINDER_SET_CONTEXT_MGR already set [ 216.197943][ T6897] binder: 6896:6897 ioctl 4018620d 200000000300 returned -16 [ 216.498084][ T6904] netlink: 12 bytes leftover after parsing attributes in process `syz.3.379'. [ 216.563295][ T6904] netlink: 8 bytes leftover after parsing attributes in process `syz.3.379'. [ 216.563322][ T6904] netlink: 4 bytes leftover after parsing attributes in process `syz.3.379'. [ 217.144549][ T6904] netlink: 'syz.3.379': attribute type 13 has an invalid length. [ 217.144576][ T6904] netlink: 'syz.3.379': attribute type 17 has an invalid length. [ 218.447815][ T6923] binder: 6919:6923 ioctl 4018620d 0 returned -22 [ 218.463988][ T6923] binder: 6919:6923 ioctl c0306201 200000000580 returned -14 [ 219.678712][ T6951] netlink: 12 bytes leftover after parsing attributes in process `syz.2.398'. [ 219.739751][ T6951] netlink: 8 bytes leftover after parsing attributes in process `syz.2.398'. [ 219.739777][ T6951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.398'. [ 219.787677][ T6952] nvme_fcloop: unknown parameter or missing value 'wwpn' [ 220.036480][ T6951] netlink: 'syz.2.398': attribute type 13 has an invalid length. [ 220.036506][ T6951] netlink: 'syz.2.398': attribute type 17 has an invalid length. [ 220.329554][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 220.615107][ T6959] binder: 6957:6959 ioctl 4018620d 0 returned -22 [ 220.629532][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 220.631689][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.631722][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.631745][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 220.631787][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 220.631808][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.635588][ T6958] binder: 6957:6958 ioctl c0306201 200000000580 returned -22 [ 220.653546][ T10] usb 1-1: config 0 descriptor?? [ 220.771155][ T6961] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.401'. [ 222.400275][ T10] usbhid 1-1:0.0: can't add hid device: -71 [ 222.400406][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 222.439539][ T59] Bluetooth: hci0: command 0x0406 tx timeout [ 222.519442][ T59] Bluetooth: hci1: command 0x0406 tx timeout [ 222.519477][ T59] Bluetooth: hci3: command 0x0406 tx timeout [ 222.519769][ T59] Bluetooth: hci2: command 0x0406 tx timeout [ 222.669981][ T10] usb 1-1: USB disconnect, device number 5 [ 224.130860][ T7002] binder: BINDER_SET_CONTEXT_MGR already set [ 224.130877][ T7002] binder: 7000:7002 ioctl 4018620d 200000000300 returned -16 [ 224.131187][ T7002] binder: 7000:7002 ioctl c0306201 200000000580 returned -22 [ 224.325420][ T7006] netlink: 12 bytes leftover after parsing attributes in process `syz.1.419'. [ 224.366237][ T7006] netlink: 8 bytes leftover after parsing attributes in process `syz.1.419'. [ 224.366260][ T7006] netlink: 4 bytes leftover after parsing attributes in process `syz.1.419'. [ 224.545527][ T7008] netlink: 1688 bytes leftover after parsing attributes in process `syz.3.418'. [ 224.703412][ T7006] netlink: 'syz.1.419': attribute type 13 has an invalid length. [ 224.703437][ T7006] netlink: 'syz.1.419': attribute type 17 has an invalid length. [ 226.704669][ T7037] binder: 7036:7037 ioctl c0306201 200000000580 returned -22 [ 227.019107][ T7006] IPv6: ipvlan1: Failed to add prefix route for address fe80::37; dropping [ 227.299817][ T7048] netlink: 1688 bytes leftover after parsing attributes in process `syz.0.435'. [ 230.155025][ T7074] binder: BINDER_SET_CONTEXT_MGR already set [ 230.155250][ T7074] binder: 7071:7074 ioctl 4018620d 200000000300 returned -16 [ 230.379309][ T7074] binder: 7071:7074 ioctl c0306201 200000000580 returned -22 [ 232.839511][ T7082] nvme_fcloop: unknown parameter or missing value 'r' [ 233.014591][ T7090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.450'. [ 233.041565][ T7090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.450'. [ 233.041606][ T7090] netlink: 4 bytes leftover after parsing attributes in process `syz.0.450'. [ 233.189873][ T7090] netlink: 'syz.0.450': attribute type 13 has an invalid length. [ 233.189896][ T7090] netlink: 'syz.0.450': attribute type 17 has an invalid length. [ 233.309375][ T5589] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 233.479937][ T5589] usb 3-1: Using ep0 maxpacket: 32 [ 233.482981][ T5589] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 233.506426][ T5589] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 233.506460][ T5589] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 233.506484][ T5589] usb 3-1: Product: syz [ 233.506500][ T5589] usb 3-1: Manufacturer: syz [ 233.506516][ T5589] usb 3-1: SerialNumber: syz [ 233.517450][ T5589] usb 3-1: config 0 descriptor?? [ 233.522281][ T7088] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 233.536524][ T5589] hub 3-1:0.0: bad descriptor, ignoring hub [ 233.536584][ T5589] hub 3-1:0.0: probe with driver hub failed with error -5 [ 234.500546][ T7107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 234.506052][ T7107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.975080][ T7114] binder: 7113:7114 ioctl c0306201 0 returned -14 [ 234.997385][ T7114] binder: 7113:7114 ioctl c0306201 200000000580 returned -14 [ 235.389695][ T7115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.390362][ T7115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.676553][ T7122] binder: 7121:7122 ioctl c0306201 200000000580 returned -14 [ 235.735824][ T7124] nvme_fcloop: unknown parameter or missing value 'r' [ 237.675211][ T7149] binder: 7147:7149 ioctl c0306201 0 returned -14 [ 237.676855][ T7149] binder: 7147:7149 ioctl c0306201 200000000580 returned -14 [ 238.521809][ T5706] usb 3-1: USB disconnect, device number 7 [ 238.575841][ T7156] nvme_fcloop: unknown parameter or missing value 'r' [ 240.327213][ T7173] netlink: 68 bytes leftover after parsing attributes in process `syz.0.481'. [ 240.518723][ T7179] netlink: 12 bytes leftover after parsing attributes in process `syz.1.484'. [ 240.570728][ T7179] netlink: 8 bytes leftover after parsing attributes in process `syz.1.484'. [ 240.570753][ T7179] netlink: 4 bytes leftover after parsing attributes in process `syz.1.484'. [ 240.757083][ T7189] nvme_fcloop: unknown parameter or missing value 'role' [ 240.800514][ T7179] netlink: 'syz.1.484': attribute type 13 has an invalid length. [ 240.800530][ T7179] netlink: 'syz.1.484': attribute type 17 has an invalid length. [ 241.107858][ T7194] netlink: 24 bytes leftover after parsing attributes in process `syz.4.488'. [ 241.917895][ T7204] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.490'. [ 243.638228][ T7222] netlink: 12 bytes leftover after parsing attributes in process `syz.3.500'. [ 244.604551][ T7222] netlink: 8 bytes leftover after parsing attributes in process `syz.3.500'. [ 244.604580][ T7222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.500'. [ 244.813237][ T7222] netlink: 'syz.3.500': attribute type 13 has an invalid length. [ 244.813260][ T7222] netlink: 'syz.3.500': attribute type 17 has an invalid length. [ 245.022919][ T7234] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.502'. [ 247.409215][ T7259] netlink: 24 bytes leftover after parsing attributes in process `syz.1.510'. [ 247.613798][ T7265] nvme_fcloop: unknown parameter or missing value 'role' [ 247.672746][ T7267] netlink: 12 bytes leftover after parsing attributes in process `syz.0.515'. [ 247.739500][ T7267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.515'. [ 247.739527][ T7267] netlink: 4 bytes leftover after parsing attributes in process `syz.0.515'. [ 248.003697][ T37] audit: type=1800 audit(1785935059.882:3): pid=7251 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.506" name="zone_nr_conv" dev="configfs" ino=15697 res=0 errno=0 [ 248.193942][ T7267] netlink: 'syz.0.515': attribute type 13 has an invalid length. [ 248.193969][ T7267] netlink: 'syz.0.515': attribute type 17 has an invalid length. [ 248.443067][ T7273] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.516'. [ 248.611070][ T7276] binder: 7275:7276 ioctl c0306201 200000000580 returned -14 [ 251.154871][ T7309] binder: 7306:7309 ioctl c0306201 200000000580 returned -14 [ 251.185192][ T7314] netlink: 24 bytes leftover after parsing attributes in process `syz.1.528'. [ 251.200349][ T7313] netlink: 12 bytes leftover after parsing attributes in process `syz.4.531'. [ 251.252559][ T7313] netlink: 8 bytes leftover after parsing attributes in process `syz.4.531'. [ 251.252585][ T7313] netlink: 4 bytes leftover after parsing attributes in process `syz.4.531'. [ 251.401606][ T7313] netlink: 'syz.4.531': attribute type 13 has an invalid length. [ 251.401633][ T7313] netlink: 'syz.4.531': attribute type 17 has an invalid length. [ 252.248067][ T7336] nvme_fcloop: unknown parameter or missing value 'roles=' [ 252.734234][ T7343] binder: 7342:7343 ioctl c0306201 200000000580 returned -14 [ 253.605733][ T7358] netlink: 12 bytes leftover after parsing attributes in process `syz.0.550'. [ 253.630819][ T7358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.550'. [ 253.630844][ T7358] netlink: 4 bytes leftover after parsing attributes in process `syz.0.550'. [ 253.719446][ T31] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 253.762560][ T7358] netlink: 'syz.0.550': attribute type 13 has an invalid length. [ 253.762583][ T7358] netlink: 'syz.0.550': attribute type 17 has an invalid length. [ 253.892425][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 253.892457][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 253.892495][ T31] usb 3-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 253.892512][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.070148][ T7367] nvme_fcloop: unknown parameter or missing value 'roles=' [ 254.469988][ T31] gud 3-1:1.0: probe with driver gud failed with error -71 [ 254.510011][ T7372] binder: 7371:7372 ioctl c0306201 200000000580 returned -14 [ 254.534096][ T31] usb 3-1: USB disconnect, device number 9 [ 260.481770][ T7415] netlink: 56 bytes leftover after parsing attributes in process `syz.3.568'. [ 260.531568][ T7416] netlink: 12 bytes leftover after parsing attributes in process `syz.4.569'. [ 260.571456][ T7417] binder: 7413:7417 ioctl c0306201 200000000580 returned -14 [ 260.595945][ T7416] netlink: 8 bytes leftover after parsing attributes in process `syz.4.569'. [ 260.595971][ T7416] netlink: 4 bytes leftover after parsing attributes in process `syz.4.569'. [ 260.703073][ T7416] netlink: 'syz.4.569': attribute type 13 has an invalid length. [ 260.703096][ T7416] netlink: 'syz.4.569': attribute type 17 has an invalid length. [ 261.331715][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.331793][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.602270][ T7446] Bluetooth: MGMT ver 1.23 [ 265.613468][ T7452] netlink: 20 bytes leftover after parsing attributes in process `syz.0.580'. [ 265.868429][ T7442] evm: overlay not supported [ 266.032974][ T7458] binder: 7457:7458 ioctl c0306201 200000000580 returned -14 [ 266.347386][ T7464] netlink: 12 bytes leftover after parsing attributes in process `syz.0.586'. [ 266.397510][ T7464] netlink: 36 bytes leftover after parsing attributes in process `syz.0.586'. [ 266.397729][ T7464] netlink: 36 bytes leftover after parsing attributes in process `syz.0.586'. [ 266.680967][ T7470] netlink: 56 bytes leftover after parsing attributes in process `syz.3.588'. [ 269.017903][ T5612] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 269.025585][ T5616] Bluetooth: hci2: command 0x0406 tx timeout [ 269.295323][ T7482] netlink: 20 bytes leftover after parsing attributes in process `syz.4.593'. [ 269.445439][ T7486] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.595'. [ 269.503177][ T7489] binder: 7488:7489 ioctl c0306201 200000000580 returned -14 [ 269.567606][ T7491] netlink: 24 bytes leftover after parsing attributes in process `syz.4.596'. [ 269.885624][ T7497] netlink: 12 bytes leftover after parsing attributes in process `syz.2.600'. [ 269.952637][ T7497] netlink: 36 bytes leftover after parsing attributes in process `syz.2.600'. [ 270.173288][ T37] audit: type=1326 audit(1785935082.122:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7501 comm="syz.2.603" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f63ebc8e0d9 code=0x0 [ 270.621099][ T7512] __nla_validate_parse: 2 callbacks suppressed [ 270.621123][ T7512] netlink: 56 bytes leftover after parsing attributes in process `syz.0.605'. [ 270.889427][ T5707] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 271.064488][ T5707] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 271.064521][ T5707] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 271.064562][ T5707] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 271.064588][ T5707] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 271.195095][ T7515] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.608'. [ 271.312562][ T7517] binder: 7516:7517 ioctl c0306201 200000000580 returned -14 [ 271.694967][ T7526] netlink: 12 bytes leftover after parsing attributes in process `syz.2.614'. [ 271.711164][ T5707] gud 5-1:1.0: probe with driver gud failed with error -71 [ 271.743903][ T5707] usb 5-1: USB disconnect, device number 2 [ 271.758507][ T7526] netlink: 36 bytes leftover after parsing attributes in process `syz.2.614'. [ 271.758797][ T7526] netlink: 36 bytes leftover after parsing attributes in process `syz.2.614'. [ 274.722224][ T7543] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 274.994645][ T7546] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.620'. [ 275.951376][ T7557] binder: 7555:7557 ioctl c0306201 200000000580 returned -14 [ 276.363622][ T7565] netlink: 48 bytes leftover after parsing attributes in process `syz.3.626'. [ 276.550845][ T7570] netlink: 12 bytes leftover after parsing attributes in process `syz.4.628'. [ 276.728812][ T7576] netlink: 12 bytes leftover after parsing attributes in process `syz.3.631'. [ 276.888801][ T7579] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.632'. [ 277.439916][ T7567] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 277.490307][ T7567] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 278.381227][ T7589] binder: 7588:7589 ioctl 4018620d 0 returned -22 [ 278.381641][ T7589] binder: 7588:7589 ioctl c0306201 200000000580 returned -14 [ 278.461019][ T7567] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 278.461140][ T7567] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 278.543812][ T7567] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 278.543899][ T7567] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 278.654726][ T7567] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 278.654878][ T7567] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 278.679518][ T5612] Bluetooth: hci0: command 0x0406 tx timeout [ 278.749997][ T7567] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 278.750138][ T7567] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 278.982729][ T7595] netlink: 48 bytes leftover after parsing attributes in process `syz.4.640'. [ 279.106526][ T7602] netlink: 24 bytes leftover after parsing attributes in process `syz.2.639'. [ 279.150791][ T31] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 279.213173][ T7606] netlink: 12 bytes leftover after parsing attributes in process `syz.4.643'. [ 279.275100][ T7608] netlink: 12 bytes leftover after parsing attributes in process `syz.1.642'. [ 279.478610][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 279.478644][ T31] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 279.478688][ T31] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 279.478714][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.536991][ T7612] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.644'. [ 279.703690][ T7614] binder: 7613:7614 ioctl 4018620d 0 returned -22 [ 279.704160][ T7614] binder: 7613:7614 ioctl c0306201 200000000580 returned -14 [ 279.937978][ T31] usb 4-1: USB disconnect, device number 5 [ 280.519581][ T5612] Bluetooth: hci2: command 0x0406 tx timeout [ 280.600630][ T5612] Bluetooth: hci1: command 0x0406 tx timeout [ 280.679770][ T5612] Bluetooth: hci3: command 0x0406 tx timeout [ 280.759552][ T5616] Bluetooth: hci0: command 0x0406 tx timeout [ 280.759617][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 281.055409][ T7638] netlink: 48 bytes leftover after parsing attributes in process `syz.2.655'. [ 281.627130][ T7651] binder: 7647:7651 ioctl 4018620d 0 returned -22 [ 281.635032][ T7651] binder: 7647:7651 ioctl c0306201 200000000580 returned -14 [ 282.757002][ T5612] Bluetooth: hci2: command 0x0406 tx timeout [ 282.757142][ T5612] Bluetooth: hci1: command 0x0406 tx timeout [ 282.794655][ T5616] Bluetooth: hci3: command 0x0406 tx timeout [ 283.023831][ T5616] Bluetooth: hci4: command 0x0c1a tx timeout [ 287.789050][ T7672] __nla_validate_parse: 2 callbacks suppressed [ 287.789070][ T7672] netlink: 48 bytes leftover after parsing attributes in process `syz.3.667'. [ 288.414406][ T7688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.673'. [ 290.335988][ T7727] binder: 7726:7727 ioctl c0306201 0 returned -14 [ 290.589543][ T5863] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 291.102111][ T5863] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 291.102144][ T5863] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 291.102189][ T5863] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 291.102215][ T5863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.217119][ T7731] netlink: 12 bytes leftover after parsing attributes in process `syz.0.691'. [ 291.651075][ T5863] gud 5-1:1.0: probe with driver gud failed with error -71 [ 291.707467][ T5863] usb 5-1: USB disconnect, device number 3 [ 291.974880][ T7746] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 291.974938][ T7746] File: /dev/nullb0 PID: 7746 Comm: syz.3.694 [ 293.378984][ T7762] binder: 7752:7762 ioctl c0306201 0 returned -14 [ 294.684119][ T7773] netlink: 24 bytes leftover after parsing attributes in process `syz.0.705'. [ 294.710441][ T7763] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 294.971487][ T7777] netlink: 12 bytes leftover after parsing attributes in process `syz.4.706'. [ 295.055535][ T7781] netlink: 64 bytes leftover after parsing attributes in process `syz.0.709'. [ 295.669477][ T5733] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 295.842296][ T5733] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 295.842329][ T5733] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 295.842373][ T5733] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 295.842397][ T5733] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.664619][ T7809] netlink: 48 bytes leftover after parsing attributes in process `syz.4.718'. [ 296.834471][ T5733] gud 1-1:1.0: probe with driver gud failed with error -121 [ 300.894545][ T10] usb 1-1: USB disconnect, device number 6 [ 303.608501][ T7825] netlink: 64 bytes leftover after parsing attributes in process `syz.1.725'. [ 303.693743][ T7826] netlink: 12 bytes leftover after parsing attributes in process `syz.0.724'. [ 303.995292][ T7826] netlink: 48 bytes leftover after parsing attributes in process `syz.0.724'. [ 305.286044][ T7826] netlink: 'syz.0.724': attribute type 13 has an invalid length. [ 305.286062][ T7826] netlink: 'syz.0.724': attribute type 17 has an invalid length. [ 306.628034][ T7851] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.774734][ T7855] netlink: 64 bytes leftover after parsing attributes in process `syz.1.737'. [ 306.849640][ T7857] netlink: 24 bytes leftover after parsing attributes in process `syz.0.736'. [ 309.128299][ T7868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.742'. [ 309.220200][ T7868] netlink: 48 bytes leftover after parsing attributes in process `syz.2.742'. [ 309.220539][ T7868] netlink: 48 bytes leftover after parsing attributes in process `syz.2.742'. [ 309.279596][ C0] Unknown status report in ack skb [ 309.304176][ T7865] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.039628][ T5707] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 310.192207][ T5707] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 310.192241][ T5707] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 310.192294][ T5707] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 310.192320][ T5707] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 310.656753][ T5707] gud 4-1:1.0: probe with driver gud failed with error -121 [ 310.850263][ T7888] netlink: 52 bytes leftover after parsing attributes in process `syz.1.751'. [ 310.946517][ T7893] netlink: 12 bytes leftover after parsing attributes in process `syz.2.753'. [ 310.967911][ T7893] netlink: 48 bytes leftover after parsing attributes in process `syz.2.753'. [ 310.968261][ T7893] netlink: 48 bytes leftover after parsing attributes in process `syz.2.753'. [ 311.110773][ T5610] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 311.139914][ T9] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 311.287219][ T5610] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 311.287252][ T5610] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 311.287295][ T5610] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 311.287320][ T5610] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.382793][ T9] usb 5-1: config 0 has an invalid interface number: 251 but max is 0 [ 311.382829][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 311.382964][ T9] usb 5-1: config 0 has no interface number 0 [ 311.392065][ T9] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 311.392176][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.392262][ T9] usb 5-1: Product: syz [ 311.392310][ T9] usb 5-1: Manufacturer: syz [ 311.392397][ T9] usb 5-1: SerialNumber: syz [ 311.629570][ T9] usb 5-1: config 0 descriptor?? [ 311.665613][ T9] asix 5-1:0.251: probe with driver asix failed with error -22 [ 312.416246][ T5610] gud 1-1:1.0: Failed to add properties (error=-71) [ 312.416292][ T5610] gud 1-1:1.0: probe with driver gud failed with error -71 [ 312.584901][ T5610] usb 1-1: USB disconnect, device number 7 [ 312.847665][ T5733] usb 4-1: USB disconnect, device number 6 [ 314.207351][ T7949] netlink: 52 bytes leftover after parsing attributes in process `syz.2.764'. [ 315.081177][ T5610] usb 5-1: USB disconnect, device number 4 [ 315.098535][ C1] Unknown status report in ack skb [ 315.124151][ T7952] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.219731][ T7954] netlink: 12 bytes leftover after parsing attributes in process `syz.2.766'. [ 315.285892][ T7954] netlink: 48 bytes leftover after parsing attributes in process `syz.2.766'. [ 316.645493][ T7971] netlink: 24 bytes leftover after parsing attributes in process `syz.3.770'. [ 316.848368][ T7954] netlink: 'syz.2.766': attribute type 13 has an invalid length. [ 316.848395][ T7954] netlink: 'syz.2.766': attribute type 17 has an invalid length. [ 320.132700][ T7997] netlink: 52 bytes leftover after parsing attributes in process `syz.2.776'. [ 321.413877][ T8013] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 321.612271][ T8022] netlink: 12 bytes leftover after parsing attributes in process `syz.0.783'. [ 321.658123][ T8022] netlink: 48 bytes leftover after parsing attributes in process `syz.0.783'. [ 321.708474][ T8015] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 321.712334][ T8022] netlink: 48 bytes leftover after parsing attributes in process `syz.0.783'. [ 321.832667][ T5610] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 321.905944][ T8030] netlink: 24 bytes leftover after parsing attributes in process `syz.4.784'. [ 322.069321][ T5610] usb 3-1: Using ep0 maxpacket: 8 [ 322.072090][ T5610] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 322.072120][ T5610] usb 3-1: config 0 has no interface number 0 [ 322.072167][ T5610] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 322.072193][ T5610] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 322.072220][ T5610] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 322.072248][ T5610] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 322.072295][ T5610] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 322.072319][ T5610] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.172148][ T5610] usb 3-1: config 0 descriptor?? [ 322.285253][ T8038] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 322.763568][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.763644][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 325.384115][ T5610] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 325.759693][ T8061] netlink: 52 bytes leftover after parsing attributes in process `syz.1.791'. [ 325.915090][ T5733] usb 3-1: USB disconnect, device number 10 [ 327.087160][ T5733] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 329.258378][ T8083] netlink: 12 bytes leftover after parsing attributes in process `syz.0.797'. [ 329.278858][ T8085] netlink: zone id is out of range [ 329.278874][ T8085] netlink: zone id is out of range [ 329.278883][ T8085] netlink: zone id is out of range [ 329.278891][ T8085] netlink: zone id is out of range [ 329.278900][ T8085] netlink: zone id is out of range [ 329.278908][ T8085] netlink: zone id is out of range [ 329.278917][ T8085] netlink: zone id is out of range [ 329.278925][ T8085] netlink: zone id is out of range [ 329.278934][ T8085] netlink: zone id is out of range [ 329.278942][ T8085] netlink: set zone limit has 4 unknown bytes [ 329.404933][ T8083] netlink: 48 bytes leftover after parsing attributes in process `syz.0.797'. [ 329.405247][ T8083] netlink: 48 bytes leftover after parsing attributes in process `syz.0.797'. [ 329.854397][ T8102] netlink: 52 bytes leftover after parsing attributes in process `syz.3.804'. [ 331.187334][ T8124] netlink: 48 bytes leftover after parsing attributes in process `syz.2.805'. [ 332.831331][ T8125] netlink: 36 bytes leftover after parsing attributes in process `syz.3.808'. [ 334.464115][ T8147] netlink: 12 bytes leftover after parsing attributes in process `syz.1.812'. [ 334.488431][ T8147] netlink: 48 bytes leftover after parsing attributes in process `syz.1.812'. [ 334.806457][ T8147] netlink: 'syz.1.812': attribute type 13 has an invalid length. [ 334.806484][ T8147] netlink: 'syz.1.812': attribute type 17 has an invalid length. [ 335.620333][ T8156] binder: BINDER_SET_CONTEXT_MGR already set [ 335.620352][ T8156] binder: 8155:8156 ioctl 4018620d 200000000300 returned -16 [ 335.620792][ T8156] binder: 8155:8156 ioctl c0306201 200000000580 returned -14 [ 335.932725][ T8160] netlink: 52 bytes leftover after parsing attributes in process `syz.3.817'. [ 336.163646][ T8167] netlink: 24 bytes leftover after parsing attributes in process `syz.0.819'. [ 338.172877][ C1] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 341.118268][ T8198] netlink: 12 bytes leftover after parsing attributes in process `syz.2.831'. [ 344.897831][ T8198] netlink: 48 bytes leftover after parsing attributes in process `syz.2.831'. [ 344.898118][ T8198] netlink: 48 bytes leftover after parsing attributes in process `syz.2.831'. [ 344.977784][ T8201] binder: BINDER_SET_CONTEXT_MGR already set [ 344.977796][ T8201] binder: 8200:8201 ioctl 4018620d 200000000300 returned -16 [ 344.978061][ T8201] binder: 8200:8201 ioctl c0306201 200000000580 returned -14 [ 345.271028][ C0] Unknown status report in ack skb [ 345.345507][ T8203] net_ratelimit: 1 callbacks suppressed [ 345.345527][ T8203] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 345.469608][ T8208] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.836'. [ 351.719465][ T5619] Bluetooth: hci5: command 0x1003 tx timeout [ 351.722018][ T5616] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 351.799423][ T5612] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 352.200130][ T5612] Bluetooth: hci4: command 0x0c1a tx timeout [ 354.534146][ T8265] netlink: 12 bytes leftover after parsing attributes in process `syz.0.846'. [ 354.730004][ T8265] netlink: 48 bytes leftover after parsing attributes in process `syz.0.846'. [ 354.730307][ T8265] netlink: 48 bytes leftover after parsing attributes in process `syz.0.846'. [ 354.908908][ T8274] binder_alloc: 8271: binder_alloc_buf, no vma [ 355.053345][ T8273] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.849'. [ 358.147695][ T8321] netlink: 12 bytes leftover after parsing attributes in process `syz.4.862'. [ 358.178327][ T8322] binder_alloc: 8320: binder_alloc_buf, no vma [ 358.224554][ T8321] netlink: 48 bytes leftover after parsing attributes in process `syz.4.862'. [ 358.224873][ T8321] netlink: 48 bytes leftover after parsing attributes in process `syz.4.862'. [ 358.474634][ T8332] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.867'. [ 359.326947][ T8337] netlink: 24 bytes leftover after parsing attributes in process `syz.4.868'. [ 362.875529][ T8351] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 362.918146][ T8353] netlink: 88 bytes leftover after parsing attributes in process `syz.0.873'. [ 364.375518][ T8364] binder_alloc: 8361: binder_alloc_buf, no vma [ 364.491406][ T8369] netlink: 12 bytes leftover after parsing attributes in process `syz.0.878'. [ 364.553879][ T8369] netlink: 48 bytes leftover after parsing attributes in process `syz.0.878'. [ 364.554199][ T8369] netlink: 48 bytes leftover after parsing attributes in process `syz.0.878'. [ 365.262621][ T8381] netlink: 48 bytes leftover after parsing attributes in process `syz.1.881'. [ 368.677424][ T8414] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.859878][ T8421] binder_alloc: 8420: binder_alloc_buf, no vma [ 369.069632][ T8428] netlink: 24 bytes leftover after parsing attributes in process `syz.4.893'. [ 369.124171][ T8430] netlink: 12 bytes leftover after parsing attributes in process `syz.1.894'. [ 369.236077][ T8430] netlink: 48 bytes leftover after parsing attributes in process `syz.1.894'. [ 369.236415][ T8430] netlink: 48 bytes leftover after parsing attributes in process `syz.1.894'. [ 371.285877][ T8456] Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O! [ 371.285944][ T8456] File: /dev/nullb0 PID: 8456 Comm: syz.3.900 [ 374.331640][ T198] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 375.182181][ T198] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 375.182266][ T198] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 375.182374][ T198] usb 1-1: config 0 has no interface number 0 [ 375.182438][ T198] usb 1-1: config 0 interface 251 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 375.361698][ T198] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 375.361740][ T198] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 375.361813][ T198] usb 1-1: Product: syz [ 375.361831][ T198] usb 1-1: Manufacturer: syz [ 375.361900][ T198] usb 1-1: SerialNumber: syz [ 375.934999][ T198] usb 1-1: config 0 descriptor?? [ 376.107556][ T198] asix 1-1:0.251: probe with driver asix failed with error -22 [ 376.801714][ T198] usb 1-1: USB disconnect, device number 8 [ 377.810880][ T8479] binder_alloc: 8478: binder_alloc_buf, no vma [ 378.054789][ T8485] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 380.491755][ T8525] netlink: 12 bytes leftover after parsing attributes in process `syz.0.925'. [ 381.725776][ T8549] binder_alloc: 8548: binder_alloc_buf, no vma [ 381.725846][ T8549] binder: 8548:8549 ioctl c0306201 200000000580 returned -14 [ 383.834100][ T8573] netlink: 12 bytes leftover after parsing attributes in process `syz.0.944'. [ 384.051590][ T8580] binder_alloc: 8579: binder_alloc_buf, no vma [ 384.051689][ T8580] binder: 8579:8580 ioctl c0306201 200000000580 returned -14 [ 384.237094][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 384.237173][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.455214][ T5733] kernel read not supported for file /syz2 (pid: 5733 comm: kworker/1:5) [ 385.276787][ T8610] netlink: 12 bytes leftover after parsing attributes in process `syz.2.961'. [ 385.347634][ T8610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.961'. [ 385.347660][ T8610] netlink: 4 bytes leftover after parsing attributes in process `syz.2.961'. [ 385.569564][ T8610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.961'. [ 385.569590][ T8610] netlink: 4 bytes leftover after parsing attributes in process `syz.2.961'. [ 385.581429][ T55] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.581736][ T267] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.581782][ T267] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.581823][ T267] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 385.933668][ T2304] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 385.933690][ T2304] #PF: supervisor read access in kernel mode [ 385.933704][ T2304] #PF: error_code(0x0000) - not-present page [ 385.933716][ T2304] PGD 80000000404e2067 P4D 80000000404e2067 PUD 0 [ 385.933754][ T2304] Oops: Oops: 0000 [#1] SMP KASAN PTI [ 385.933781][ T2304] CPU: 1 UID: 0 PID: 2304 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 385.933806][ T2304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 385.933820][ T2304] Workqueue: events_unbound cfg80211_wiphy_work [ 385.934030][ T2304] RIP: 0010:kcov_remote_start+0x287/0x6f0 [ 385.934157][ T2304] Code: b3 8d 4c 8b b8 b8 b2 9e 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 00 0f 22 8e 4d 8b 3f 49 81 ff 00 0f 22 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 bb d1 07 03 84 c0 74 0e 49 8b 07 49 [ 385.934177][ T2304] RSP: 0018:ffffc900084f79f8 EFLAGS: 00010207 [ 385.934195][ T2304] RAX: 0000000000000000 RBX: ffff88802782dd00 RCX: 0000000000000000 [ 385.934210][ T2304] RDX: 00000000675d2385 RSI: 0000000000000001 RDI: ffffffff8bca7820 [ 385.934224][ T2304] RBP: 0000000000100000 R08: ffffffff8b465b20 R09: 0000000000000000 [ 385.934238][ T2304] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000002 [ 385.934252][ T2304] R13: 0000000000000001 R14: ffff888025edad00 R15: 0000000000000000 [ 385.934266][ T2304] FS: 0000000000000000(0000) GS:ffff888125d3e000(0000) knlGS:0000000000000000 [ 385.934283][ T2304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.934297][ T2304] CR2: 0000000000000010 CR3: 00000000397ac000 CR4: 00000000003526f0 [ 385.934315][ T2304] Call Trace: [ 385.934323][ T2304] [ 385.934335][ T2304] ieee80211_iface_work+0x20c/0x1010 [ 385.934430][ T2304] cfg80211_wiphy_work+0x29e/0x420 [ 385.934456][ T2304] ? process_scheduled_works+0xa20/0x14e0 [ 385.934586][ T2304] process_scheduled_works+0xa8e/0x14e0 [ 385.934628][ T2304] ? __pfx_process_scheduled_works+0x10/0x10 [ 385.934659][ T2304] ? assign_work+0x3cf/0x5d0 [ 385.934687][ T2304] worker_thread+0xa47/0xfb0 [ 385.934722][ T2304] ? __kthread_parkme+0x71/0x1f0 [ 385.934782][ T2304] kthread+0x388/0x470 [ 385.934815][ T2304] ? __pfx_worker_thread+0x10/0x10 [ 385.934841][ T2304] ? __pfx_kthread+0x10/0x10 [ 385.934876][ T2304] ret_from_fork+0x514/0xb70 [ 385.934957][ T2304] ? __pfx_ret_from_fork+0x10/0x10 [ 385.934992][ T2304] ? __switch_to+0xc89/0x1420 [ 385.935044][ T2304] ? __pfx_kthread+0x10/0x10 [ 385.935078][ T2304] ret_from_fork_asm+0x1a/0x30 [ 385.935161][ T2304] [ 385.935173][ T2304] Modules linked in: [ 385.935195][ T2304] CR2: 0000000000000010 [ 385.935211][ T2304] ---[ end trace 0000000000000000 ]--- [ 385.935226][ T2304] RIP: 0010:kcov_remote_start+0x287/0x6f0 [ 385.935262][ T2304] Code: b3 8d 4c 8b b8 b8 b2 9e 92 bd 00 00 04 00 eb 4f 41 8b ae a4 00 00 00 49 c7 c7 00 0f 22 8e 4d 8b 3f 49 81 ff 00 0f 22 8e 74 4c <41> 39 6f 10 75 ee 4c 89 ff e8 bb d1 07 03 84 c0 74 0e 49 8b 07 49 [ 385.935280][ T2304] RSP: 0018:ffffc900084f79f8 EFLAGS: 00010207 [ 385.935298][ T2304] RAX: 0000000000000000 RBX: ffff88802782dd00 RCX: 0000000000000000 [ 385.935313][ T2304] RDX: 00000000675d2385 RSI: 0000000000000001 RDI: ffffffff8bca7820 [ 385.935329][ T2304] RBP: 0000000000100000 R08: ffffffff8b465b20 R09: 0000000000000000 [ 385.935344][ T2304] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000002 [ 385.935358][ T2304] R13: 0000000000000001 R14: ffff888025edad00 R15: 0000000000000000 [ 385.935373][ T2304] FS: 0000000000000000(0000) GS:ffff888125d3e000(0000) knlGS:0000000000000000 [ 385.935391][ T2304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 385.935406][ T2304] CR2: 0000000000000010 CR3: 00000000397ac000 CR4: 00000000003526f0 [ 385.935425][ T2304] Kernel panic - not syncing: Fatal exception [ 385.936029][ T2304] Kernel Offset: disabled