last executing test programs: 16m15.821607445s ago: executing program 2 (id=3904): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cc, 0x325) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x13, &(0x7f0000000600)={@local, @broadcast, @void, {@generic={0x5, "c08e23dbea"}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x8, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xd9}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x3}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 16m14.394628486s ago: executing program 2 (id=3907): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x960, 0x0) ioctl$TUNSETLINK(r0, 0x400454cc, 0x325) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x13, &(0x7f0000000600)={@local, @broadcast, @void, {@generic={0x5, "c08e23dbea"}}}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x8, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xd9}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x3}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 16m12.663793617s ago: executing program 2 (id=3909): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x960, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETLINK(r0, 0x400454cc, 0x325) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x13, &(0x7f0000000600)={@local, @broadcast, @void, {@generic={0x5, "c08e23dbea"}}}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x8, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xd9}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x3}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 16m11.230186381s ago: executing program 2 (id=3912): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x960, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cc, 0x325) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x13, &(0x7f0000000600)={@local, @broadcast, @void, {@generic={0x5, "c08e23dbea"}}}, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x8, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xd9}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x3}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, 0x0, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 16m9.756318723s ago: executing program 2 (id=3915): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cc, 0x325) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xe8001, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x13, &(0x7f0000000600)={@local, @broadcast, @void, {@generic={0x5, "c08e23dbea"}}}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="bc30a071d8bcb8794f5d8e1334b133b0cc64874f1a44052e038135a56412a20d4363f5df408fc6441639e75c7470bb11f031bf8ed23da02f7a291fcc59c4382ecb", 0x41, 0xfffffffffffffffe) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x2c, 0x107, 0x70bd2b, 0x25dfdbff, {0x8, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0xd9}]}, @nested={0x8, 0x3, 0x0, 0x1, [@nested={0x4, 0x3}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 16m8.15967739s ago: executing program 2 (id=3918): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) socket$can_j1939(0x1d, 0x2, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f00000003c0)={0x2a, 0x1, 0xfffffffe}, 0xc) r1 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000ac0), 0x40001de, 0x10002, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) 15m51.71160513s ago: executing program 32 (id=3918): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x2, 0x4) socket$can_j1939(0x1d, 0x2, 0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f00000003c0)={0x2a, 0x1, 0xfffffffe}, 0xc) r1 = socket$qrtr(0x2a, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000ac0), 0x40001de, 0x10002, 0x0) connect$qrtr(r1, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r1, &(0x7f0000000340)=[{&(0x7f0000000080)="fb", 0x1}], 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) openat(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x26d01, 0x0) 9m57.779438048s ago: executing program 4 (id=4755): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x400c0c4}, 0x20000810) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB], &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0xffffffd4, 0x0, 0x0, 0x20}}, &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r7 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe0200108500000007000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r6, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r8, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000140)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r5, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r9 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 9m56.952327962s ago: executing program 4 (id=4757): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) 9m45.229481855s ago: executing program 4 (id=4785): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) 9m31.074381422s ago: executing program 4 (id=4811): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x400c0c4}, 0x20000810) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB], &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0xffffffd4, 0x0, 0x0, 0x20}}, &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) r7 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r7, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r6, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r8, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f0000000140)=[0x5], &(0x7f0000000180)=[0x2], 0x0, 0x1, 0x1}}, 0x3c) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r5, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r9 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 9m29.129616463s ago: executing program 4 (id=4816): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, r0, 0x800, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x400c0c4}, 0x20000810) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, &(0x7f00000014c0)=ANY=[@ANYBLOB], &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000000200)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2f, 0xffffffd4, 0x0, 0x0, 0x20}}, &(0x7f0000000240)='GPL\x00', 0x1, 0xc3, &(0x7f0000000280)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x1c3040, 0x0) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r6 = creat(&(0x7f00000002c0)='./file0\x00', 0x104) open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000003bc0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r6, &(0x7f0000000c40)=ANY=[], 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000006, 0x12, r5, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 9m27.374053298s ago: executing program 4 (id=4820): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) 9m11.076317023s ago: executing program 33 (id=4820): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) 3m12.303916134s ago: executing program 1 (id=6484): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, 0x0, 0x0) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) sendmmsg$inet(r1, &(0x7f0000001e80)=[{{0x0, 0x0, &(0x7f0000001bc0)=[{&(0x7f0000000640)='<', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000002240)='.', 0x1}], 0x1}}], 0x2, 0x400a055) close_range(r0, 0xffffffffffffffff, 0x0) 3m12.250437828s ago: executing program 1 (id=6485): syz_emit_ethernet(0x49, &(0x7f00000003c0)={@link_local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "ecff80", 0x13, 0x11, 0x0, @private0, @mcast2, {[], {0x0, 0x4e22, 0x13, 0x0, @opaque="053dee8d72f09045bea793"}}}}}}, 0x0) 3m12.174635226s ago: executing program 1 (id=6486): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000003f00070113a769d500000000017c00000400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="0c0002800500230000000000080007"], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 3m12.173591298s ago: executing program 1 (id=6487): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000280)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000000580)='./file0/../file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000008c0)='./file0\x00', 0x0, 0x2a05004, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) pivot_root(&(0x7f0000000600)='./file0\x00', &(0x7f00000001c0)='./file0\x00') 3m12.091543128s ago: executing program 1 (id=6488): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000ac0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB=',\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000ffdbde252100000008000300", @ANYRES32=r2, @ANYBLOB="10007d800500000016"], 0x2c}, 0x1, 0x0, 0x0, 0x46b2d3ba8e12a610}, 0x4048840) 3m11.98387812s ago: executing program 1 (id=6489): syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[], 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)=ANY=[], 0x20) socket$qrtr(0x2a, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r1, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r1, 0x1) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = openat$qrtrtun(0xffffff9c, &(0x7f0000000040), 0x14801) signalfd(r4, &(0x7f00000000c0)={[0x2]}, 0x8) sendmsg$SMC_PNETID_DEL(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="270e28bd70000000000004"], 0x14}, 0x1, 0x40030000000000}, 0x4000) 3m11.930217258s ago: executing program 34 (id=6489): syz_emit_ethernet(0x2a, &(0x7f0000000280)=ANY=[], 0x0) prlimit64(0x0, 0xc, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000003c0)=ANY=[], 0x20) socket$qrtr(0x2a, 0x2, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$packet(r1, &(0x7f0000000200)={0x1f, 0xf8, 0x0, 0x1, 0x2}, 0x14) shutdown(r1, 0x1) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r4 = openat$qrtrtun(0xffffff9c, &(0x7f0000000040), 0x14801) signalfd(r4, &(0x7f00000000c0)={[0x2]}, 0x8) sendmsg$SMC_PNETID_DEL(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="270e28bd70000000000004"], 0x14}, 0x1, 0x40030000000000}, 0x4000) 53.500546747s ago: executing program 3 (id=8207): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002840)={0x4c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x888e}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac, @broadcast, @broadcast}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) 53.395197693s ago: executing program 3 (id=8210): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b529, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x9d4eeb6eb0bd5fc7, 0x4}}}]}, 0x3c}}, 0x4000010) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 53.095754745s ago: executing program 3 (id=8218): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x4a, &(0x7f00000038c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a9646", 0x14, 0x6, 0x0, @empty, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0xfffe}}}}}}}, 0x0) 53.056404624s ago: executing program 3 (id=8220): syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/net\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4040080) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r0, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) 52.967822105s ago: executing program 3 (id=8221): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x80000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 52.913769076s ago: executing program 3 (id=8223): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)={0x54, r1, 0x1, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "3c7eaeee9ae9f897"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6dac2939834308b4090d55829ec79543"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e194d151e02cd5966c054f40dce50d6d"}]}]}, 0x54}}, 0x4008000) 37.781257225s ago: executing program 5 (id=8372): socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) syz_open_dev$vim2m(&(0x7f0000000140), 0x2, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$igmp(0x2, 0x3, 0x2) r1 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010101}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 37.780828996s ago: executing program 5 (id=8373): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) sendto$inet(r0, &(0x7f0000000740)="98e2d24a2d8ce4a509d138cc91611ed14f69b7d7aebfeca49d719bfbb537aef2a00ebefaf0", 0x25, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) 37.696270323s ago: executing program 5 (id=8374): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b529, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x9d4eeb6eb0bd5fc7, 0x4}}}]}, 0x3c}}, 0x4000010) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) 37.695863852s ago: executing program 5 (id=8375): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) write$P9_RSTATu(r1, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xff\xff\xff\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0xee01}}, 0x233) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r2, 0xffffffffffffffff, 0x0) 37.569142459s ago: executing program 5 (id=8376): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x40049366, 0x0) 37.568903675s ago: executing program 5 (id=8377): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@ax25={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2000005}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000100)=0x987, 0x4) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040)='gretap0\x00'}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000020, 0x0, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffd, 0x6, 0x0, @buffer={0x20, 0x0, 0x0}, &(0x7f00000000c0)="5b8e7ecf0140", 0x0, 0x0, 0x10, 0x0, 0x0}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x3, 0x4, 0xf9, 0x949f, @vifc_lcl_addr=@multicast2, @loopback}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000540)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1000, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo={0x8, 0x0, 0x0, 0x6, 0x3}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) 36.547122761s ago: executing program 35 (id=8223): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000280)={0x54, r1, 0x1, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x38, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "3c7eaeee9ae9f897"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="6dac2939834308b4090d55829ec79543"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e194d151e02cd5966c054f40dce50d6d"}]}]}, 0x54}}, 0x4008000) 36.37184249s ago: executing program 6 (id=8385): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = io_uring_setup(0xf08, &(0x7f00000003c0)={0x0, 0xfb6e, 0x10000, 0x44, 0x246}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000000)) 34.982882186s ago: executing program 6 (id=8388): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000005c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000cbd70100400000005000000080009000200000008000c00a80a000008000b0000000000060001000700"], 0x40}, 0x1, 0x0, 0x0, 0x40811}, 0x820) bind$inet6(r1, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x51, &(0x7f0000001180)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @val={@void}, {@ipv6={0x86dd, @udp={0x0, 0x6, "910100", 0x17, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x17, 0x0, @gue={{0x2, 0x0, 0x0, 0x3}, "34bf96abdf31d0"}}}}}}}, 0x0) 34.619209391s ago: executing program 6 (id=8389): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001040)={0x3, 0x11, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000900000000000000008500000053000000b7080000000000007b8af8ff00000000b7080000fdffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6cab2ea5}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r1, 0xffffffffffffffff, 0x37, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x3}}, 0x30) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_RANGEINFO(r5, 0x80106408, &(0x7f0000000280)={0xb, &(0x7f00000001c0)}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000340)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e23, 0xe76, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}}}, 0x90) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd01, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000003740)={r6, 0x0, 0x3a, 0x1000, &(0x7f00000000c0)="7dd53cbd3194ca5fdf819f26407baee211bc663e897588e401f0e4a0fb45b71d77741621473ac658833ca3a65d0cce88271044d28f364b55ad3b", &(0x7f0000002600)=""/4096, 0x5, 0x0, 0xc, 0xeb, &(0x7f0000003600)="c56a8c847238ff52ad060000", &(0x7f0000000500)="229659ccd6f855f1bd40fd739fa8de0cf1ea3f2f73819162675a1ad240b49256c8b5ad664c93136c96f3edc592119ca3df9a80f378d8a74b6a002cad87c687c57201c01f48a4b96bc64e86aafbe22b123676a913b97292c8b81cb7f354a8bbe56b6801d91ea0f5a62faf0660d63f0f204da7c2eb0ff4276ef0f673fc3e0daa8a6375ae443d958b949236f304d7b7ec3c74a34e82949b401a080000000000000019668bedd2eec7ed2766b9f69557646f981aeb9342e4fbd9ee239c7e20caa8beb6b9a56f39c059b4723325cfee096fe5c09269845ea686525461429559d4b3dcbb5134a83966f6c5c8a85a", 0x2, 0x0, 0x3}, 0x50) r7 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x7f}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x20020800}, 0x0) sendmsg$IPSET_CMD_FLUSH(r8, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x4c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004040}, 0x40) 34.063197621s ago: executing program 6 (id=8390): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={0x48, 0x2, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x48}}, 0x20000000) 33.964250795s ago: executing program 6 (id=8391): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(0xffffffffffffffff, 0x40049366, 0x0) 33.796286691s ago: executing program 6 (id=8392): r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f00000001c0), 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 21.488340158s ago: executing program 36 (id=8377): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@ax25={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2000005}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)}], 0x1, 0x0, 0x0, 0x900}, 0x60) syz_usb_connect(0x0, 0x36, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, &(0x7f0000000100)=0x987, 0x4) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040)='gretap0\x00'}) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000020, 0x0, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffd, 0x6, 0x0, @buffer={0x20, 0x0, 0x0}, &(0x7f00000000c0)="5b8e7ecf0140", 0x0, 0x0, 0x10, 0x0, 0x0}) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x3, 0x4, 0xf9, 0x949f, @vifc_lcl_addr=@multicast2, @loopback}, 0x10) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000540)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x1000, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo={0x8, 0x0, 0x0, 0x6, 0x3}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xffffeff7, 0x40, 0x40000006}, 0x3c) 17.570165306s ago: executing program 37 (id=8392): r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f00000001c0), 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 4.460710625s ago: executing program 0 (id=8664): socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$ttys(0xc, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1b00000000000000000000000080", @ANYRES32=0x0], 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$unix(0x1, 0x1, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0xa64a, 0x0, 0x8000, 0x4, 0x58}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 3.522849008s ago: executing program 0 (id=8678): syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x2, 0x402) pwritev(r0, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) 2.956223926s ago: executing program 0 (id=8691): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0xffffffffffffff91, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000040)={@local, @link_local={0x3}, @val={@void, {0x8100, 0x1, 0x0, 0x4}}, {@ipv4={0x8864, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x21, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 2.892007297s ago: executing program 0 (id=8693): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f00000002c0), 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f0000000240)='./file0\x00') mount$afs(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x90, 0x0) openat$incfs(0xffffffffffffff9c, &(0x7f0000000080)='.log\x00', 0x2800, 0x20) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, 0x0) mount$afs(&(0x7f0000000180)=@cell={0x23, 'syz1:', 'syz1', '.backup'}, &(0x7f00000001c0)='.\x00', &(0x7f0000000240), 0x14800, 0x0) gettid() 2.826346954s ago: executing program 0 (id=8696): pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) connect$inet(r1, &(0x7f00000006c0)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) sendmmsg$inet(r1, &(0x7f00000014c0)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000080)="b5", 0x1}, {&(0x7f0000000200)="c9", 0x1}, {&(0x7f0000000340)="01", 0x1}, {&(0x7f0000000400)='Q', 0x1}, {&(0x7f0000000500)="d7", 0x1}, {&(0x7f0000000600)='J', 0x1}, {&(0x7f0000000700)=')', 0x1}, {&(0x7f0000000180)='<', 0x1}], 0x8}}, {{0x0, 0x0, &(0x7f0000002dc0)=[{&(0x7f0000000a40)="db", 0x1}, {&(0x7f0000000840)="e3", 0x1}, {&(0x7f0000000680)="a7", 0x1}, {&(0x7f0000000540)='k', 0x1}, {&(0x7f00000002c0)="c8", 0x1}, {&(0x7f0000002bc0)='>', 0x1}], 0x6}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000940)="b2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000a80)="57cd1a87", 0x4}], 0x1}}], 0x4, 0x4008c50) 2.760412755s ago: executing program 0 (id=8699): r0 = syz_usb_connect(0x3, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000c80)={0x44, &(0x7f0000000a00)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f0000000240)={0x1, 0x6, 0x5, &(0x7f0000000000)={0x4e, "c955000000d5ac81e630a59afe000000000200"}}) 2.335987675s ago: executing program 7 (id=8703): ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240), 0x0}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x0, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x48001}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 2.197380916s ago: executing program 7 (id=8704): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={[0x3]}, 0x0, 0x8) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000080)=0xfffffffa) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) add_key(0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) 1.908975127s ago: executing program 8 (id=8710): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket(0x2b, 0x1, 0x1) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000340)={0x2, 0x4e22, @local}, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 1.828804434s ago: executing program 8 (id=8711): syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect$cdc_ncm(0x5, 0xf3, &(0x7f0000000300)=ANY=[@ANYBLOB="12011001020000402505a1a44000010203010902"], 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x41015500, &(0x7f0000000500)) 1.217312529s ago: executing program 7 (id=8713): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) timer_create(0x0, &(0x7f0000000180)={0x0, 0x11, 0x4}, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) read$FUSE(r1, 0x0, 0x0) r2 = fsopen(&(0x7f0000000040)='xfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x3, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) timer_settime(0x0, 0x236bd4336e4642df, 0x0, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) socketpair$unix(0x1, 0x2, 0x0, 0x0) 401.950604ms ago: executing program 9 (id=8715): keyctl$restrict_keyring(0xa, 0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0xf8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@delchain={0x24, 0x64, 0x1, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {}, {0x2, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004840) 337.974727ms ago: executing program 9 (id=8716): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@delchain={0x3c, 0x2c, 0xf31, 0x70bd27, 0x2000, {0x0, 0x0, 0x0, r5, {0x8, 0x7}, {0xfff2, 0xffff}, {0xfff1, 0xc}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xfff3, 0x10}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) 337.651759ms ago: executing program 9 (id=8717): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001040)={0x3, 0x11, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000000000900000000000000008500000053000000b7080000000000007b8af8ff00000000b7080000fdffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffff", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6cab2ea5}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r1, 0xffffffffffffffff, 0x37, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x3}}, 0x30) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, 0x0, 0x0) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000700)=@ethtool_flash={0x33, 0xea6, '.\x00'}}) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_RANGEINFO(r5, 0x80106408, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000340)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e23, 0xe76, @private0={0xfc, 0x0, '\x00', 0x1}, 0x2}}}, 0x90) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0xd01, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000003740)={r6, 0x0, 0x3a, 0x1000, &(0x7f00000000c0)="7dd53cbd3194ca5fdf819f26407baee211bc663e897588e401f0e4a0fb45b71d77741621473ac658833ca3a65d0cce88271044d28f364b55ad3b", &(0x7f0000002600)=""/4096, 0x5, 0x0, 0xc, 0xeb, &(0x7f0000003600)="c56a8c847238ff52ad060000", &(0x7f0000000500)="229659ccd6f855f1bd40fd739fa8de0cf1ea3f2f73819162675a1ad240b49256c8b5ad664c93136c96f3edc592119ca3df9a80f378d8a74b6a002cad87c687c57201c01f48a4b96bc64e86aafbe22b123676a913b97292c8b81cb7f354a8bbe56b6801d91ea0f5a62faf0660d63f0f204da7c2eb0ff4276ef0f673fc3e0daa8a6375ae443d958b949236f304d7b7ec3c74a34e82949b401a080000000000000019668bedd2eec7ed2766b9f69557646f981aeb9342e4fbd9ee239c7e20caa8beb6b9a56f39c059b4723325cfee096fe5c09269845ea686525461429559d4b3dcbb5134a83966f6c5c8a85a", 0x2, 0x0, 0x3}, 0x50) r7 = fsopen(&(0x7f0000000100)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x7f}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x20020800}, 0x0) sendmsg$IPSET_CMD_FLUSH(r8, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x4c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004040}, 0x40) 337.456872ms ago: executing program 8 (id=8718): socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) socket$kcm(0x29, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000140), 0x2, 0x2) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$igmp(0x2, 0x3, 0x2) openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @private=0xa010101}, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e24, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x4, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 231.119439ms ago: executing program 7 (id=8719): ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240), 0x0}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x0, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x48001}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 230.736407ms ago: executing program 8 (id=8720): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, 0x0}], 0x1, 0x15, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 230.215492ms ago: executing program 9 (id=8721): ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd0900300003003012000060ce902d9f0c2f0081e949b93897bc3b0000000000007d01ff02000000000000000000000000000112006558"], 0xfdef) 113.930133ms ago: executing program 7 (id=8722): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000e80)=ANY=[@ANYBLOB, @ANYRES16=r0, @ANYBLOB="010800040000000000000b01000008000300", @ANYRES32=r2, @ANYBLOB="2800508014000b"], 0x44}}, 0x0) 113.29381ms ago: executing program 7 (id=8723): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000500)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r2, 0x6, 0x4, &(0x7f0000000c00), 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r3, 0x5) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffa}]}) close_range(r5, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) 113.071206ms ago: executing program 8 (id=8724): keyctl$restrict_keyring(0xa, 0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0xf8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@delchain={0x24, 0x64, 0x1, 0x30bd2c, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {}, {0x2, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004840) 57.313371ms ago: executing program 9 (id=8725): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xa2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x1ffffffffffffe, 0x0) read$msr(r1, &(0x7f000004b680)=""/102392, 0x18ff8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x2c, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfff7}, 0x3a, [0x8000, 0xc95a, 0x1, 0x8, 0x7fffffff, 0x2, 0x1080007, 0x7f, 0x20000006, 0xca, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x100001, 0x3, 0x0, 0x5, 0x6, 0x2000001, 0x7, 0x3c5b, 0x1, 0x24, 0x8006, 0x1, 0x5, 0xffffffff, 0xe661, 0x80004, 0x7, 0x89d2, 0x8, 0x4c74, 0x80000000, 0x40000, 0x3, 0xe, 0xfffffffc, 0x80008071, 0x7, 0x17, 0xd, 0x3, 0x2, 0x3e, 0x8f, 0x4006, 0x6, 0x80000000, 0x0, 0xf, 0x8, 0x400, 0x80, 0x0, 0x4, 0x7, 0x8, 0x4, 0x5, 0x40], [0x10000007, 0xf0000000, 0x8000012f, 0x8004, 0x5, 0x6, 0x169432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x19, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0xd, 0x8, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x7ffe, 0x401, 0x6, 0x0, 0xff, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0xfffffffe, 0x7, 0x9, 0x5, 0x3, 0x8, 0xa6d, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x8004, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x2000000, 0x1ef, 0x5, 0x6, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x1, 0x800003, 0x1fe, 0x7e, 0x7, 0x4, 0x2850bfaf, 0xffe, 0xa2, 0x7, 0x4000a9, 0x5, 0x9, 0xac8, 0x2000af, 0xfffffffe, 0x8, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x2, 0x5, 0x42c2, 0x0, 0x6, 0x0, 0xb9, 0x4e7, 0x5, 0x2, 0x57, 0x4, 0x8000003, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a623, 0x2, 0x1, 0x1, 0x2, 0x5, 0xe7, 0x8, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x6, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0xffffffff, 0x5, 0x41, 0x8, 0x30b1d693, 0x5, 0x1f40, 0x7, 0x41, 0x6c1b, 0x0, 0x804, 0xac1, 0xb1e, 0xd7, 0xc, 0xffff3441, 0xfff]}, 0x45c) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x84}, 0x20000800) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x300}], 0x20000000000000dc, 0x0, 0x0, 0x0) 56.923129ms ago: executing program 8 (id=8726): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20040040) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x28, r7, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x58, r7, 0x1, 0x70bd2d, 0x0, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4000004) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r8, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff, 0xf, 0x0, @void}, 0x10) 0s ago: executing program 9 (id=8727): r0 = syz_usb_connect(0x5, 0x24, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x2, 0x402) pwritev(r1, &(0x7f0000000500)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): 60] usb 11-1: config 0 has no interface number 0 [ 1787.555680][ T60] usb 11-1: New USB device found, idVendor=056d, idProduct=0000, bcdDevice=39.00 [ 1787.559777][ T60] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1787.563655][ T60] usb 11-1: Product: syz [ 1787.565608][ T60] usb 11-1: Manufacturer: syz [ 1787.567711][ T60] usb 11-1: SerialNumber: syz [ 1787.573619][ T60] usb 11-1: config 0 descriptor?? [ 1787.798801][ T60] uvcvideo 11-1:0.64: Found Unit with invalid ID 0 [ 1787.801466][ T60] uvcvideo 11-1:0.64: Found UVC 0.00 device syz (056d:0000) [ 1787.803979][ T60] uvcvideo 11-1:0.64: No valid video chain found. [ 1787.809376][ T60] usb 11-1: USB disconnect, device number 11 [ 1787.813882][T26097] EXT4-fs error: 4 callbacks suppressed [ 1787.813891][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1787.822337][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1787.826000][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1788.240998][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1788.245768][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1788.249509][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1788.490082][ T60] usb 10-1: new high-speed USB device number 47 using dummy_hcd [ 1788.639700][T22578] usb 11-1: new high-speed USB device number 12 using dummy_hcd [ 1788.651546][ T60] usb 10-1: Using ep0 maxpacket: 16 [ 1788.655372][ T60] usb 10-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1788.659343][ T60] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1788.662174][ T60] usb 10-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1788.665193][ T60] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1788.673007][ T60] usb 10-1: config 0 descriptor?? [ 1788.687843][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1788.691967][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1788.696240][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1788.801690][T22578] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1788.806286][T22578] usb 11-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1788.810081][T22578] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1788.815850][T22578] usb 11-1: config 0 descriptor?? [ 1788.826329][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1789.066298][T22578] usbhid 11-1:0.0: can't add hid device: -71 [ 1789.099188][T22578] usbhid 11-1:0.0: probe with driver usbhid failed with error -71 [ 1789.103661][T22578] usb 11-1: USB disconnect, device number 12 [ 1789.391349][ T60] usbhid 10-1:0.0: can't add hid device: -71 [ 1789.393335][ T60] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1789.397189][ T60] usb 10-1: USB disconnect, device number 47 [ 1789.624071][T22578] usb 11-1: new high-speed USB device number 13 using dummy_hcd [ 1789.784321][T22578] usb 11-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1789.787930][T22578] usb 11-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1789.791034][T22578] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1789.794881][T22578] usb 11-1: config 0 descriptor?? [ 1789.995732][T31554] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7728'. [ 1790.016668][T31556] openvswitch: netlink: Unknown key attributes 20 [ 1790.659810][T22578] aiptek 11-1:0.0: Aiptek using 400 ms programming speed [ 1790.663559][T22578] input: Aiptek as /devices/platform/dummy_hcd.6/usb11/11-1/11-1:0.0/input/input38 [ 1790.830353][ T6222] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1790.990562][ T6222] usb 5-1: Using ep0 maxpacket: 32 [ 1790.995572][ T6222] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1790.999127][ T6222] usb 5-1: config 14 has an invalid interface number: 228 but max is 0 [ 1791.008009][ T6222] usb 5-1: config 14 has no interface number 0 [ 1791.010129][ T6222] usb 5-1: config 14 interface 228 altsetting 5 has an invalid endpoint descriptor of length 2, skipping [ 1791.014014][ T6222] usb 5-1: config 14 interface 228 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1791.018238][ T6222] usb 5-1: config 14 interface 228 has no altsetting 0 [ 1791.021867][ T34] usb 11-1: USB disconnect, device number 13 [ 1791.024376][ C3] aiptek 11-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1791.030106][ T6222] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 1791.033119][ T6222] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1791.040898][ T6222] usb 5-1: Product: syz [ 1791.042269][ T6222] usb 5-1: Manufacturer: syz [ 1791.044781][ T6222] usb 5-1: SerialNumber: syz [ 1791.275730][ T6222] legousbtower 5-1:14.228: interrupt endpoints not found [ 1791.282138][ T6222] usb 5-1: USB disconnect, device number 88 [ 1791.585176][T31578] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1791.943321][T31597] 9p: Bad value for 'wfdno' [ 1792.032542][ T42] kauditd_printk_skb: 21 callbacks suppressed [ 1792.032558][ T42] audit: type=1326 audit(1783336195.507:986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.043462][ T42] audit: type=1326 audit(1783336195.516:987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.051687][ T42] audit: type=1326 audit(1783336195.516:988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.065509][ T42] audit: type=1326 audit(1783336195.516:989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=91 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.077519][ T42] audit: type=1326 audit(1783336195.516:990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.088173][ T42] audit: type=1326 audit(1783336195.516:991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.098667][ T42] audit: type=1326 audit(1783336195.516:992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.110772][ T42] audit: type=1326 audit(1783336195.516:993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.119899][ T42] audit: type=1326 audit(1783336195.516:994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31602 comm="syz.6.7750" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf701efec code=0x7ffc0000 [ 1792.261558][T31618] program syz.6.7756 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1793.132198][T31642] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7765'. [ 1793.258957][ T50] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1793.452367][ T50] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1793.460390][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1793.467704][ T50] usb 5-1: Product: syz [ 1793.469034][ T50] usb 5-1: Manufacturer: syz [ 1793.477014][ T50] usb 5-1: SerialNumber: syz [ 1793.485737][ T50] usb 5-1: config 0 descriptor?? [ 1793.930390][ T50] usb 5-1: Firmware: major: 165, minor: 173, hardware type: UNKNOWN (213) [ 1794.153158][ T50] usb 5-1: failed to fetch extended address, random address set [ 1794.158569][ T50] usb 5-1: atusb_probe: initialization failed, error = -524 [ 1794.165698][ T50] atusb 5-1:0.0: probe with driver atusb failed with error -524 [ 1794.180751][ T50] usb 5-1: USB disconnect, device number 89 [ 1794.188080][T26097] EXT4-fs error: 16 callbacks suppressed [ 1794.188090][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1794.194075][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1794.204390][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1794.506413][T31664] input: syz0 as /devices/virtual/input/input39 [ 1794.516113][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1794.524551][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1794.530479][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1795.001658][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1795.021976][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1795.028070][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1795.213748][T31688] mac80211_hwsim hwsim30 wlan1: entered promiscuous mode [ 1795.222756][T31688] batman_adv: batadv0: Interface activated: macvtap1 [ 1795.233525][T31688] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 1795.247700][T28822] bridge0: port 2(bridge_slave_1) entered blocking state [ 1795.249994][T28822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1795.402274][T31694] netlink: 116 bytes leftover after parsing attributes in process `syz.3.7784'. [ 1795.413995][T31688] mac80211_hwsim hwsim29 wlan0: entered promiscuous mode [ 1795.429100][T31688] mac80211_hwsim hwsim29 wlan0: entered allmulticast mode [ 1796.184000][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1796.578057][T31720] 9p: Bad value for 'rfdno' [ 1797.160131][T31747] 9p: Bad value for 'rfdno' [ 1798.139007][ T64] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 1798.265134][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1798.333288][T31774] 9p: Bad value for 'rfdno' [ 1798.368546][T31776] netlink: 56 bytes leftover after parsing attributes in process `syz.3.7819'. [ 1798.752656][ T6222] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1798.843238][T31804] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7832'. [ 1798.844838][T22578] usb 11-1: new high-speed USB device number 14 using dummy_hcd [ 1798.911187][ T6222] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1798.915174][ T6222] usb 5-1: config 0 has an invalid interface number: 249 but max is 0 [ 1798.918459][ T6222] usb 5-1: config 0 has no interface number 0 [ 1798.921221][ T6222] usb 5-1: config 0 interface 249 has no altsetting 0 [ 1798.925819][ T6222] usb 5-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 1798.929150][ T6222] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1798.932022][ T6222] usb 5-1: Product: syz [ 1798.933410][ T6222] usb 5-1: Manufacturer: syz [ 1798.934897][ T6222] usb 5-1: SerialNumber: syz [ 1798.939139][ T6222] usb 5-1: config 0 descriptor?? [ 1798.983865][T22578] usb 11-1: device descriptor read/64, error -71 [ 1799.240162][T22578] usb 11-1: new high-speed USB device number 15 using dummy_hcd [ 1799.379131][T22578] usb 11-1: device descriptor read/64, error -71 [ 1799.496902][T22578] usb usb11-port1: attempt power cycle [ 1800.073758][T22578] usb 11-1: new high-speed USB device number 16 using dummy_hcd [ 1800.110599][T22578] usb 11-1: device descriptor read/8, error -71 [ 1800.362489][T22578] usb 11-1: new high-speed USB device number 17 using dummy_hcd [ 1800.384118][T22578] usb 11-1: device descriptor read/8, error -71 [ 1800.501671][T22578] usb usb11-port1: unable to enumerate USB device [ 1801.478808][ T5154] EXT4-fs error: 2 callbacks suppressed [ 1801.478820][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1801.495726][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1801.499866][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1801.617178][ T6222] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 1801.622801][ T6222] gspca_sn9c2028: read1 error -71 [ 1801.625147][ T6222] gspca_sn9c2028: read1 error -71 [ 1801.627036][ T6222] gspca_sn9c2028: read1 error -71 [ 1801.628764][ T6222] sn9c2028 5-1:0.249: probe with driver sn9c2028 failed with error -71 [ 1801.633477][ T6222] usb 5-1: USB disconnect, device number 90 [ 1801.718593][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1801.722471][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1801.726161][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1801.805115][T23301] usb 10-1: new high-speed USB device number 48 using dummy_hcd [ 1801.966590][T23301] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1801.970662][T23301] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1801.975634][T23301] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1801.981786][T23301] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1801.987377][T23301] usb 10-1: config 0 descriptor?? [ 1801.998118][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1802.003109][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1802.008353][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1802.209457][T23301] usbhid 10-1:0.0: can't add hid device: -71 [ 1802.211581][T23301] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1802.219130][T23301] usb 10-1: USB disconnect, device number 48 [ 1802.691848][T23301] usb 10-1: new high-speed USB device number 49 using dummy_hcd [ 1802.714631][T31872] program syz.3.7857 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1802.852243][T23301] usb 10-1: Using ep0 maxpacket: 8 [ 1802.855996][T23301] usb 10-1: config 0 has an invalid interface number: 52 but max is 0 [ 1802.859016][T23301] usb 10-1: config 0 has no interface number 0 [ 1802.861015][T23301] usb 10-1: config 0 interface 52 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1802.864523][T23301] usb 10-1: config 0 interface 52 altsetting 1 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1802.867812][T23301] usb 10-1: config 0 interface 52 has no altsetting 0 [ 1802.870469][T23301] usb 10-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 8.00 [ 1802.873271][T23301] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1802.877737][T23301] usb 10-1: config 0 descriptor?? [ 1802.899014][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1803.098194][T23301] input: USB Synaptics Device 06cb:0007 (Stick) as /devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.52/input/input40 [ 1803.111520][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.120890][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.130825][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.146683][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.151346][T26090] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.155093][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.162824][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.167009][ T5139] synaptics_usb 10-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 1803.309947][T23301] usb 10-1: USB disconnect, device number 49 [ 1803.920839][ T6222] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1804.295049][ T6222] usb 5-1: Using ep0 maxpacket: 16 [ 1804.304308][ T6222] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1804.312046][ T6222] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1804.320087][ T6222] usb 5-1: Product: syz [ 1804.322351][ T6222] usb 5-1: Manufacturer: syz [ 1804.324428][ T6222] usb 5-1: SerialNumber: syz [ 1804.330337][ T6222] usb 5-1: config 0 descriptor?? [ 1804.551913][ T6222] speedtch 5-1:0.0: speedtch_bind: data interface not found! [ 1804.554407][ T6222] speedtch 5-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1804.768705][T23301] usb 5-1: USB disconnect, device number 91 [ 1805.142288][T31928] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7878'. [ 1805.157278][T31928] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7878'. [ 1805.634492][T31949] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7884'. [ 1806.297688][T31957] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1806.302950][T31957] overlayfs: failed to set xattr on upper [ 1806.305848][T31957] overlayfs: ...falling back to redirect_dir=nofollow. [ 1806.308876][T31957] overlayfs: ...falling back to index=off. [ 1806.311484][T31957] overlayfs: ...falling back to uuid=null. [ 1806.432686][ T5862] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1807.744207][T32007] ecryptfs_validate_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 1807.780623][T32007] Error validating options; rc = [-22] [ 1807.863627][T32015] snd_dummy snd_dummy.0: control 5:1023:7:syz1:1024 is already present [ 1808.521702][ T5154] EXT4-fs error: 16 callbacks suppressed [ 1808.521715][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1808.539789][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1808.546035][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1809.757746][T32073] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1809.770055][T32074] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:3: iget: checksum invalid [ 1809.945652][ T50] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1810.118570][ T50] usb 5-1: Using ep0 maxpacket: 8 [ 1810.127234][ T50] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1810.137076][ T50] usb 5-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1810.153483][ T50] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1810.163778][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1810.173443][ T50] usbtmc 5-1:16.0: bulk endpoints not found [ 1810.176084][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1810.179787][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1810.186459][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1810.207265][T32093] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:32: iget: checksum invalid [ 1810.625866][T32106] hub 8-0:1.0: USB hub found [ 1810.631709][T32106] hub 8-0:1.0: 1 port detected [ 1811.242571][T32116] bond2: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 1811.249977][T32116] bond2 (unregistering): Released all slaves [ 1811.380571][T32125] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7954'. [ 1812.652389][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1812.895420][ T5862] usb 5-1: USB disconnect, device number 92 [ 1813.350343][T32169] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7972'. [ 1813.489588][T32174] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7974'. [ 1814.072519][T32198] netlink: 'syz.3.7984': attribute type 6 has an invalid length. [ 1815.349725][T32247] netlink: 24 bytes leftover after parsing attributes in process `syz.5.7999'. [ 1816.680613][ T5154] EXT4-fs error: 2 callbacks suppressed [ 1816.680624][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1816.687392][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1816.691639][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1816.699179][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1817.058189][T32290] netlink: 72 bytes leftover after parsing attributes in process `syz.5.8021'. [ 1817.165670][T32294] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:24: iget: checksum invalid [ 1817.171463][T32295] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:24: iget: checksum invalid [ 1817.769830][ T50] usb 11-1: new high-speed USB device number 18 using dummy_hcd [ 1817.940764][ T50] usb 11-1: Using ep0 maxpacket: 8 [ 1817.943823][ T50] usb 11-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1817.947285][ T50] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1817.950348][ T50] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1817.955539][ T50] usb 11-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1817.959974][ T50] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1817.962994][ T50] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1817.968617][ T50] usbtmc 11-1:16.0: bulk endpoints not found [ 1817.977820][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1817.981376][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1817.991468][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1818.194910][T32330] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8038'. [ 1818.200589][T32330] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8038'. [ 1818.203944][T32330] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8038'. [ 1818.330196][T32343] trusted_key: encrypted_key: key user:syz not found [ 1819.428090][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 1820.263908][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1820.270659][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1820.741209][ T6222] usb 11-1: USB disconnect, device number 18 [ 1820.850346][T32397] netlink: 68 bytes leftover after parsing attributes in process `syz.6.8066'. [ 1823.506128][ T5154] EXT4-fs error: 1 callbacks suppressed [ 1823.506145][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1823.513686][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1823.564429][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1823.651791][T32489] Bluetooth: hci0: invalid len left 7, exp >= 50 [ 1824.734527][T32522] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:2: iget: checksum invalid [ 1824.746068][T32523] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:3: iget: checksum invalid [ 1824.899772][T23301] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1825.079076][T23301] usb 5-1: Using ep0 maxpacket: 16 [ 1825.087246][T23301] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1825.094089][T23301] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1825.102304][T23301] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 0 [ 1825.106564][T23301] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1825.115112][T23301] usb 5-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 1825.119220][T23301] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1825.122671][T23301] usb 5-1: Product: syz [ 1825.124566][T23301] usb 5-1: Manufacturer: syz [ 1825.126673][T23301] usb 5-1: SerialNumber: syz [ 1825.139723][T23301] usb 5-1: config 0 descriptor?? [ 1825.151833][T23301] port100 5-1:0.0: NFC: Could not find bulk-in or bulk-out endpoint [ 1825.283981][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1825.289485][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1825.292546][T32530] netlink: 80 bytes leftover after parsing attributes in process `syz.5.8121'. [ 1825.297142][T32530] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8121'. [ 1825.300160][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1825.308619][T32530] geneve0: entered allmulticast mode [ 1825.372721][ T6222] usb 5-1: USB disconnect, device number 93 [ 1825.666954][T23494] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1825.839812][T23494] usb 8-1: Using ep0 maxpacket: 8 [ 1825.843037][T23494] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1825.846239][T23494] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1825.849421][T23494] usb 8-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1825.852945][T23494] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1825.857196][T23494] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1825.860123][T23494] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1825.866430][T23494] usbtmc 8-1:16.0: bulk endpoints not found [ 1825.871628][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1825.875535][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1826.406962][T32549] Bluetooth: hci0: unsupported parameter 255 [ 1826.409577][T32549] Bluetooth: hci0: unsupported parameter 255 [ 1826.635212][T32563] syzkaller0: entered promiscuous mode [ 1826.637292][T32563] syzkaller0: entered allmulticast mode [ 1826.882125][T32569] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8138'. [ 1826.951816][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1827.601410][T23494] usb 10-1: new high-speed USB device number 50 using dummy_hcd [ 1827.761316][T23494] usb 10-1: Using ep0 maxpacket: 8 [ 1827.765452][T23494] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 1827.768934][T23494] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1827.773112][T23494] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1827.777381][T23494] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1827.781588][T23494] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1827.787783][T23494] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1827.791560][T23494] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1828.018255][T23494] usb 10-1: usb_control_msg returned -32 [ 1828.020586][T23494] usbtmc 10-1:16.0: can't read capabilities [ 1828.353935][ T5761] Bluetooth: hci3: link tx timeout [ 1828.396196][T32625] usbtmc 10-1:16.0: usbtmc488_ioctl_trigger returned -90 [ 1828.630427][T23301] usb 8-1: USB disconnect, device number 7 [ 1828.738112][T32636] tipc: Enabled bearer , priority 0 [ 1828.742274][T32636] mac80211_hwsim hwsim29 syzkaller0: entered promiscuous mode [ 1828.745317][T32636] mac80211_hwsim hwsim29 syzkaller0: entered allmulticast mode [ 1829.727562][ T5862] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1829.834354][T23301] usb 11-1: new high-speed USB device number 19 using dummy_hcd [ 1829.849698][ T42] audit: type=1326 audit(1783336230.889:995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.859143][ T42] audit: type=1326 audit(1783336230.889:996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.867422][ T42] audit: type=1326 audit(1783336230.908:997): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.875491][ T42] audit: type=1326 audit(1783336230.908:998): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.883506][ T42] audit: type=1326 audit(1783336230.908:999): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=426 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.887949][ T5862] usb 5-1: Using ep0 maxpacket: 8 [ 1829.891433][ T42] audit: type=1326 audit(1783336230.908:1000): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.895357][ T5862] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1829.902034][ T42] audit: type=1326 audit(1783336230.908:1001): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.904987][ T5862] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1829.912449][ T42] audit: type=1326 audit(1783336230.908:1002): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.915823][ T5862] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1829.924055][ T42] audit: type=1326 audit(1783336230.908:1003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32661 comm="syz.3.8181" exe="/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf7fe7fec code=0x7ffc0000 [ 1829.927796][ T5862] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1829.930656][ T60] tipc: Node number set to 301580713 [ 1829.945616][ T5862] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1829.949333][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1829.958886][ T5862] usbtmc 5-1:16.0: bulk endpoints not found [ 1829.978373][T26097] EXT4-fs error: 7 callbacks suppressed [ 1829.978388][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1829.985753][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1829.990549][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1830.005653][T23301] usb 11-1: Using ep0 maxpacket: 8 [ 1830.018917][T23301] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1830.025297][T23301] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1830.033139][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1830.047962][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1830.055516][T23301] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1830.058900][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1830.064538][T23301] pvrusb2: ********** [ 1830.066309][T23301] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1830.073209][T23301] pvrusb2: Important functionality might not be entirely working. [ 1830.076617][T23301] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1830.082485][T23301] pvrusb2: ********** [ 1830.083170][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1830.088072][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1830.092871][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1830.271617][ T2515] pvrusb2: Invalid write control endpoint [ 1830.304153][T32675] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:32: iget: checksum invalid [ 1830.316260][ T2515] pvrusb2: Invalid write control endpoint [ 1830.320760][ T2515] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1830.324508][ T2515] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1830.332399][ T2515] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1830.337064][ T2515] pvrusb2: Device being rendered inoperable [ 1830.347443][ T2515] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1830.352857][ T2515] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1830.367404][ T2515] pvrusb2: Attached sub-driver cx25840 [ 1830.370956][ T2515] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1830.377499][ T2515] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1830.486917][T32656] pvrusb2: Attempted to execute control transfer when device not ok [ 1830.497542][T23494] usb 11-1: USB disconnect, device number 19 [ 1830.532244][T23415] usb 10-1: USB disconnect, device number 50 [ 1830.688242][T22578] IPVS: starting estimator thread 0... [ 1830.796860][T32681] IPVS: using max 48 ests per chain, 115200 per kthread [ 1830.827560][T32686] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8187'. [ 1831.529466][T32715] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1831.532133][T32715] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1831.534681][T32715] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1831.542084][T32719] fuse: Bad value for 'fd' [ 1831.607736][T32723] netlink: 40 bytes leftover after parsing attributes in process `syz.5.8204'. [ 1831.938561][T32746] netlink: 40 bytes leftover after parsing attributes in process `syz.6.8215'. [ 1832.672527][T26383] usb 5-1: USB disconnect, device number 94 [ 1832.779755][ T317] syzkaller1: entered promiscuous mode [ 1832.782152][ T317] syzkaller1: entered allmulticast mode [ 1833.022068][ T325] kvm: requested 179352 ns i8254 timer period limited to 200000 ns [ 1833.025777][ T325] kvm: requested 132419 ns i8254 timer period limited to 200000 ns [ 1833.029269][ T325] kvm: requested 90514 ns i8254 timer period limited to 200000 ns [ 1833.033654][ T325] kvm: requested 33523 ns i8254 timer period limited to 200000 ns [ 1833.046609][ T325] kvm: requested 186057 ns i8254 timer period limited to 200000 ns [ 1833.050260][ T325] kvm: requested 48609 ns i8254 timer period limited to 200000 ns [ 1833.053878][ T325] kvm: requested 56990 ns i8254 timer period limited to 200000 ns [ 1833.057384][ T325] kvm: requested 102247 ns i8254 timer period limited to 200000 ns [ 1833.060911][ T325] kvm: requested 98895 ns i8254 timer period limited to 200000 ns [ 1833.393109][ T5862] usb 11-1: new low-speed USB device number 20 using dummy_hcd [ 1833.578371][ T5862] usb 11-1: LPM exit latency is zeroed, disabling LPM. [ 1833.584615][ T5862] usb 11-1: config 129 has an invalid interface number: 176 but max is 0 [ 1833.588150][ T5862] usb 11-1: config 129 has no interface number 0 [ 1833.590457][ T5862] usb 11-1: config 129 interface 176 has no altsetting 0 [ 1833.601252][ T5862] usb 11-1: string descriptor 0 read error: -22 [ 1833.604022][ T5862] usb 11-1: New USB device found, idVendor=19d2, idProduct=0412, bcdDevice=69.83 [ 1833.607479][ T5862] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1833.646724][ T5862] option 11-1:129.176: GSM modem (1-port) converter detected [ 1833.713630][ T5761] Bluetooth: hci1: command 0x0c1a tx timeout [ 1833.714212][ T64] Bluetooth: hci3: command 0x0419 tx timeout [ 1833.991529][ T5862] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1834.183686][ T5862] usb 5-1: Using ep0 maxpacket: 8 [ 1834.196137][ T5862] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1834.200328][ T5862] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1834.206722][ T5862] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1834.212760][ T5862] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1834.228666][ T5862] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1834.253896][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1834.281698][ T5862] usbtmc 5-1:16.0: bulk endpoints not found [ 1834.900221][ T5862] usb 10-1: new high-speed USB device number 51 using dummy_hcd [ 1835.059917][ T5862] usb 10-1: Using ep0 maxpacket: 8 [ 1835.063969][ T5862] usb 10-1: config 0 has an invalid interface number: 31 but max is 0 [ 1835.067471][ T5862] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1835.071836][ T5862] usb 10-1: config 0 has no interface number 0 [ 1835.077557][ T5862] usb 10-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1835.081414][ T5862] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1835.084641][ T5862] usb 10-1: Product: syz [ 1835.086432][ T5862] usb 10-1: Manufacturer: syz [ 1835.088029][ T5862] usb 10-1: SerialNumber: syz [ 1835.090904][ T5862] usb 10-1: config 0 descriptor?? [ 1835.095907][ T5862] uvcvideo 10-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1835.098323][ T5862] uvcvideo 10-1:0.31: No valid video chain found. [ 1835.316375][T23494] usb 10-1: USB disconnect, device number 51 [ 1835.925817][ T64] Bluetooth: hci3: command 0x0419 tx timeout [ 1836.166603][T23494] usb 11-1: USB disconnect, device number 20 [ 1836.171703][T23494] option 11-1:129.176: device disconnected [ 1836.696901][ T5154] EXT4-fs error: 15 callbacks suppressed [ 1836.696913][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1836.702763][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1836.706900][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1836.940348][T26383] usb 5-1: USB disconnect, device number 95 [ 1837.080616][ T376] fuse: Bad value for 'fd' [ 1837.112568][ T378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8259'. [ 1837.209052][T20922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.212002][T20922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.214551][T20922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.217126][T20922] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.221183][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.223789][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.226304][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.229925][T23415] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1837.531255][ T60] usb 10-1: new high-speed USB device number 52 using dummy_hcd [ 1837.699396][ T60] usb 10-1: Using ep0 maxpacket: 8 [ 1837.702779][ T60] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1837.706540][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1837.709641][ T60] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1837.712914][ T60] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1837.716037][ T60] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1837.720196][ T60] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1837.723153][ T60] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1837.728701][ T60] usbtmc 10-1:16.0: probe with driver usbtmc failed with error -22 [ 1837.734775][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1837.738914][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1837.743966][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1838.041330][ T34] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1838.203325][ T34] usb 5-1: config 0 has no interfaces? [ 1838.207007][ T34] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1838.209990][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1838.212836][ T34] usb 5-1: Product: syz [ 1838.214169][ T34] usb 5-1: Manufacturer: syz [ 1838.215835][ T34] usb 5-1: SerialNumber: syz [ 1838.219197][ T34] usb 5-1: config 0 descriptor?? [ 1838.440614][ T34] usb 5-1: USB disconnect, device number 96 [ 1840.049589][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1840.058043][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1840.062860][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1840.126157][ T415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8275'. [ 1840.486090][ T34] usb 10-1: USB disconnect, device number 52 [ 1842.288325][ T471] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1842.598900][ T490] netlink: 8 bytes leftover after parsing attributes in process `syz.6.8303'. [ 1843.269279][ T510] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8316'. [ 1843.284593][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1843.299092][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1843.303331][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1843.334526][ T514] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8318'. [ 1843.398979][ T518] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8320'. [ 1843.402504][ T518] netlink: 16 bytes leftover after parsing attributes in process `syz.5.8320'. [ 1844.019521][ T532] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1844.032639][ T533] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1844.095768][ T538] netlink: 172 bytes leftover after parsing attributes in process `syz.0.8329'. [ 1844.098791][ T538] block nbd0: not configured, cannot reconfigure [ 1844.764003][T23494] usb 11-1: new high-speed USB device number 21 using dummy_hcd [ 1844.933822][T23494] usb 11-1: Using ep0 maxpacket: 8 [ 1844.937280][T23494] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1844.940442][T23494] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1844.943553][T23494] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1844.946831][T23494] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1844.949862][T23494] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1844.953856][T23494] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1844.958419][T23494] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1844.965843][T23494] usbtmc 11-1:16.0: probe with driver usbtmc failed with error -22 [ 1844.973370][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1844.979441][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1844.984289][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1845.623506][ T604] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1845.628844][ T605] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1845.959722][T23494] usb 10-1: new high-speed USB device number 53 using dummy_hcd [ 1846.130620][T23494] usb 10-1: Using ep0 maxpacket: 8 [ 1846.134160][T23494] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 1846.136922][T23494] usb 10-1: config 0 has no interface number 0 [ 1846.138955][T23494] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1846.143550][T23494] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1846.148171][T23494] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1846.151946][T23494] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1846.156005][T23494] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1846.158968][T23494] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1846.163388][T23494] usb 10-1: config 0 descriptor?? [ 1846.169085][T23494] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1846.226619][ T621] netlink: 'syz.0.8365': attribute type 3 has an invalid length. [ 1846.230124][ T621] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8365'. [ 1846.385779][T23494] usb 10-1: USB disconnect, device number 53 [ 1846.385862][ C1] ldusb 10-1:0.55: usb_submit_urb failed (-19) [ 1846.399899][T23494] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 1846.581781][ T5761] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1846.603046][ T5761] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1846.605915][ T609] ldusb: No device or device unplugged -19 [ 1846.625218][ T5761] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1846.630443][ T5761] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1846.634834][ T5761] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1846.694442][ T631] lo speed is unknown, defaulting to 1000 [ 1846.901186][ T631] bridge0: port 1(bridge_slave_0) entered blocking state [ 1846.904265][ T631] bridge0: port 1(bridge_slave_0) entered disabled state [ 1846.907436][ T631] bridge_slave_0: entered allmulticast mode [ 1846.911721][ T631] bridge_slave_0: entered promiscuous mode [ 1846.916833][ T631] bridge0: port 2(bridge_slave_1) entered blocking state [ 1846.919257][ T631] bridge0: port 2(bridge_slave_1) entered disabled state [ 1846.922396][ T631] bridge_slave_1: entered allmulticast mode [ 1846.925349][ T631] bridge_slave_1: entered promiscuous mode [ 1846.950728][ T631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1846.960862][ T631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1846.979815][ T631] team0: Port device team_slave_0 added [ 1846.983119][ T631] team0: Port device team_slave_1 added [ 1846.998188][ T631] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1847.000424][ T631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1847.008839][ T631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1847.013230][ T631] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1847.015447][ T631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1847.023699][ T631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1847.049436][ T631] hsr_slave_0: entered promiscuous mode [ 1847.051945][ T631] hsr_slave_1: entered promiscuous mode [ 1847.054509][ T631] debugfs: 'hsr0' already exists in 'hsr' [ 1847.056394][ T631] Cannot create hsr debugfs directory [ 1847.193334][ T631] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1847.220150][ T649] syzkaller0: entered promiscuous mode [ 1847.222144][ T649] syzkaller0: entered allmulticast mode [ 1847.303286][ T631] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1847.413715][ T631] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1847.477455][ T5862] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1847.521649][ T631] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1847.647485][ T631] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1847.651815][ T631] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1847.654579][ T631] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1847.671873][ T631] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1847.674797][ T631] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1847.684118][ T631] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1847.686880][ T631] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1847.690896][ T631] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1847.705243][ T631] bridge0: port 2(bridge_slave_1) entered blocking state [ 1847.707553][ T631] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1847.709930][ T631] bridge0: port 1(bridge_slave_0) entered blocking state [ 1847.712223][ T631] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1847.731511][T20922] bridge0: port 1(bridge_slave_0) entered disabled state [ 1847.736431][T20922] bridge0: port 2(bridge_slave_1) entered disabled state [ 1847.741976][ T5862] usb 11-1: USB disconnect, device number 21 [ 1847.771255][ T631] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1847.781534][ T631] 8021q: adding VLAN 0 to HW filter on device team0 [ 1847.792619][T20922] bridge0: port 1(bridge_slave_0) entered blocking state [ 1847.794825][T20922] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1847.804300][T20922] bridge0: port 2(bridge_slave_1) entered blocking state [ 1847.806921][T20922] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1847.876015][ T631] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1847.906197][ T631] veth0_vlan: entered promiscuous mode [ 1847.911987][ T631] veth1_vlan: entered promiscuous mode [ 1847.932773][ T631] veth0_macvtap: entered promiscuous mode [ 1847.938646][ T631] veth1_macvtap: entered promiscuous mode [ 1847.949632][ T631] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1847.956781][ T631] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1847.970774][T11699] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1847.973617][T11699] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1847.977212][T11699] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1847.981140][T11699] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1848.042891][T28822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1848.046369][T28822] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1848.087632][T28822] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1848.091136][T28822] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1848.753716][ T64] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1848.781154][ T64] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1848.786506][ T64] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1848.789589][ T64] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1848.794020][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1848.812316][ T698] EXT4-fs error: 32 callbacks suppressed [ 1848.812329][ T698] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.828387][ T699] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.835849][ T5761] Bluetooth: hci2: command tx timeout [ 1848.839454][ T700] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.848412][ T703] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.853781][ T704] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:3: iget: checksum invalid [ 1848.860029][ T705] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:3: iget: checksum invalid [ 1848.866528][ T706] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.872948][ T707] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:0: iget: checksum invalid [ 1848.914419][ T5761] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 1848.917617][ T5761] CPU: 2 UID: 0 PID: 5761 Comm: kworker/u34:8 Tainted: G L syzkaller #0 PREEMPT(full) [ 1848.917636][ T5761] Tainted: [L]=SOFTLOCKUP [ 1848.917640][ T5761] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1848.917650][ T5761] Workqueue: hci2 hci_rx_work [ 1848.917724][ T5761] Call Trace: [ 1848.917729][ T5761] [ 1848.917735][ T5761] dump_stack_lvl+0x100/0x190 [ 1848.917754][ T5761] sysfs_warn_dup.cold+0x1c/0x28 [ 1848.917773][ T5761] sysfs_create_dir_ns+0x24b/0x2b0 [ 1848.917819][ T5761] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1848.917834][ T5761] ? find_held_lock+0x2b/0x80 [ 1848.917851][ T5761] ? kobject_add_internal+0x25f/0x930 [ 1848.917867][ T5761] ? kobject_add_internal+0x25f/0x930 [ 1848.917882][ T5761] ? do_raw_spin_unlock+0x145/0x1e0 [ 1848.917895][ T5761] kobject_add_internal+0x2c8/0x930 [ 1848.917911][ T5761] kobject_add+0x16a/0x1e0 [ 1848.917924][ T5761] ? __pfx_kobject_add+0x10/0x10 [ 1848.917937][ T5761] ? class_to_subsys+0x10f/0x150 [ 1848.918011][ T5761] ? kobject_put+0xb9/0x640 [ 1848.918024][ T5761] ? _raw_spin_unlock+0x28/0x50 [ 1848.918050][ T5761] device_add+0x294/0x1970 [ 1848.918068][ T5761] ? __pfx_dev_set_name+0x10/0x10 [ 1848.918087][ T5761] ? __pfx_device_add+0x10/0x10 [ 1848.918103][ T5761] ? mgmt_send_event_skb+0x2fb/0x460 [ 1848.918149][ T5761] hci_conn_add_sysfs+0x1a3/0x260 [ 1848.918163][ T5761] le_conn_complete_evt+0x11eb/0x1f60 [ 1848.918186][ T5761] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1848.918229][ T5761] ? hci_event_packet+0x186/0xcd0 [ 1848.918250][ T5761] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1848.918268][ T5761] ? skb_pull_data+0x15f/0x1e0 [ 1848.918290][ T5761] hci_le_meta_evt+0x34a/0x5f0 [ 1848.918310][ T5761] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1848.918329][ T5761] hci_event_packet+0x51c/0xcd0 [ 1848.918346][ T5761] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1848.918364][ T5761] ? __pfx_hci_event_packet+0x10/0x10 [ 1848.918382][ T5761] ? kcov_remote_start+0x384/0x670 [ 1848.918398][ T5761] ? lockdep_hardirqs_on+0x78/0x100 [ 1848.918419][ T5761] hci_rx_work+0x451/0xfc0 [ 1848.918438][ T5761] process_one_work+0xa23/0x1940 [ 1848.918460][ T5761] ? __pfx_process_one_work+0x10/0x10 [ 1848.918479][ T5761] ? __pfx_hci_rx_work+0x10/0x10 [ 1848.918496][ T5761] worker_thread+0x5ef/0xe50 [ 1848.918531][ T5761] ? kthread+0x13a/0x450 [ 1848.918544][ T5761] ? __pfx_worker_thread+0x10/0x10 [ 1848.918558][ T5761] kthread+0x370/0x450 [ 1848.918571][ T5761] ? __pfx_kthread+0x10/0x10 [ 1848.918585][ T5761] ret_from_fork+0x72b/0xd50 [ 1848.918599][ T5761] ? __pfx_ret_from_fork+0x10/0x10 [ 1848.918614][ T5761] ? __switch_to+0x800/0x10f0 [ 1848.918631][ T5761] ? __pfx_kthread+0x10/0x10 [ 1848.918647][ T5761] ret_from_fork_asm+0x1a/0x30 [ 1848.918670][ T5761] [ 1849.001639][ T5761] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1849.006147][ T5761] Bluetooth: hci2: failed to register connection device [ 1849.028182][ T694] lo speed is unknown, defaulting to 1000 [ 1849.064113][ T1] EXT4-fs error (device sda1): ext4_lookup:1785: inode #2001: comm init: iget: checksum invalid [ 1849.068058][ T1] EXT4-fs error (device sda1): ext4_lookup:1785: inode #2001: comm init: iget: checksum invalid [ 1849.082506][T11685] usb 11-1: new high-speed USB device number 22 using dummy_hcd [ 1849.151486][T23346] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1849.250950][T11685] usb 11-1: Using ep0 maxpacket: 8 [ 1849.254426][T11685] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1849.258176][T11685] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1849.261777][T11685] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1849.264606][T11685] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1849.268302][T11685] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1849.270871][T11685] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1849.302969][T23346] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1849.410379][ T694] bridge0: port 1(bridge_slave_0) entered blocking state [ 1849.412906][ T694] bridge0: port 1(bridge_slave_0) entered disabled state [ 1849.415345][ T694] bridge_slave_0: entered allmulticast mode [ 1849.418844][ T694] bridge_slave_0: entered promiscuous mode [ 1849.456088][T23346] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1849.471348][ T694] bridge0: port 2(bridge_slave_1) entered blocking state [ 1849.473802][ T694] bridge0: port 2(bridge_slave_1) entered disabled state [ 1849.477541][ T694] bridge_slave_1: entered allmulticast mode [ 1849.481069][ T694] bridge_slave_1: entered promiscuous mode [ 1849.503524][ T694] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1849.510613][ T694] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1849.517396][T11685] usb 11-1: usb_control_msg returned -32 [ 1849.523350][T11685] usbtmc 11-1:16.0: can't read capabilities [ 1849.526613][ T694] team0: Port device team_slave_0 added [ 1849.530687][ T694] team0: Port device team_slave_1 added [ 1849.547793][T11685] usb 11-1: USB disconnect, device number 22 [ 1849.569583][ T694] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1849.571952][ T694] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1849.580046][ T694] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1849.584994][ T694] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1849.587314][ T694] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1849.595928][ T694] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1849.633464][T23346] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1849.662460][ T694] hsr_slave_0: entered promiscuous mode [ 1849.664867][ T694] hsr_slave_1: entered promiscuous mode [ 1849.667105][ T694] debugfs: 'hsr0' already exists in 'hsr' [ 1849.669175][ T694] Cannot create hsr debugfs directory [ 1849.921347][ T694] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1849.925968][ T694] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1849.930362][ T694] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1849.934384][ T694] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1849.937431][ T694] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1849.942154][ T694] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1849.955354][ T721] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8387'. [ 1849.984568][ T694] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1849.991139][ T694] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1850.028814][T23346] bridge_slave_1: left allmulticast mode [ 1850.033846][T23346] bridge_slave_1: left promiscuous mode [ 1850.038379][T23346] bridge0: port 2(bridge_slave_1) entered disabled state [ 1850.056099][T23346] bridge_slave_0: left allmulticast mode [ 1850.058891][T23346] bridge_slave_0: left promiscuous mode [ 1850.061245][T23346] bridge0: port 1(bridge_slave_0) entered disabled state [ 1850.392398][T23346] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1850.404872][T23346] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1850.420356][T23346] bond0 (unregistering): Released all slaves [ 1850.505635][ T5456] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1850.536729][ T694] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1850.553940][ T5456] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1850.561215][ T694] 8021q: adding VLAN 0 to HW filter on device team0 [ 1850.572614][T28822] bridge0: port 1(bridge_slave_0) entered blocking state [ 1850.575019][T28822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1850.580400][T23346] tipc: Disabling bearer [ 1850.595781][T23346] tipc: Left network mode [ 1850.613582][ T5456] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1850.618095][T28822] bridge0: port 2(bridge_slave_1) entered blocking state [ 1850.620665][T28822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1850.853271][ T5456] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1851.006228][ T5761] Bluetooth: hci0: command tx timeout [ 1851.055890][T23346] batman_adv: batadv0: Interface deactivated: macvtap1 [ 1851.068981][ T5761] Bluetooth: hci2: command tx timeout [ 1851.102064][T23346] batman_adv: batadv0: Removing interface: macvtap1 [ 1851.138347][ T694] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1851.272632][ T694] veth0_vlan: entered promiscuous mode [ 1851.278266][ T694] veth1_vlan: entered promiscuous mode [ 1851.293897][ T694] veth0_macvtap: entered promiscuous mode [ 1851.299277][ T694] veth1_macvtap: entered promiscuous mode [ 1851.310719][ T694] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1851.319464][ T694] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1851.329272][ T12] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1851.338972][ T12] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1851.345267][ T12] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1851.349712][ T12] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1851.511176][T21442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1851.513857][T21442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1851.539988][T23346] hsr_slave_0: left promiscuous mode [ 1851.542481][T23346] hsr_slave_1: left promiscuous mode [ 1851.545053][T23346] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1851.548238][T23346] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1851.556761][T23346] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1851.565144][T23346] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1851.577961][T23346] veth1_macvtap: left promiscuous mode [ 1851.579950][T23346] veth0_macvtap: left promiscuous mode [ 1851.582130][T23346] veth1_vlan: left promiscuous mode [ 1851.584460][T23346] veth0_vlan: left promiscuous mode [ 1851.957988][T23346] team0 (unregistering): Port device team_slave_1 removed [ 1851.967149][T23346] team0 (unregistering): Port device team_slave_0 removed [ 1852.057643][T25017] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1852.060264][T25017] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1852.229820][ T60] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1852.284312][ T782] Bluetooth: MGMT ver 1.23 [ 1852.393711][ T60] usb 5-1: Using ep0 maxpacket: 8 [ 1852.397649][ T60] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1852.402058][ T60] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1852.406207][ T60] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1852.409363][ T60] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1852.413881][ T60] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1852.416820][ T60] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1852.427594][T23346] IPVS: stop unused estimator thread 0... [ 1852.640368][ T60] usb 5-1: usb_control_msg returned -32 [ 1852.642484][ T60] usbtmc 5-1:16.0: can't read capabilities [ 1852.649968][ T60] usb 5-1: USB disconnect, device number 97 [ 1853.205664][ T5761] Bluetooth: hci0: command tx timeout [ 1853.290974][ T5761] Bluetooth: hci2: command tx timeout [ 1854.946655][ T60] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 1855.107017][ T60] usb 12-1: Using ep0 maxpacket: 8 [ 1855.111044][ T60] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1855.115125][ T60] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1855.119246][ T60] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1855.123346][ T60] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1855.128574][ T60] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1855.132284][ T60] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1855.155717][T26097] EXT4-fs error: 59 callbacks suppressed [ 1855.155734][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1855.163101][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1855.167008][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1855.357249][ T60] usb 12-1: usb_control_msg returned -32 [ 1855.359811][ T60] usbtmc 12-1:16.0: can't read capabilities [ 1855.368970][ T60] usb 12-1: USB disconnect, device number 2 [ 1855.417029][ T64] Bluetooth: hci0: command tx timeout [ 1855.502327][ T64] Bluetooth: hci2: command tx timeout [ 1855.957468][ T820] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8411'. [ 1856.028537][ T822] binder_alloc: 821: binder_alloc_buf, no vma [ 1856.702686][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1856.706931][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1856.711694][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1857.062450][T23494] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1857.222729][T23494] usb 5-1: Using ep0 maxpacket: 8 [ 1857.226359][T23494] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 1857.229830][T23494] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1857.233917][T23494] usb 5-1: config 0 has no interface number 0 [ 1857.237922][T23494] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1857.240959][T23494] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1857.244118][T23494] usb 5-1: Product: syz [ 1857.245813][T23494] usb 5-1: Manufacturer: syz [ 1857.247705][T23494] usb 5-1: SerialNumber: syz [ 1857.251049][T23494] usb 5-1: config 0 descriptor?? [ 1857.256700][T23494] uvcvideo 5-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 1857.259215][T23494] uvcvideo 5-1:0.31: No valid video chain found. [ 1857.266739][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1857.271087][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1857.275478][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1857.383276][T11685] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 1857.472114][ T6222] usb 5-1: USB disconnect, device number 98 [ 1857.543681][T11685] usb 12-1: Using ep0 maxpacket: 8 [ 1857.547898][T11685] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1857.552106][T11685] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1857.556197][T11685] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1857.560430][T11685] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1857.565803][T11685] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1857.569957][T11685] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1857.592123][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1857.640112][ T5761] Bluetooth: hci0: command tx timeout [ 1857.726871][ T5761] Bluetooth: hci2: command 0x0406 tx timeout [ 1857.736626][ T5862] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1857.796430][T11685] usb 12-1: usb_control_msg returned -32 [ 1857.798876][T11685] usbtmc 12-1:16.0: can't read capabilities [ 1857.820828][T11685] usb 12-1: USB disconnect, device number 3 [ 1858.607909][ T863] No control pipe specified [ 1858.890209][T11685] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 1859.071755][T11685] usb 12-1: Using ep0 maxpacket: 8 [ 1859.076181][T11685] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1859.080618][T11685] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1859.084905][T11685] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1859.089237][T11685] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1859.095383][T11685] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1859.099252][T11685] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1859.157234][T26383] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1859.323142][T26383] usb 5-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 1859.323598][T11685] usb 12-1: usb_control_msg returned -32 [ 1859.327106][T26383] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 1859.329391][T11685] usbtmc 12-1:16.0: can't read capabilities [ 1859.332542][T26383] usb 5-1: Product: syz [ 1859.336108][T26383] usb 5-1: Manufacturer: syz [ 1859.338037][T26383] usb 5-1: SerialNumber: syz [ 1859.339506][T11685] usb 12-1: USB disconnect, device number 4 [ 1859.342632][T26383] usb 5-1: config 0 descriptor?? [ 1859.349336][T26383] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 1859.352837][T26383] dvb-usb: bulk message failed: -22 (2/0) [ 1859.366848][T26383] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1859.371257][T26383] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 1859.374404][T26383] usb 5-1: media controller created [ 1859.386438][T26383] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1859.563642][ T871] dvb-usb: bulk message failed: -22 (4/0) [ 1859.570419][ T871] cxusb: i2c read failed [ 1859.573701][T26383] cxusb: set interface failed [ 1859.578967][T26383] dvb-usb: bulk message failed: -22 (1/0) [ 1859.583681][T26383] DVB: Unable to find symbol mt352_attach() [ 1859.586422][T26383] dvb-usb: bulk message failed: -22 (5/0) [ 1859.596480][T26383] zl10353_read_register: readreg error (reg=127, ret==-121) [ 1859.599685][T26383] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 1859.608213][T26383] rc_core: Couldn't load IR keymap rc-dvico-mce [ 1859.610928][T26383] Registered IR keymap rc-empty [ 1859.614451][T26383] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0 [ 1859.622506][T26383] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb5/5-1/rc/rc0/input43 [ 1859.630657][T26383] dvb-usb: schedule remote query interval to 100 msecs. [ 1859.633786][T26383] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 1859.640354][T26383] usb 5-1: USB disconnect, device number 99 [ 1859.704196][T26383] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 1860.744736][ T895] netlink: 4 bytes leftover after parsing attributes in process `syz.7.8441'. [ 1860.748496][ T896] EXT4-fs error: 16 callbacks suppressed [ 1860.748555][ T896] EXT4-fs error (device sda1): ext4_lookup:1785: inode #274: comm syz.0.8439: iget: checksum invalid [ 1860.760714][ T896] faux_driver regulatory: loading /lib/firmware/updates/syzkaller/regulatory.db failed with error -74 [ 1860.767066][ T896] EXT4-fs error (device sda1): ext4_lookup:1785: inode #274: comm syz.0.8439: iget: checksum invalid [ 1860.772749][ T896] faux_driver regulatory: loading /lib/firmware/updates/regulatory.db failed with error -74 [ 1860.803002][ T896] EXT4-fs error (device sda1): ext4_lookup:1785: inode #274: comm syz.0.8439: iget: checksum invalid [ 1860.809155][ T896] faux_driver regulatory: loading /lib/firmware/syzkaller/regulatory.db failed with error -74 [ 1860.814317][ T896] EXT4-fs error (device sda1): ext4_lookup:1785: inode #274: comm syz.0.8439: iget: checksum invalid [ 1860.824580][ T896] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -74 [ 1860.828994][ T896] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -74 [ 1860.833348][ T896] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1861.226543][ T911] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8448'. [ 1862.003661][ T924] EXT4-fs error (device sda1): ext4_lookup:1785: inode #13: comm dhcpcd: iget: checksum invalid [ 1862.268272][ T931] EXT4-fs error (device sda1): ext4_lookup:1785: inode #13: comm dhcpcd: iget: checksum invalid [ 1862.350151][ T5761] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 1863.203112][T26383] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1863.206569][T26383] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1863.374895][ T937] EXT4-fs error (device sda1): ext4_lookup:1785: inode #13: comm dhcpcd: iget: checksum invalid [ 1863.422647][ T938] EXT4-fs error (device sda1): ext4_lookup:1785: inode #13: comm dhcpcd: iget: checksum invalid [ 1863.506312][ T34] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1863.688009][ T34] usb 5-1: Using ep0 maxpacket: 16 [ 1863.695129][ T34] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1863.705741][ T34] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1863.720984][ T34] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1863.731100][ T34] usb 5-1: Product: syz [ 1863.732479][ T34] usb 5-1: Manufacturer: syz [ 1863.738851][ T34] usb 5-1: SerialNumber: syz [ 1863.749154][ T34] usb 5-1: config 0 descriptor?? [ 1863.749207][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1863.754534][ T34] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1863.755558][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1863.764053][ T34] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 1863.839314][ T5761] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1863.843557][ T5761] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1863.847110][ T5761] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1863.878358][ T5761] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1863.903428][ T5761] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1864.016094][ T940] lo speed is unknown, defaulting to 1000 [ 1864.278619][T11699] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1864.419076][ T34] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 1864.420573][T11699] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1864.579173][T11699] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1864.607262][ T940] bridge0: port 1(bridge_slave_0) entered blocking state [ 1864.610107][ T940] bridge0: port 1(bridge_slave_0) entered disabled state [ 1864.613199][ T940] bridge_slave_0: entered allmulticast mode [ 1864.616914][ T940] bridge_slave_0: entered promiscuous mode [ 1864.622244][ T940] bridge0: port 2(bridge_slave_1) entered blocking state [ 1864.624993][ T940] bridge0: port 2(bridge_slave_1) entered disabled state [ 1864.627860][ T940] bridge_slave_1: entered allmulticast mode [ 1864.636778][ T940] bridge_slave_1: entered promiscuous mode [ 1864.665419][ T940] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1864.671777][ T940] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1864.735580][T11699] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1864.755028][ T940] team0: Port device team_slave_0 added [ 1864.763088][ T940] team0: Port device team_slave_1 added [ 1864.798960][ T940] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1864.801263][ T940] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1864.809272][ T940] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1864.814821][ T940] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1864.817006][ T940] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1864.826196][ T940] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1864.855887][ T34] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1864.859003][ T34] em28xx 5-1:0.0: board has no eeprom [ 1864.883255][ T940] hsr_slave_0: entered promiscuous mode [ 1864.886560][ T940] hsr_slave_1: entered promiscuous mode [ 1864.889354][ T940] debugfs: 'hsr0' already exists in 'hsr' [ 1864.891180][ T940] Cannot create hsr debugfs directory [ 1864.941666][ T936] em28xx 5-1:0.0: write to i2c device at 0xe failed with unknown error (status=1) [ 1864.945919][ T64] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 1864.949648][ T64] CPU: 0 UID: 0 PID: 64 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1864.949673][ T64] Tainted: [L]=SOFTLOCKUP [ 1864.949678][ T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1864.949687][ T64] Workqueue: hci0 hci_rx_work [ 1864.949710][ T64] Call Trace: [ 1864.949714][ T64] [ 1864.949720][ T64] dump_stack_lvl+0x100/0x190 [ 1864.949736][ T64] sysfs_warn_dup.cold+0x1c/0x28 [ 1864.949753][ T64] sysfs_create_dir_ns+0x24b/0x2b0 [ 1864.949770][ T64] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1864.949784][ T64] ? find_held_lock+0x2b/0x80 [ 1864.949798][ T64] ? kobject_add_internal+0x25f/0x930 [ 1864.949812][ T64] ? kobject_add_internal+0x25f/0x930 [ 1864.949827][ T64] ? do_raw_spin_unlock+0x145/0x1e0 [ 1864.949838][ T64] kobject_add_internal+0x2c8/0x930 [ 1864.949854][ T64] kobject_add+0x16a/0x1e0 [ 1864.949867][ T64] ? __pfx_kobject_add+0x10/0x10 [ 1864.949879][ T64] ? class_to_subsys+0x10f/0x150 [ 1864.949898][ T64] ? kobject_put+0xb9/0x640 [ 1864.949909][ T64] ? _raw_spin_unlock+0x28/0x50 [ 1864.949927][ T64] device_add+0x294/0x1970 [ 1864.949943][ T64] ? __pfx_dev_set_name+0x10/0x10 [ 1864.949985][ T64] ? __pfx_device_add+0x10/0x10 [ 1864.950007][ T64] ? mgmt_send_event_skb+0x2fb/0x460 [ 1864.950030][ T64] hci_conn_add_sysfs+0x1a3/0x260 [ 1864.950044][ T64] le_conn_complete_evt+0x11eb/0x1f60 [ 1864.950067][ T64] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1864.950083][ T64] ? hci_event_packet+0x186/0xcd0 [ 1864.950102][ T64] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1864.950119][ T64] ? skb_pull_data+0x15f/0x1e0 [ 1864.950137][ T64] hci_le_meta_evt+0x34a/0x5f0 [ 1864.950156][ T64] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1864.950176][ T64] hci_event_packet+0x51c/0xcd0 [ 1864.950192][ T64] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1864.950210][ T64] ? __pfx_hci_event_packet+0x10/0x10 [ 1864.950227][ T64] ? kcov_remote_start+0x384/0x670 [ 1864.950243][ T64] ? lockdep_hardirqs_on+0x78/0x100 [ 1864.950263][ T64] hci_rx_work+0x451/0xfc0 [ 1864.950281][ T64] process_one_work+0xa23/0x1940 [ 1864.950302][ T64] ? __pfx_process_one_work+0x10/0x10 [ 1864.950321][ T64] ? __pfx_hci_rx_work+0x10/0x10 [ 1864.950338][ T64] worker_thread+0x5ef/0xe50 [ 1864.950358][ T64] ? kthread+0x13a/0x450 [ 1864.950370][ T64] ? __pfx_worker_thread+0x10/0x10 [ 1864.950384][ T64] kthread+0x370/0x450 [ 1864.950396][ T64] ? __pfx_kthread+0x10/0x10 [ 1864.950411][ T64] ret_from_fork+0x72b/0xd50 [ 1864.950424][ T64] ? __pfx_ret_from_fork+0x10/0x10 [ 1864.950437][ T64] ? __switch_to+0x800/0x10f0 [ 1864.950453][ T64] ? __pfx_kthread+0x10/0x10 [ 1864.950467][ T64] ret_from_fork_asm+0x1a/0x30 [ 1864.950489][ T64] [ 1864.950505][ T64] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1865.056153][ T64] Bluetooth: hci0: failed to register connection device [ 1865.060277][T11699] bridge_slave_1: left allmulticast mode [ 1865.062147][T11699] bridge_slave_1: left promiscuous mode [ 1865.064254][T11699] bridge0: port 2(bridge_slave_1) entered disabled state [ 1865.070706][T11699] bridge_slave_0: left allmulticast mode [ 1865.072611][T11699] bridge_slave_0: left promiscuous mode [ 1865.075466][T11699] bridge0: port 1(bridge_slave_0) entered disabled state [ 1865.271326][T11699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1865.277119][T11699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1865.283581][T11699] bond0 (unregistering): Released all slaves [ 1865.349783][ T5456] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1865.410684][ T34] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1865.413274][ T34] em28xx 5-1:0.0: dvb set to bulk mode. [ 1865.432040][T26357] em28xx 5-1:0.0: Binding DVB extension [ 1865.458396][ T34] usb 5-1: USB disconnect, device number 100 [ 1865.479814][ T34] em28xx 5-1:0.0: Disconnecting em28xx [ 1865.508742][T11699] IPVS: stopping backup sync thread 31026 ... [ 1865.535738][T26357] em28xx 5-1:0.0: Registering input extension [ 1865.538672][ T34] em28xx 5-1:0.0: Closing input extension [ 1865.555176][ T34] em28xx 5-1:0.0: Freeing device [ 1865.557625][ T5456] 8021q: adding VLAN 0 to HW filter on device eth15 [ 1865.610181][ T940] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1865.614667][ T940] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1865.617647][ T940] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1865.621803][ T940] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1865.626876][ T940] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1865.633912][ T940] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1865.637530][ T5456] 8021q: adding VLAN 0 to HW filter on device eth16 [ 1865.640989][ T940] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1865.648078][ T940] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1865.717118][ T5456] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1865.731035][ T940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1865.747343][ T940] 8021q: adding VLAN 0 to HW filter on device team0 [ 1865.781212][T15160] bridge0: port 1(bridge_slave_0) entered blocking state [ 1865.784055][T15160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1865.788925][T15160] bridge0: port 2(bridge_slave_1) entered blocking state [ 1865.791675][T15160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1865.815509][ T1010] No control pipe specified [ 1865.920040][ T940] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1865.999015][ T940] veth0_vlan: entered promiscuous mode [ 1866.007263][ T940] veth1_vlan: entered promiscuous mode [ 1866.013401][T11699] hsr_slave_0: left promiscuous mode [ 1866.015576][T11699] hsr_slave_1: left promiscuous mode [ 1866.020000][T11699] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1866.022331][T11699] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1866.025309][T11699] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1866.027718][T11699] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1866.040770][T11699] veth1_macvtap: left promiscuous mode [ 1866.043198][T11699] veth0_macvtap: left promiscuous mode [ 1866.045680][T11699] veth1_vlan: left promiscuous mode [ 1866.047918][T11699] veth0_vlan: left promiscuous mode [ 1866.199103][ T64] Bluetooth: hci1: command tx timeout [ 1866.244308][ T5862] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1866.328120][T11699] team0 (unregistering): Port device team_slave_1 removed [ 1866.336925][T11699] team0 (unregistering): Port device team_slave_0 removed [ 1866.434653][ T5862] usb 5-1: Using ep0 maxpacket: 8 [ 1866.443135][ T5862] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1866.446682][ T5862] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1866.463446][ T5862] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1866.465967][ T5862] pvrusb2: ********** [ 1866.467910][ T5862] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1866.469870][T26097] EXT4-fs error: 62 callbacks suppressed [ 1866.469883][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.471628][ T940] veth0_macvtap: entered promiscuous mode [ 1866.471709][ T5862] pvrusb2: Important functionality might not be entirely working. [ 1866.474664][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.475554][ T940] veth1_macvtap: entered promiscuous mode [ 1866.478410][ T5862] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1866.481714][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.484049][ T5862] pvrusb2: ********** [ 1866.493662][ T940] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1866.514340][ T1040] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8473'. [ 1866.515558][ T940] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1866.531670][ T5796] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1866.548058][ T5796] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1866.551029][ T5796] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1866.554826][ T5796] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1866.556606][ T5456] EXT4-fs error (device sda1): ext4_lookup:1785: inode #2001: comm dhcpcd: iget: checksum invalid [ 1866.702100][ T2515] pvrusb2: Invalid write control endpoint [ 1866.713648][T21442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1866.726718][T21442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1866.774921][T21442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1866.780877][T21442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1866.783727][ T1045] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1866.802152][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.824208][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.828104][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1866.833909][ T2515] pvrusb2: Invalid write control endpoint [ 1866.836200][ T2515] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1866.839526][ T2515] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1866.842913][ T2515] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1866.846340][ T2515] pvrusb2: Device being rendered inoperable [ 1866.848496][ T2515] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1866.851351][ T2515] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1866.865310][ T2515] pvrusb2: Attached sub-driver cx25840 [ 1866.867182][ T2515] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1866.870633][ T2515] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1866.914194][ T1029] pvrusb2: Attempted to execute control transfer when device not ok [ 1866.926183][T26383] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 1866.931735][T26357] usb 5-1: USB disconnect, device number 101 [ 1866.968465][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1866.972436][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1867.031581][T11699] IPVS: stop unused estimator thread 0... [ 1867.082345][ T64] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 1867.087012][ T64] CPU: 0 UID: 0 PID: 64 Comm: kworker/u34:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1867.087046][ T64] Tainted: [L]=SOFTLOCKUP [ 1867.087054][ T64] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1867.087069][ T64] Workqueue: hci1 hci_rx_work [ 1867.087101][ T64] Call Trace: [ 1867.087108][ T64] [ 1867.087117][ T64] dump_stack_lvl+0x100/0x190 [ 1867.087143][ T64] sysfs_warn_dup.cold+0x1c/0x28 [ 1867.087172][ T64] sysfs_create_dir_ns+0x24b/0x2b0 [ 1867.087199][ T64] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1867.087224][ T64] ? find_held_lock+0x2b/0x80 [ 1867.087247][ T64] ? kobject_add_internal+0x25f/0x930 [ 1867.087270][ T64] ? kobject_add_internal+0x25f/0x930 [ 1867.087295][ T64] ? do_raw_spin_unlock+0x145/0x1e0 [ 1867.087317][ T64] kobject_add_internal+0x2c8/0x930 [ 1867.087345][ T64] kobject_add+0x16a/0x1e0 [ 1867.087369][ T64] ? __pfx_kobject_add+0x10/0x10 [ 1867.087390][ T64] ? class_to_subsys+0x10f/0x150 [ 1867.087422][ T64] ? kobject_put+0xb9/0x640 [ 1867.087439][ T64] ? _raw_spin_unlock+0x28/0x50 [ 1867.087467][ T64] device_add+0x294/0x1970 [ 1867.087493][ T64] ? __pfx_dev_set_name+0x10/0x10 [ 1867.087520][ T64] ? __pfx_device_add+0x10/0x10 [ 1867.087545][ T64] ? mgmt_send_event_skb+0x2fb/0x460 [ 1867.087580][ T64] hci_conn_add_sysfs+0x1a3/0x260 [ 1867.087609][ T64] le_conn_complete_evt+0x11eb/0x1f60 [ 1867.087646][ T64] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1867.087673][ T64] ? hci_event_packet+0x186/0xcd0 [ 1867.087706][ T64] hci_le_conn_complete_evt+0x23c/0x3a0 [ 1867.087736][ T64] ? skb_pull_data+0x15f/0x1e0 [ 1867.087765][ T64] hci_le_meta_evt+0x34a/0x5f0 [ 1867.087795][ T64] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 1867.087826][ T64] hci_event_packet+0x51c/0xcd0 [ 1867.087854][ T64] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1867.087886][ T64] ? __pfx_hci_event_packet+0x10/0x10 [ 1867.087917][ T64] ? kcov_remote_start+0x384/0x670 [ 1867.087942][ T64] ? lockdep_hardirqs_on+0x78/0x100 [ 1867.087979][ T64] hci_rx_work+0x451/0xfc0 [ 1867.088015][ T64] process_one_work+0xa23/0x1940 [ 1867.088053][ T64] ? __pfx_process_one_work+0x10/0x10 [ 1867.088088][ T64] ? __pfx_hci_rx_work+0x10/0x10 [ 1867.088118][ T64] worker_thread+0x5ef/0xe50 [ 1867.088154][ T64] ? kthread+0x13a/0x450 [ 1867.088177][ T64] ? __pfx_worker_thread+0x10/0x10 [ 1867.088200][ T64] kthread+0x370/0x450 [ 1867.088246][ T64] ? __pfx_kthread+0x10/0x10 [ 1867.088273][ T64] ret_from_fork+0x72b/0xd50 [ 1867.088295][ T64] ? __pfx_ret_from_fork+0x10/0x10 [ 1867.088317][ T64] ? __switch_to+0x800/0x10f0 [ 1867.088344][ T64] ? __pfx_kthread+0x10/0x10 [ 1867.088368][ T64] ret_from_fork_asm+0x1a/0x30 [ 1867.088408][ T64] [ 1867.092008][ T64] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1867.096676][T26383] usb 12-1: Using ep0 maxpacket: 16 [ 1867.098005][ T64] Bluetooth: hci1: failed to register connection device [ 1867.104621][T26383] usb 12-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1867.195871][T26383] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1867.198418][T26383] usb 12-1: Product: syz [ 1867.199719][T26383] usb 12-1: Manufacturer: syz [ 1867.201340][T26383] usb 12-1: SerialNumber: syz [ 1867.204548][T26383] usb 12-1: config 0 descriptor?? [ 1867.564621][ T1054] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8476'. [ 1867.646004][T26383] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1867.653773][T26383] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1867.658555][T26383] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1867.662064][T26383] usb 12-1: media controller created [ 1867.677103][T26383] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1867.723520][ T5761] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1867.737275][ T5761] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1867.741576][ T5761] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1867.745520][ T5761] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1867.751429][ T5761] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1867.850937][ T1058] lo speed is unknown, defaulting to 1000 [ 1867.862660][T26383] zl10353_read_register: readreg error (reg=127, ret==0) [ 1867.868173][T26383] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1867.876725][T26383] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1868.072021][ T1076] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8481'. [ 1868.228790][ T5796] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.401241][ T5796] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.411187][ T64] Bluetooth: hci1: command tx timeout [ 1868.446069][ T1058] bridge0: port 1(bridge_slave_0) entered blocking state [ 1868.448707][ T1058] bridge0: port 1(bridge_slave_0) entered disabled state [ 1868.451595][ T1058] bridge_slave_0: entered allmulticast mode [ 1868.454675][ T1058] bridge_slave_0: entered promiscuous mode [ 1868.458458][ T1058] bridge0: port 2(bridge_slave_1) entered blocking state [ 1868.461268][ T1058] bridge0: port 2(bridge_slave_1) entered disabled state [ 1868.463901][ T1058] bridge_slave_1: entered allmulticast mode [ 1868.472684][ T1058] bridge_slave_1: entered promiscuous mode [ 1868.494104][ T50] usb 12-1: USB disconnect, device number 5 [ 1868.496032][ T1058] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1868.539611][ T50] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1868.567878][ T5796] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.581576][ T1058] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1868.582157][T28875] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1868.602273][ T1058] team0: Port device team_slave_0 added [ 1868.611022][ T1058] team0: Port device team_slave_1 added [ 1868.626272][ T1058] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1868.628848][ T1058] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1868.640488][ T1058] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1868.645367][ T1058] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1868.647948][ T1058] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1868.656350][ T1058] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1868.701820][ T5796] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.742416][T28875] usb 5-1: Using ep0 maxpacket: 8 [ 1868.744256][ T1058] hsr_slave_0: entered promiscuous mode [ 1868.745495][T28875] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1868.746815][ T1058] hsr_slave_1: entered promiscuous mode [ 1868.749295][T28875] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1868.751995][ T1058] debugfs: 'hsr0' already exists in 'hsr' [ 1868.756499][ T1058] Cannot create hsr debugfs directory [ 1868.759888][T28875] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1868.763145][T28875] pvrusb2: ********** [ 1868.765019][T28875] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1868.769081][T28875] pvrusb2: Important functionality might not be entirely working. [ 1868.772219][T28875] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1868.777028][T28875] pvrusb2: ********** [ 1868.948292][ T5796] bridge_slave_1: left allmulticast mode [ 1868.950863][ T5796] bridge_slave_1: left promiscuous mode [ 1868.953717][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 1868.965439][ T5796] bridge_slave_0: left allmulticast mode [ 1868.968934][ T5796] bridge_slave_0: left promiscuous mode [ 1868.975379][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 1868.983021][ T2515] pvrusb2: Invalid write control endpoint [ 1868.986159][ T5796] dummy0: left allmulticast mode [ 1868.993106][ T5796] dummy0: left promiscuous mode [ 1868.996696][ T5796] bridge1: port 1(dummy0) entered disabled state [ 1868.998566][ T2515] pvrusb2: Invalid write control endpoint [ 1869.003653][ T2515] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1869.008253][ T2515] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1869.011633][ T2515] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1869.015727][ T2515] pvrusb2: Device being rendered inoperable [ 1869.023076][ T2515] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1869.028029][ T2515] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1869.044189][ T2515] pvrusb2: Attached sub-driver cx25840 [ 1869.047264][ T2515] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1869.051787][ T2515] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1869.120953][ T1101] netlink: 48 bytes leftover after parsing attributes in process `syz.8.8487'. [ 1869.179490][ T64] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 1869.198386][ T1090] pvrusb2: Attempted to execute control transfer when device not ok [ 1869.202557][ T1069] usb 5-1: USB disconnect, device number 102 [ 1869.239280][ T5796] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1869.245414][ T5796] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1869.250727][ T5796] bond0 (unregistering): Released all slaves [ 1869.261123][ T5796] bond1 (unregistering): Released all slaves [ 1869.372006][ T5456] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1869.444877][ T5796] tipc: Left network mode [ 1869.557015][ T1058] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1869.563611][ T1058] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1869.569382][ T5456] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1869.574732][ T1058] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1869.588961][ T1058] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1869.590603][ T1119] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8490'. [ 1869.593838][ T1058] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1869.602404][ T1058] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1869.631284][ T1058] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1869.643744][ T1058] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1869.701356][ T5456] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1869.763137][ T5456] 8021q: adding VLAN 0 to HW filter on device eth21 [ 1869.818423][ T1058] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1869.853486][ T1058] 8021q: adding VLAN 0 to HW filter on device team0 [ 1869.896422][T21442] bridge0: port 1(bridge_slave_0) entered blocking state [ 1869.899129][T21442] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1869.908401][ T1148] netlink: 96 bytes leftover after parsing attributes in process `syz.8.8494'. [ 1869.923713][ T5796] hsr_slave_0: left promiscuous mode [ 1869.926447][ T5796] hsr_slave_1: left promiscuous mode [ 1869.928684][ T5796] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1869.931370][ T5796] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1869.936509][ T5796] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1869.941310][ T5796] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1869.955528][ T1152] netlink: 48 bytes leftover after parsing attributes in process `syz.8.8495'. [ 1869.957958][ T5796] veth1_macvtap: left promiscuous mode [ 1869.960745][ T5761] Bluetooth: hci4: command tx timeout [ 1869.961135][ T5796] veth0_macvtap: left promiscuous mode [ 1870.172700][ T5796] team0 (unregistering): Port device team_slave_1 removed [ 1870.184758][ T5796] team0 (unregistering): Port device team_slave_0 removed [ 1870.260337][T21442] bridge0: port 2(bridge_slave_1) entered blocking state [ 1870.262674][T21442] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1870.427481][ T1058] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1870.471565][ T1058] veth0_vlan: entered promiscuous mode [ 1870.482812][ T1058] veth1_vlan: entered promiscuous mode [ 1870.504390][ T1058] veth0_macvtap: entered promiscuous mode [ 1870.510655][ T1058] veth1_macvtap: entered promiscuous mode [ 1870.522651][ T1058] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1870.532002][ T1058] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1870.545936][ T12] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1870.549519][ T12] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1870.553001][ T12] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1870.556315][ T12] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1870.612491][T26357] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1870.635344][ T5761] Bluetooth: hci1: command tx timeout [ 1870.638033][T15160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1870.668480][T15160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1870.721141][T20922] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1870.726758][T20922] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1870.794045][T26357] usb 5-1: Using ep0 maxpacket: 8 [ 1870.798394][T26357] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1870.802796][T26357] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1870.829101][T26357] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1870.834159][T26357] pvrusb2: ********** [ 1870.835456][T26357] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1870.845020][T26357] pvrusb2: Important functionality might not be entirely working. [ 1870.851882][T26357] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1870.857389][T26357] pvrusb2: ********** [ 1870.926945][ T1207] autofs: Bad value for 'fd' [ 1871.041903][ T2515] pvrusb2: Invalid write control endpoint [ 1871.061050][ T1210] netlink: 48 bytes leftover after parsing attributes in process `syz.9.8509'. [ 1871.083057][ T2515] pvrusb2: Invalid write control endpoint [ 1871.085911][ T2515] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1871.089589][ T2515] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1871.092420][ T2515] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1871.097699][ T2515] pvrusb2: Device being rendered inoperable [ 1871.100313][ T2515] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1871.103245][ T2515] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1871.108710][ T2515] pvrusb2: Attached sub-driver cx25840 [ 1871.110921][ T2515] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1871.114384][ T2515] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1871.259087][T26357] usb 5-1: USB disconnect, device number 103 [ 1871.346888][ T1221] netlink: 108 bytes leftover after parsing attributes in process `syz.8.8512'. [ 1871.390646][ T1223] syzkaller0: entered promiscuous mode [ 1871.392574][ T1223] syzkaller0: entered allmulticast mode [ 1871.496310][ T1229] autofs: Bad value for 'fd' [ 1871.712684][ T1237] netlink: 48 bytes leftover after parsing attributes in process `syz.8.8518'. [ 1871.713025][ T10] usb 14-1: new high-speed USB device number 2 using dummy_hcd [ 1871.777622][ T1241] Bluetooth: MGMT ver 1.23 [ 1871.886138][ T10] usb 14-1: Using ep0 maxpacket: 32 [ 1871.889581][ T10] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 128, changing to 11 [ 1871.900760][ T10] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 76, changing to 10 [ 1871.913737][ T10] usb 14-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1871.920884][ T10] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1871.925990][ T10] usb 14-1: Product: syz [ 1871.930360][ T10] usb 14-1: Manufacturer: syz [ 1871.931988][ T10] usb 14-1: SerialNumber: syz [ 1871.934458][ T5456] EXT4-fs error: 79 callbacks suppressed [ 1871.934467][ T5456] EXT4-fs error (device sda1): ext4_lookup:1785: inode #2001: comm dhcpcd: iget: checksum invalid [ 1871.940617][ T10] usb 14-1: config 0 descriptor?? [ 1871.950343][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.9/usb14/14-1/14-1:0.0/input/input45 [ 1872.016563][ T1255] autofs: Unknown parameter '0x0000000000000000' [ 1872.095047][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.101345][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.106018][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.133658][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.137966][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.145190][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1872.171322][T23494] usb 14-1: USB disconnect, device number 2 [ 1872.173688][ C0] xpad 14-1:0.0: xpad_irq_out - usb_submit_urb failed with result -19 [ 1872.177231][ T5761] Bluetooth: hci4: command tx timeout [ 1872.343819][ T1257] Bluetooth: hci0: command 0x0406 tx timeout [ 1872.764191][ T1273] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1872.777225][ T1274] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1872.856612][ T64] Bluetooth: hci1: command tx timeout [ 1872.870357][ T1278] netlink: 12 bytes leftover after parsing attributes in process `syz.9.8536'. [ 1872.951464][ T10] usb 13-1: new high-speed USB device number 2 using dummy_hcd [ 1873.021398][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1873.134306][ T10] usb 13-1: Using ep0 maxpacket: 8 [ 1873.138795][ T10] usb 13-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1873.142392][ T10] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1873.154749][ T10] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1873.157140][ T10] pvrusb2: ********** [ 1873.158344][ T10] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1873.161361][ T10] pvrusb2: Important functionality might not be entirely working. [ 1873.163686][ T10] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1873.167335][ T10] pvrusb2: ********** [ 1873.371213][ T2515] pvrusb2: Invalid write control endpoint [ 1873.394790][ T2515] pvrusb2: Invalid write control endpoint [ 1873.408771][ T2515] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1873.412431][ T2515] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1873.414805][ T2515] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1873.417989][ T2515] pvrusb2: Device being rendered inoperable [ 1873.419902][ T2515] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1873.422273][ T2515] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1873.429063][ T2515] pvrusb2: Attached sub-driver cx25840 [ 1873.431279][ T2515] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1873.436089][ T2515] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1873.456364][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1873.586017][ T10] usb 13-1: USB disconnect, device number 2 [ 1874.082148][ T1303] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1874.117086][ T1313] autofs: Unknown parameter '0x0000000000000000' [ 1874.184940][ T1315] netlink: 40 bytes leftover after parsing attributes in process `syz.8.8551'. [ 1874.413613][ T64] Bluetooth: hci4: command tx timeout [ 1874.472824][ T1337] autofs: Unknown parameter '0x0000000000000000' [ 1874.494952][ T64] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 1874.731449][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88806685cc00: rx timeout, send abort [ 1874.735243][ C3] vxcan1: j1939_xtp_rx_abort_one: 0xffff88806685cc00: 0x0f001: (3) A timeout occurred and this is the connection abort to close the session. Jul 6 11:11:12 syzkaller kern.alert kernel: [ 1874.731449][ C3] vxcan1: j1939_tp_rxtimer: 0xffff88806685cc00: rx timeout, send abort [ 1875.090157][ T5761] Bluetooth: hci1: command 0x0406 tx timeout [ 1875.310300][ T1351] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1875.451326][ T1358] netlink: 48 bytes leftover after parsing attributes in process `syz.9.8569'. [ 1875.462541][ T1360] autofs: Unknown parameter 'fd0x0000000000000000' [ 1875.520025][ T1367] netlink: 'syz.9.8572': attribute type 10 has an invalid length. [ 1875.541971][ T1367] team0: Port device dummy0 added [ 1875.903892][ T1392] autofs: Unknown parameter 'fd0x0000000000000000' [ 1876.340374][ T1412] netlink: 40 bytes leftover after parsing attributes in process `syz.9.8588'. [ 1876.618205][ T5761] Bluetooth: hci4: command 0x0419 tx timeout [ 1877.173330][ T1460] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8608'. [ 1877.259097][ T10] usb 12-1: new high-speed USB device number 6 using dummy_hcd [ 1877.339363][ T1469] EXT4-fs error: 19 callbacks suppressed [ 1877.339380][ T1469] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.349629][ T1470] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.358381][ T1471] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.365373][ T1472] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.372136][ T1473] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.378602][ T1474] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1877.419368][ T10] usb 12-1: Using ep0 maxpacket: 8 [ 1877.423094][ T10] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1877.426588][ T10] usb 12-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1877.429370][ T10] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1877.435927][ T10] usb 12-1: config 0 descriptor?? [ 1877.445409][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1877.449141][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1877.452903][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1877.663164][ T10] iowarrior 12-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1877.857066][ T1483] EXT4-fs error (device sda1): ext4_lookup:1785: inode #13: comm dhcpcd: iget: checksum invalid [ 1877.876609][ T10] usb 12-1: USB disconnect, device number 6 [ 1878.648292][ T60] usb 14-1: new high-speed USB device number 3 using dummy_hcd [ 1878.820673][ T60] usb 14-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1878.824501][ T60] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1878.827995][ T60] usb 14-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1878.831251][ T60] usb 14-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1878.835276][ T60] usb 14-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1878.838054][ T60] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1878.840792][ T5761] Bluetooth: hci4: command 0x0419 tx timeout [ 1878.844804][ T60] usb 14-1: config 0 descriptor?? [ 1879.007405][ T1525] netlink: 40 bytes leftover after parsing attributes in process `syz.7.8632'. [ 1879.170255][ T1531] netlink: 12 bytes leftover after parsing attributes in process `syz.7.8635'. [ 1879.304027][ T60] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.9-1/input0 [ 1879.318509][ T1536] udevd[1536]: failed to execute '/lib/udev/fido_id' 'fido_id': Bad message [ 1879.634458][ T1549] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8644'. [ 1879.793073][ T1557] Bluetooth: hci0: unsupported parameter 255 [ 1879.795762][ T1557] Bluetooth: hci0: unsupported parameter 255 [ 1879.874678][ T1563] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8649'. [ 1879.888183][T28875] usb 12-1: new high-speed USB device number 7 using dummy_hcd [ 1880.070265][T28875] usb 12-1: Using ep0 maxpacket: 8 [ 1880.076423][T28875] usb 12-1: config 179 has an invalid interface number: 65 but max is 0 [ 1880.085554][T28875] usb 12-1: config 179 has no interface number 0 [ 1880.088180][T28875] usb 12-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1880.096212][T28875] usb 12-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1880.104614][T28875] usb 12-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1880.112389][T28875] usb 12-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1880.119492][T28875] usb 12-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1880.133620][T28875] usb 12-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1880.137117][T28875] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1880.140164][ T1577] Bluetooth: hci0: unsupported parameter 255 [ 1880.142958][ T1577] Bluetooth: hci0: unsupported parameter 255 [ 1880.144428][ T1551] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1880.152350][ T60] usb 14-1: USB disconnect, device number 3 [ 1880.398702][ T1584] netlink: 12 bytes leftover after parsing attributes in process `syz.8.8659'. [ 1880.410986][T28875] input: Generic X-Box pad as /devices/platform/dummy_hcd.7/usb12/12-1/12-1:179.65/input/input48 [ 1880.590271][T28875] usb 12-1: USB disconnect, device number 7 [ 1880.592567][ C1] xpad 12-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1880.592600][ C1] xpad 12-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1880.681942][ T1596] Bluetooth: hci0: unsupported parameter 255 [ 1880.683897][ T1596] Bluetooth: hci0: unsupported parameter 255 [ 1881.021218][ T1069] usb 13-1: new full-speed USB device number 3 using dummy_hcd [ 1881.108141][ T1612] No control pipe specified [ 1881.193377][ T1069] usb 13-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1881.197826][ T1069] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1881.202108][ T1069] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1881.208808][ T1069] usb 13-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1881.212695][ T1069] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1881.216281][ T1069] usb 13-1: Product: syz [ 1881.217967][ T1069] usb 13-1: Manufacturer: syz [ 1881.219916][ T1069] usb 13-1: SerialNumber: syz [ 1881.224056][ T1069] usb 13-1: config 0 descriptor?? [ 1881.227159][ T1599] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1881.237128][ T1069] rc_core: Couldn't load IR keymap rc-streamzap [ 1881.239668][ T1069] Registered IR keymap rc-empty [ 1881.242671][ T1069] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0 [ 1881.245388][ T1616] Bluetooth: hci0: invalid len left 7, exp >= 50 [ 1881.249322][ T1069] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/rc/rc0/input49 [ 1881.450563][ T60] usb 13-1: USB disconnect, device number 3 [ 1881.768700][ T10] usb 12-1: new high-speed USB device number 8 using dummy_hcd [ 1881.826448][ T1635] orangefs: client-core tried to read wrong size [ 1881.952560][ T10] usb 12-1: config 0 has no interfaces? [ 1881.958133][ T10] usb 12-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1881.963285][ T10] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1881.974254][ T10] usb 12-1: Product: syz [ 1881.976057][ T10] usb 12-1: Manufacturer: syz [ 1881.980504][ T10] usb 12-1: SerialNumber: syz [ 1881.992256][ T10] usb 12-1: config 0 descriptor?? [ 1882.215272][ T1606] usb 12-1: USB disconnect, device number 8 æ[_ °A#cGû "¡Å®¾ƒ¸2¡!×\Xjuü×þ›³dÅZb&xª_!Ù˜™Œ¹OןOΖ[ 1882.301083][ T1660] kAFS: unable to lookup cell 'syz1' [ 1882.666389][T26383] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1882.838122][T26383] usb 5-1: Using ep0 maxpacket: 16 [ 1882.844367][T26383] usb 5-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1882.848380][T26383] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1882.851728][T26383] usb 5-1: Product: syz [ 1882.853439][T26383] usb 5-1: Manufacturer: syz [ 1882.855380][T26383] usb 5-1: SerialNumber: syz [ 1882.862793][T26383] usb 5-1: config 0 descriptor?? [ 1883.302596][T26383] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1883.311865][T26383] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1883.327802][T26383] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1883.333058][T26383] usb 5-1: media controller created [ 1883.357201][T26383] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1883.362583][ T5154] EXT4-fs error: 30 callbacks suppressed [ 1883.362596][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1883.379316][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1883.384676][ T5154] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1222: comm udevd: iget: checksum invalid [ 1883.516725][T26383] zl10353_read_register: readreg error (reg=127, ret==0) [ 1883.519973][T26383] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1883.523714][T26383] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1883.542714][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1883.555991][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1883.561047][T26097] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1135: comm udevd: iget: checksum invalid [ 1883.716718][T11685] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1883.852413][ T10] usb 13-1: new high-speed USB device number 4 using dummy_hcd [ 1884.025323][ T10] usb 13-1: config 0 has no interfaces? [ 1884.031327][ T10] usb 13-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1884.035511][ T10] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1884.038886][ T10] usb 13-1: Product: syz [ 1884.040982][ T10] usb 13-1: Manufacturer: syz [ 1884.043065][ T10] usb 13-1: SerialNumber: syz [ 1884.048600][ T10] usb 13-1: config 0 descriptor?? [ 1884.267631][ T10] usb 13-1: USB disconnect, device number 4 [ 1884.733847][ T1725] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:1: iget: checksum invalid [ 1884.745450][ T1726] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:32: iget: checksum invalid [ 1885.058985][ T1746] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1885.068052][ T1749] EXT4-fs error (device sda1): ext4_lookup:1785: inode #1259: comm kworker/u33:25: iget: checksum invalid [ 1885.082581][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 1885.167180][ T1754] ------------[ cut here ]------------ [ 1885.173340][ T1754] usb 5-1: BOGUS control dir, pipe 80006880 doesn't match bRequestType c0 [ 1885.176834][ T1754] WARNING: drivers/usb/core/urb.c:411 at usb_submit_urb+0x15ff/0x19b0, CPU#3: syz.9.8727/1754 [ 1885.180991][ T1754] Modules linked in: [ 1885.184210][ T1754] CPU: 3 UID: 0 PID: 1754 Comm: syz.9.8727 Tainted: G L syzkaller #0 PREEMPT(full) [ 1885.189310][ T1754] Tainted: [L]=SOFTLOCKUP [ 1885.191069][ T1754] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1885.194848][ T1754] RIP: 0010:usb_submit_urb+0x160d/0x19b0 [ 1885.197179][ T1754] Code: 48 89 54 24 40 e8 63 d5 8b fa 4c 89 e7 e8 5b 10 dc fe 48 89 c6 48 8d 3d 31 75 b2 09 44 8b 44 24 20 8b 4c 24 30 48 8b 54 24 40 <67> 48 0f b9 3a e9 28 ed ff ff e8 34 d5 8b fa 89 ee bf ff 00 00 00 [ 1885.205118][ T1754] RSP: 0000:ffffc90020747740 EFLAGS: 00010283 [ 1885.207644][ T1754] RAX: ffffffff8ca5d6a0 RBX: ffff88806edde200 RCX: 0000000080006880 [ 1885.211350][ T1754] RDX: ffff88804c31e0e0 RSI: ffffffff8ca5d6a0 RDI: ffffffff912fcc40 [ 1885.214520][ T1754] RBP: ffff888026f1e058 R08: 00000000000000c0 R09: 0000000000000000 [ 1885.217586][ T1754] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888026f1e0b0 [ 1885.221068][ T1754] R13: ffff8880703b5360 R14: ffff8880703b5366 R15: ffff8880703b5367 [ 1885.224483][ T1754] FS: 0000000000000000(0000) GS:ffff888096ef5000(0063) knlGS:00000000f54a6b40 [ 1885.229441][ T1754] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 1885.229506][ T1754] CR2: 00000000f515875e CR3: 000000005fd3a000 CR4: 0000000000352ef0 [ 1885.229517][ T1754] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1885.229528][ T1754] DR3: 00000000000f010e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1885.229539][ T1754] Call Trace: [ 1885.229545][ T1754] [ 1885.229557][ T1754] ? __init_swait_queue_head+0xca/0x150 [ 1885.229590][ T1754] usb_start_wait_urb+0x10e/0x580 [ 1885.229618][ T1754] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1885.229642][ T1754] ? trace_kmalloc+0xeb/0x110 [ 1885.229694][ T1754] ? __asan_memset+0x23/0x50 [ 1885.229716][ T1754] usb_control_msg+0x328/0x4b0 [ 1885.229743][ T1754] ? __pfx_usb_control_msg+0x10/0x10 [ 1885.229772][ T1754] ? do_pwritev+0x1ac/0x270 [ 1885.229793][ T1754] ? __do_fast_syscall_32+0xe7/0x970 [ 1885.229808][ T1754] dtv5100_i2c_msg+0x1be/0x340 [ 1885.229856][ T1754] dtv5100_i2c_xfer+0x131/0x3d0 [ 1885.229871][ T1754] __i2c_transfer+0x5d9/0x1740 [ 1885.229911][ T1754] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1885.229930][ T1754] ? __pfx___i2c_transfer+0x10/0x10 [ 1885.229947][ T1754] ? rt_mutex_slowtrylock+0x93/0x100 [ 1885.229964][ T1754] i2c_transfer+0x15f/0x380 [ 1885.229981][ T1754] i2c_transfer_buffer_flags+0x10c/0x190 [ 1885.229999][ T1754] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 1885.230018][ T1754] ? _copy_from_user+0x59/0xd0 [ 1885.230038][ T1754] i2cdev_write+0x11e/0x240 [ 1885.230054][ T1754] ? __pfx_i2cdev_write+0x10/0x10 [ 1885.230068][ T1754] vfs_writev+0x5ed/0xdd0 [ 1885.230086][ T1754] ? __pfx_vfs_writev+0x10/0x10 [ 1885.230111][ T1754] ? __fget_files+0x21f/0x3d0 [ 1885.230132][ T1754] ? do_pwritev+0x1ac/0x270 [ 1885.230147][ T1754] do_pwritev+0x1ac/0x270 [ 1885.230164][ T1754] ? __pfx_do_pwritev+0x10/0x10 [ 1885.230185][ T1754] __do_fast_syscall_32+0xe7/0x970 [ 1885.230196][ T1754] ? lockdep_hardirqs_on+0x78/0x100 [ 1885.230215][ T1754] do_fast_syscall_32+0x32/0x70 [ 1885.230226][ T1754] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1885.230242][ T1754] RIP: 0023:0xf7fe6fec [ 1885.230258][ T1754] Code: Unable to access opcode bytes at 0xf7fe6fc2. [ 1885.230264][ T1754] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000014e [ 1885.230277][ T1754] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 1885.230285][ T1754] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1885.230292][ T1754] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1885.230299][ T1754] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1885.230307][ T1754] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1885.230324][ T1754] [ 1885.230332][ T1754] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1885.230343][ T1754] CPU: 3 UID: 0 PID: 1754 Comm: syz.9.8727 Tainted: G L syzkaller #0 PREEMPT(full) [ 1885.230359][ T1754] Tainted: [L]=SOFTLOCKUP [ 1885.230363][ T1754] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1885.230371][ T1754] Call Trace: [ 1885.230375][ T1754] [ 1885.230379][ T1754] dump_stack_lvl+0x100/0x190 [ 1885.230394][ T1754] vpanic+0x552/0x970 [ 1885.230406][ T1754] ? __pfx_vpanic+0x10/0x10 [ 1885.230422][ T1754] panic+0xd1/0xe0 [ 1885.230433][ T1754] ? __pfx_panic+0x10/0x10 [ 1885.230450][ T1754] check_panic_on_warn.cold+0x19/0x34 [ 1885.230463][ T1754] ? usb_submit_urb+0x15ff/0x19b0 [ 1885.230481][ T1754] __warn.cold+0x191/0x318 [ 1885.230496][ T1754] __report_bug+0x30f/0x440 [ 1885.230512][ T1754] ? usb_submit_urb+0x15ff/0x19b0 [ 1885.230543][ T1754] ? __pfx___report_bug+0x10/0x10 [ 1885.230559][ T1754] ? lockdep_hardirqs_on+0x78/0x100 [ 1885.230580][ T1754] ? kasan_save_stack+0x3f/0x50 [ 1885.230593][ T1754] ? kasan_save_stack+0x30/0x50 [ 1885.230608][ T1754] report_bug_entry+0xe1/0x290 [ 1885.230626][ T1754] ? usb_submit_urb+0x160d/0x19b0 [ 1885.230643][ T1754] handle_bug+0x1cd/0x2a0 [ 1885.230654][ T1754] exc_invalid_op+0x17/0x50 [ 1885.230666][ T1754] asm_exc_invalid_op+0x1a/0x20 [ 1885.230677][ T1754] RIP: 0010:usb_submit_urb+0x160d/0x19b0 [ 1885.230695][ T1754] Code: 48 89 54 24 40 e8 63 d5 8b fa 4c 89 e7 e8 5b 10 dc fe 48 89 c6 48 8d 3d 31 75 b2 09 44 8b 44 24 20 8b 4c 24 30 48 8b 54 24 40 <67> 48 0f b9 3a e9 28 ed ff ff e8 34 d5 8b fa 89 ee bf ff 00 00 00 [ 1885.230708][ T1754] RSP: 0000:ffffc90020747740 EFLAGS: 00010283 [ 1885.230721][ T1754] RAX: ffffffff8ca5d6a0 RBX: ffff88806edde200 RCX: 0000000080006880 [ 1885.230732][ T1754] RDX: ffff88804c31e0e0 RSI: ffffffff8ca5d6a0 RDI: ffffffff912fcc40 [ 1885.230743][ T1754] RBP: ffff888026f1e058 R08: 00000000000000c0 R09: 0000000000000000 [ 1885.230753][ T1754] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888026f1e0b0 [ 1885.230782][ T1754] R13: ffff8880703b5360 R14: ffff8880703b5366 R15: ffff8880703b5367 [ 1885.230819][ T1754] ? __init_swait_queue_head+0xca/0x150 [ 1885.230853][ T1754] usb_start_wait_urb+0x10e/0x580 [ 1885.230880][ T1754] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1885.230901][ T1754] ? trace_kmalloc+0xeb/0x110 [ 1885.230925][ T1754] ? __asan_memset+0x23/0x50 [ 1885.230942][ T1754] usb_control_msg+0x328/0x4b0 [ 1885.230964][ T1754] ? __pfx_usb_control_msg+0x10/0x10 [ 1885.230987][ T1754] ? do_pwritev+0x1ac/0x270 [ 1885.231005][ T1754] ? __do_fast_syscall_32+0xe7/0x970 [ 1885.231022][ T1754] dtv5100_i2c_msg+0x1be/0x340 [ 1885.231042][ T1754] dtv5100_i2c_xfer+0x131/0x3d0 [ 1885.231060][ T1754] __i2c_transfer+0x5d9/0x1740 [ 1885.231082][ T1754] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1885.231103][ T1754] ? __pfx___i2c_transfer+0x10/0x10 [ 1885.231122][ T1754] ? rt_mutex_slowtrylock+0x93/0x100 [ 1885.231140][ T1754] i2c_transfer+0x15f/0x380 [ 1885.231160][ T1754] i2c_transfer_buffer_flags+0x10c/0x190 [ 1885.231180][ T1754] ? __pfx_i2c_transfer_buffer_flags+0x10/0x10 [ 1885.231202][ T1754] ? _copy_from_user+0x59/0xd0 [ 1885.231223][ T1754] i2cdev_write+0x11e/0x240 [ 1885.231242][ T1754] ? __pfx_i2cdev_write+0x10/0x10 [ 1885.231259][ T1754] vfs_writev+0x5ed/0xdd0 [ 1885.231283][ T1754] ? __pfx_vfs_writev+0x10/0x10 [ 1885.231316][ T1754] ? __fget_files+0x21f/0x3d0 [ 1885.231341][ T1754] ? do_pwritev+0x1ac/0x270 [ 1885.231359][ T1754] do_pwritev+0x1ac/0x270 [ 1885.231379][ T1754] ? __pfx_do_pwritev+0x10/0x10 [ 1885.231404][ T1754] __do_fast_syscall_32+0xe7/0x970 [ 1885.231416][ T1754] ? lockdep_hardirqs_on+0x78/0x100 [ 1885.231440][ T1754] do_fast_syscall_32+0x32/0x70 [ 1885.231456][ T1754] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1885.231479][ T1754] RIP: 0023:0xf7fe6fec [ 1885.231498][ T1754] Code: Unable to access opcode bytes at 0xf7fe6fc2. [ 1885.231510][ T1754] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000014e [ 1885.231532][ T1754] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000500 [ 1885.231547][ T1754] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1885.231560][ T1754] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1885.231574][ T1754] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1885.231587][ T1754] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1885.231616][ T1754] [ 1885.232311][ T1754] Kernel Offset: disabled