last executing test programs: 22.260519809s ago: executing program 1 (id=214): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendto$inet6(r5, 0x0, 0x0, 0x20004041, 0x0, 0x0) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0900000000000000000002000000140001800500020001"], 0x28}}, 0x0) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x14e22, 0xfffffff8, @ipv4}, 0x1c) sendmmsg$inet(r3, &(0x7f0000000600)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c844) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000640)=@generic={0x1, 0x5, 0x8000000000000001}) writev(r8, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff08000400000000000000", 0x38}], 0x1) sendto$inet(r3, &(0x7f00000000c0)="8689d46205a34100bf2bbe11a5ce7839edaf02afe39ead95913e9c4f8cf31440606769ebdf12cfacae8e8c03f5db079da7d9ecda75e2a7d49d5cbcb370c4d789390a328ba42c9c60cf2154d1b659aa709e8980a522cfb72f23ad87fb7019706ccae98cfe7c4fd23e8297b8cabc46ede1ac3da78f1b488c6357e7edfcd417df6660af20a54ecdcb02f689ae15ee655d4b7b1ea733e88ee9f53669388dff487c1c49953f3bc142112bd4b582b29b35d43962ed245c2cd5d5df40a3e0ed6beaf3b641e84b0f0dfa121a9efe05269f9f4a0e9bcbf43c7a90a711f453668c730c3badedca687b71a9c27bab9e724cc4a4918713031596ea6fd01124f973f257ccd9665aee7df4a9d64f079d176abc00000000d7af3e2dd4396f72373fb0a787a6129ca41181f5087fb843212550b58e3707d5a0399de36c2503836cbe2133de4f574e9e05c96788b0de1bd13e390445433d96737b964fa8af2ac4b2f0f9390ca93d8d3d810044d024359e067c4553230ab748947d33f8fc115ce9a49e6571c45a05d786cbd49342c236537dbbeec666b07baab917252113a5b9a77283189b518f356debe42d80cf2d0687b9c64d0253a6a09286fded6e4f8557b8fb4f25ca4fb138af8945c74bbc98748eaaa030be5317646f195e6e085ac6ddb29542e3581961259987241f7e7061526a7afec8962e74215fea43703a4e543ee9d1a3c3f5f2a41977ece8fdadcf89ce331ce59bebae5f53513d0e10485d7ddbda60513bf339602510b3a23ea29a0d5d03a61e34d12942ea4a847c884b27b5344a456d02a55f8929cc567e7c792c01fab7a7b32780a14c361000609b817dd91507b04d875279527946fdb8fb92a512485e234d092c28f1d0a0498731ccc0eb10515d510e8945839307b46512ceca6f495fdd2c6ae5eb2ef3b2a40ebdc7edf0048e3fb5e3d97a9ea5113a6b70d20ad5c43f0df95d88c0f121a1884da21a21f0ba47420f8391a97921cc51871dbb272e43710fe71d5e342c3afd10608a8b02f00e8fbd8d570b6faace86c494ecea8913233391e7b7cec3d571bb3032181ed58e1b513e511f79ee562c8cde9b3b74c2e95dcde7fadb5a666bdc0c1684794620ce8cf0c0aee8e90b3ef6e7160d3f055cb4d1ced32e4edc15e7d102952d3237e6c02c591a95a182bf190c0124abc7f1225332ff1c5e1b94e4e9bf02c1a18bd7bfce20707f7298da322560bc1a4cf298d46f5bf8ff41da21e25aa17f65f9ee43ca890b5ef6a3ccf3efedf3ca60a9acef1352ad0c43e6cf375108cf0974ce89a99adba7e6a3f8949dc573440fafe0e3abdd0066057a2d868e8386080f18a421568d8e7a89536a4173861bd55245c8fcf7dcba18edce36d2e85b9630fbc218db9ebd16abb11ac06fdbf2bc3e6394d4c6e7ae71813d30772d487743a2856348fee09989ce03331e7848770fc91e62191c20fe5f4a73c5dae467dd612bdb63b1e50921d38271305d7412103d5a6214d6d534d1d530b9169f882b6926bbd338f0282a8bd9a44603934e5249e83f1d0947b39f82a7843d2b6f796d8abf7ff3e66cfd4519324d71cebbf6580dffc10d555e479e9acaa12c3c59e3732c181aa4223d0fcdac514e9d7c7963c2634964520286b028f60a4ae612b8e6049315139e884cbffd6836253094ad023329183496cf663366ad4d7f7f5f1bd2db9b0d33f106c041fba4494c7da404d45d8955e5459ca4a62862721ec1fa534fd95e262c5814426816e60000000000000000001aa4fb6f40ec24f42f6949cc28d2a0d4eb61cb1664627582d962523586539445b81e9759321652280ecb", 0xffe3, 0x6000000000000000, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000700), 0x9, 0x0) 16.595041115s ago: executing program 2 (id=221): socket$caif_seqpacket(0x25, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x84}}, 0x0}, 0x94) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) pipe2$watch_queue(0x0, 0x80) unshare(0x8000000) semget$private(0x0, 0x4000, 0x555) semtimedop(0x0, &(0x7f0000000040)=[{0x3, 0x8, 0x1800}], 0x1, 0x0) unshare(0x2c040000) 15.760471134s ago: executing program 2 (id=222): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/fib_triestat\x00') pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0xc2a) 14.198597238s ago: executing program 2 (id=223): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r0, 0x8b2c, &(0x7f0000000040)) 12.58757421s ago: executing program 1 (id=224): r0 = socket(0x40000000015, 0x5, 0x0) r1 = accept$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1e4062, &(0x7f0000000280)={[], [{@uid_eq}]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_DEL(r7, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000040)={0x2f, 0x0, r8}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r3, 0xc04064aa, &(0x7f00000000c0)={&(0x7f0000000040), 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003040)) sendmsg$BATADV_CMD_TP_METER(r2, 0x0, 0x20040084) setsockopt$packet_int(r1, 0x107, 0x10, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0xfffe, 0x0, @loopback}, 0x1c) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r10, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r9, &(0x7f00000001c0)='m', 0xffffff4c}]) 10.749389598s ago: executing program 1 (id=227): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001900010027bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x19, 0x5, 0x71}, 0x2c) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(r3, 0x0, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@sco={0x1f, @none}, 0x80, 0x0, 0x50, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x14, 0x1a, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x1b}]}, 0x14}], 0x1}, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(0x0, r6) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="01002dbd70027100c1582100000018"], 0x2c}, 0x1, 0x0, 0x0, 0x2001}, 0x4010000) 10.13556032s ago: executing program 2 (id=228): socket$nl_route(0x10, 0x3, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r7 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xd9}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000880)=""/202, 0xca, 0x200000200009, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) ptrace$peek(0x2, r8, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r5}, 0x20) recvmsg$unix(r5, &(0x7f00000003c0)={0x0, 0xffffffffffffff04, &(0x7f0000002380)=[{&(0x7f0000002480)=""/195, 0xc3}], 0x1}, 0x2000) shutdown(r4, 0x2) 10.122469527s ago: executing program 0 (id=229): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000001a40)=""/102392, 0x18ff8) r1 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r3 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x1}, &(0x7f00000009c0)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e38b8beb84ef6d549eed5aaa86dbe646fc95b4b88e17fb55ae6f1221bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dcb0d103098fa302c5b1d48f913f8b22a30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec9dd110f31ba5ae65e31f00e641832d29ed658b91f349b801b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126fceb6cca68972ac02bc7d9b0aa6453cbca85e30a02db8f48b9eb10526d00f4e90971d6c844fb8b2fb70ec826465726fb78cc47db98cf04ba351e13fcd9ab1c4c2a18f2fb931951347528d02aa982f43ad", 0x189, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r1, r2, r3}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={'sha256\x00'}}) bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x3, 0x8, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4203}, 0x94) sendmsg$NFT_MSG_GETOBJ(0xffffffffffffffff, 0x0, 0x40004) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910710007e570966f4366ec9d4"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x32803, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) io_submit(0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) syz_open_procfs$pagemap(0x0, &(0x7f0000000080)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{}, 0x0, &(0x7f0000000200)}, 0x20) 8.787994976s ago: executing program 3 (id=230): openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) syz_init_net_socket$rose(0xb, 0x5, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = mq_open(&(0x7f0000000000)='/dev/ptp0\x00', 0x800, 0x100, 0x0) syz_open_dev$loop(0x0, 0xb8a, 0x18b80) syz_open_dev$dvb_frontend(&(0x7f00000003c0), 0x0, 0xe82) mq_timedsend(r2, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x77359400}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xff00000000000000, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x1000001000, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002, 0xff00000000000000}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 8.43111287s ago: executing program 1 (id=231): openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) epoll_create1(0x80000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0x85}, 0x4000000) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r2 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000105002, 0x0) pwritev2(r2, 0x0, 0x0, 0x4000000, 0x5, 0xa) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 6.418018465s ago: executing program 1 (id=232): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) unshare(0x22020400) sched_setparam(0x0, &(0x7f0000000040)=0xfffffffe) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$packet(0x11, 0x3, 0x300) syz_emit_vhci(&(0x7f0000000040)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x3, 0x3, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0x7, 0x8}, {0x17de, 0xb, 0x1, 0xffff}}}}, 0x15) syz_usbip_server_init(0x1) pread64(0xffffffffffffffff, &(0x7f0000000140)=""/55, 0x37, 0xffffffffffffffff) setsockopt$packet_int(r3, 0x107, 0x19, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={0x0, 0xd}, 0x8) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r5 = eventfd2(0x406, 0x80801) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000100)={0x1, r5}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f00000000c0)={0x1, 0xffffffffffffffff, 0x1}) 5.507077596s ago: executing program 0 (id=233): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(0xffffffffffffffff, 0x3b88, &(0x7f0000000200)={0xc, r0}) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(0xffffffffffffffff, 0x3b70, &(0x7f0000000240)={0x18}) 4.451690922s ago: executing program 3 (id=234): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, 0x0, 0x4000010) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) accept(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1f, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x7d}]}, 0x0, 0xa, 0x0, 0x0, 0x41000, 0x1e, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000040)={r4}, 0xc) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r5, &(0x7f0000000300)=""/102400, 0x19000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r7, 0x4b52, &(0x7f0000000000)={0x2, {0x2, 0xffff, 0x880}}) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x5c, 0x24, 0xd0f, 0x470bd30, 0x25dfdbff, {0x60, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0xfff1, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_ingress={0xc}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x0, 0x4, 0x3, 0x2, 0x9, 0x1}}, {0x4}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x44080) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) 4.370904123s ago: executing program 0 (id=235): r0 = socket(0x40000000015, 0x5, 0x0) r1 = accept$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) socketpair$unix(0x1, 0x2, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x51) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x1e4062, &(0x7f0000000280)={[], [{@uid_eq}]}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_DEL(r7, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(0xffffffffffffffff, 0xc01064ab, &(0x7f0000000040)={0x2f, 0x0, r8}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r3, 0xc04064aa, &(0x7f00000000c0)={&(0x7f0000000040), 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003040)) sendmsg$BATADV_CMD_TP_METER(r2, 0x0, 0x20040084) setsockopt$packet_int(r1, 0x107, 0x10, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0xfffe, 0x0, @loopback}, 0x1c) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r10, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r9, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r9, &(0x7f00000001c0)='m', 0xffffff4c}]) 4.165328673s ago: executing program 2 (id=236): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl(r0, 0x8b2c, &(0x7f0000000040)) 3.929513626s ago: executing program 3 (id=237): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000140)={0xb, {'syz1\x00', 'syz0\x00', 'syz1\x00', 0x5, 0x4, 0x3ff, 0x1, 0x4, 0xbc, "d6515f9477"}}, 0x11d) 3.111679719s ago: executing program 3 (id=238): r0 = socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0xffffffffffffffe1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1}, 0x20) 3.03301761s ago: executing program 0 (id=239): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000001900010027bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0x84, @local, 0x15, 0x3, 'sh\x00', 0x19, 0x5, 0x71}, 0x2c) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e24, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(r3, 0x0, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@sco={0x1f, @none}, 0x80, 0x0, 0x50, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)={0x14, 0x1a, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x1b}]}, 0x14}], 0x1}, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(0x0, r6) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYBLOB="01002dbd70027100c1582100000018"], 0x2c}, 0x1, 0x0, 0x0, 0x2001}, 0x4010000) 2.877519923s ago: executing program 1 (id=240): openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000000)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000240)={0x0, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGMASK(r1, 0x80015b12, 0x0) 1.137084144s ago: executing program 3 (id=241): openat$dsp(0xffffffffffffff9c, &(0x7f0000000200), 0x42, 0x0) epoll_create1(0x80000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r0, 0x2219, 0xcf74, 0x16, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0x85}, 0x4000000) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r2 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000105002, 0x0) pwritev2(r2, 0x0, 0x0, 0x4000000, 0x5, 0xa) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 210.792851ms ago: executing program 3 (id=242): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x802, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000380)={{0xd9, 0xffe, 0x8, 0x8009}, 'syz0\x00', 0x11}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0xfffffffffffffffe, 0x2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 198.884268ms ago: executing program 0 (id=250): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x93}, [{0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8, 0x5, 0x0, 0xfffffffc, 0x5}, {}, {0x0, 0x0, 0x800000, 0x0, 0x6}, {0x0, 0xc3}, {0x0, 0x5}, {0x5}, {}, {0x0, 0x10}, {0x0, 0x4, 0x0, 0x8000000}, {0x0, 0x0, 0x0, 0x0, 0x800}, {0x7, 0x0, 0x0, 0x0, 0x6}, {}, {0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x20}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, {0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x7, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, {0x4, 0x0, 0x0, 0x0, 0x5}, {0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xffffffff, 0x9}, {0x0, 0x0, 0x0, 0x0, 0xfffff800}, {}, {}, {0xffffffff, 0x4}, {}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0x2}, {}, {0x80}, {0x80}, {0x0, 0x0, 0x0, 0x5, 0x5}, {}, {0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x8510}, {0xffff}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0x0, 0xfffefffd}, {0x0, 0x0, 0x0, 0x1}, {}, {0x5}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, {0x0, 0xfffffffc, 0x200}, {}, {0x0, 0x0, 0x0, 0x3}, {0x7}, {}, {}, {}, {0x0, 0x101, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0x0, 0x0, 0x0, 0x4, 0x9}, {}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x2}, {}, {}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x56}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0xfffffffd}, {0x6}, {0x7f}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {0x2, 0x9, 0x20000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0xe600, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, {0x0, 0x5, 0x0, 0x7, 0x1}, {0x0, 0x5, 0xffff}, {0x0, 0x0, 0x0, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {0xfffffffb, 0x0, 0x0, 0x0, 0x8000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x2d}, {}, {0x0, 0x8000}, {0x0, 0xfffffffe, 0x10000}, {0x0, 0x80000000, 0x0, 0x7fff800}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0xd}], [{}, {}, {}, {0x1}, {0x4}, {0x3}, {}, {0x0, 0x1}, {}, {}, {}, {0x2}, {}, {}, {}, {}, {0x4, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x4}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {0x5}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {0x1}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {0x2, 0x1}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x2}, {}, {}, {0x4}, {0x3}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) 63.599966ms ago: executing program 0 (id=243): openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0542, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000003f01f00040000009a00000001"], 0x48) syz_init_net_socket$rose(0xb, 0x5, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = mq_open(&(0x7f0000000000)='/dev/ptp0\x00', 0x800, 0x100, 0x0) syz_open_dev$loop(0x0, 0xb8a, 0x18b80) syz_open_dev$dvb_frontend(&(0x7f00000003c0), 0x0, 0xe82) mq_timedsend(r2, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x77359400}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xff00000000000000, 0x5, 0xfffffffffffffffd, 0x8001, 0x0, 0x1000001000, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002, 0xff00000000000000}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 2 (id=244): socket$nl_route(0x10, 0x3, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r7 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xd9}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r7, 0x2219, 0x7721, 0x16, 0x0, 0x0) mq_timedreceive(r6, &(0x7f0000000880)=""/202, 0xca, 0x200000200009, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) ptrace$peek(0x2, r8, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, &(0x7f00000006c0), &(0x7f0000000700)=r5}, 0x20) recvmsg$unix(r5, &(0x7f00000003c0)={0x0, 0xffffffffffffff04, &(0x7f0000002380)=[{&(0x7f0000002480)=""/195, 0xc3}], 0x1}, 0x2000) shutdown(r4, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.89' (ED25519) to the list of known hosts. [ 81.554622][ T5755] cgroup: Unknown subsys name 'net' [ 81.718991][ T5755] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.424988][ T5755] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.177751][ T5771] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.195298][ T5773] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.204942][ T5771] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.220422][ T5773] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.224878][ T5783] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.229416][ T5773] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.242064][ T5771] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.249387][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.257663][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.265381][ T5773] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.267709][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.273580][ T5773] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.281999][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.295409][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.302973][ T5773] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.303742][ T5784] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 85.312139][ T5773] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 85.319380][ T5784] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.327403][ T5773] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 85.338710][ T5771] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.346191][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.354928][ T5784] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 85.356309][ T5773] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.363842][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.862113][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 85.916847][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 85.990271][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 86.087145][ T5769] chnl_net:caif_netlink_parms(): no params data found [ 86.147548][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.155865][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.163683][ T5770] bridge_slave_0: entered allmulticast mode [ 86.171505][ T5770] bridge_slave_0: entered promiscuous mode [ 86.182512][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.189645][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.197234][ T5770] bridge_slave_1: entered allmulticast mode [ 86.205102][ T5770] bridge_slave_1: entered promiscuous mode [ 86.271983][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.279180][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.286954][ T5767] bridge_slave_0: entered allmulticast mode [ 86.294274][ T5767] bridge_slave_0: entered promiscuous mode [ 86.303116][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.310460][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.317704][ T5767] bridge_slave_1: entered allmulticast mode [ 86.324904][ T5767] bridge_slave_1: entered promiscuous mode [ 86.380416][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.387643][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.395174][ T5768] bridge_slave_0: entered allmulticast mode [ 86.402778][ T5768] bridge_slave_0: entered promiscuous mode [ 86.414552][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.427379][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.439298][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.468096][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.476232][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.483670][ T5768] bridge_slave_1: entered allmulticast mode [ 86.491908][ T5768] bridge_slave_1: entered promiscuous mode [ 86.511878][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.576985][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.584425][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.592280][ T5769] bridge_slave_0: entered allmulticast mode [ 86.599636][ T5769] bridge_slave_0: entered promiscuous mode [ 86.620590][ T5770] team0: Port device team_slave_0 added [ 86.629712][ T5767] team0: Port device team_slave_0 added [ 86.636898][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.647234][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.654512][ T5769] bridge_slave_1: entered allmulticast mode [ 86.664768][ T5769] bridge_slave_1: entered promiscuous mode [ 86.673885][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.686256][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.699327][ T5770] team0: Port device team_slave_1 added [ 86.722036][ T5767] team0: Port device team_slave_1 added [ 86.807639][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.817646][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.847664][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.860782][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.867784][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.894572][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.909480][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.923028][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.936913][ T5768] team0: Port device team_slave_0 added [ 86.946844][ T5768] team0: Port device team_slave_1 added [ 86.965384][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.972737][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.999071][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.018483][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.025920][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.052349][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.127146][ T5769] team0: Port device team_slave_0 added [ 87.146440][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.156523][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.183388][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.198183][ T5769] team0: Port device team_slave_1 added [ 87.235661][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.244132][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.270537][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.298189][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.305497][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.336358][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.359797][ T5767] hsr_slave_0: entered promiscuous mode [ 87.366955][ T5767] hsr_slave_1: entered promiscuous mode [ 87.400811][ T5784] Bluetooth: hci0: command tx timeout [ 87.400828][ T5773] Bluetooth: hci2: command tx timeout [ 87.401282][ T5773] Bluetooth: hci3: command tx timeout [ 87.419463][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.427439][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.453893][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.489922][ T5773] Bluetooth: hci1: command tx timeout [ 87.543953][ T5770] hsr_slave_0: entered promiscuous mode [ 87.550944][ T5770] hsr_slave_1: entered promiscuous mode [ 87.557612][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.566480][ T5770] Cannot create hsr debugfs directory [ 87.623305][ T5768] hsr_slave_0: entered promiscuous mode [ 87.630212][ T5768] hsr_slave_1: entered promiscuous mode [ 87.636982][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.644689][ T5768] Cannot create hsr debugfs directory [ 87.671430][ T5769] hsr_slave_0: entered promiscuous mode [ 87.678137][ T5769] hsr_slave_1: entered promiscuous mode [ 87.686698][ T5769] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.694404][ T5769] Cannot create hsr debugfs directory [ 88.236941][ T5770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.254582][ T5770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.267840][ T5770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.279655][ T5770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.360594][ T5768] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.387971][ T5768] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.406354][ T5768] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.417560][ T5768] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.504535][ T5767] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.527644][ T5767] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.539383][ T5767] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.559714][ T5767] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.674801][ T5769] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.686874][ T5769] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.698939][ T5769] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.727521][ T5769] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.768853][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.823464][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.849680][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.907802][ T1117] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.915259][ T1117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.936094][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.961152][ T1117] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.968366][ T1117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.986265][ T1117] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.993514][ T1117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.014712][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.037695][ T1117] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.044913][ T1117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.131790][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.147189][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.189748][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.197007][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.236804][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.244085][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.333459][ T5769] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.405156][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.412477][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.425099][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.432330][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.480339][ T5773] Bluetooth: hci0: command tx timeout [ 89.486389][ T5776] Bluetooth: hci2: command tx timeout [ 89.490698][ T5773] Bluetooth: hci3: command tx timeout [ 89.536807][ T5769] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.560742][ T5784] Bluetooth: hci1: command tx timeout [ 89.819487][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.972836][ T5770] veth0_vlan: entered promiscuous mode [ 90.016806][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.046015][ T5770] veth1_vlan: entered promiscuous mode [ 90.063109][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.154737][ T5770] veth0_macvtap: entered promiscuous mode [ 90.174164][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.188353][ T5770] veth1_macvtap: entered promiscuous mode [ 90.208658][ T5769] veth0_vlan: entered promiscuous mode [ 90.244428][ T5769] veth1_vlan: entered promiscuous mode [ 90.259402][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.273708][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.300328][ T5767] veth0_vlan: entered promiscuous mode [ 90.309225][ T5770] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.319145][ T5770] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.329381][ T5770] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.338330][ T5770] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.369131][ T5767] veth1_vlan: entered promiscuous mode [ 90.455236][ T5768] veth0_vlan: entered promiscuous mode [ 90.474024][ T5769] veth0_macvtap: entered promiscuous mode [ 90.504852][ T5768] veth1_vlan: entered promiscuous mode [ 90.526518][ T5769] veth1_macvtap: entered promiscuous mode [ 90.563074][ T5767] veth0_macvtap: entered promiscuous mode [ 90.593953][ T5767] veth1_macvtap: entered promiscuous mode [ 90.624716][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.635931][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.647972][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.665821][ T5768] veth0_macvtap: entered promiscuous mode [ 90.671936][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.692559][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.710787][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 90.725712][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.737400][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.758567][ T5768] veth1_macvtap: entered promiscuous mode [ 90.779151][ T5769] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.790212][ T5769] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.798980][ T5769] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.808303][ T5769] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.837380][ T1117] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.846797][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.857680][ T1117] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.866701][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.877548][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.888192][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.900582][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.916915][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.929546][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.942348][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.953237][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.967326][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 90.977926][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 90.990464][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.019945][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.040533][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.051420][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.063854][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.076194][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.101709][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.112559][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.123902][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.135131][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.145398][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 91.156258][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.182840][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.199302][ T5768] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.212767][ T5768] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.223337][ T5768] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.234764][ T5768] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.256555][ T5767] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.265998][ T5767] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.275685][ T5767] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.284765][ T5767] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.503250][ T1313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.536364][ T1313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.561097][ T5776] Bluetooth: hci0: command tx timeout [ 91.561109][ T5773] Bluetooth: hci2: command tx timeout [ 91.577217][ T5784] Bluetooth: hci3: command tx timeout [ 91.584620][ T1313] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.601020][ T1313] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.650992][ T5784] Bluetooth: hci1: command tx timeout [ 91.679143][ T1313] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.701912][ T1313] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.776861][ T1140] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.816842][ T1140] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.855817][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.892833][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.931072][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.939288][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.202872][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.231836][ T5848] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.288739][ T787] cfg80211: failed to load regulatory.db [ 92.496547][ T5854] ======================================================= [ 92.496547][ T5854] WARNING: The mand mount option has been deprecated and [ 92.496547][ T5854] and is ignored by this kernel. Remove the mand [ 92.496547][ T5854] option from the mount to silence this warning. [ 92.496547][ T5854] ======================================================= [ 93.730050][ T5784] Bluetooth: hci3: command tx timeout [ 93.735652][ T5784] Bluetooth: hci0: command tx timeout [ 93.741228][ T5784] Bluetooth: hci2: command tx timeout [ 93.747114][ T5784] Bluetooth: hci1: command tx timeout [ 94.135053][ T5872] misc userio: Begin command sent, but we're already running [ 94.290302][ T5817] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 94.490342][ T5817] usb 2-1: Using ep0 maxpacket: 32 [ 94.531144][ T5817] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 94.540806][ T5817] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 94.549476][ T5817] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.580380][ T5817] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 94.630074][ T5817] usb 2-1: config 1 has no interface number 0 [ 94.650639][ T5817] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 94.680894][ T5817] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.757078][ T5817] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 94.939403][ T5817] snd_usb_pod 2-1:1.1: endpoint not available, using fallback values [ 94.999248][ T5817] snd_usb_pod 2-1:1.1: invalid control EP [ 95.024530][ T5817] snd_usb_pod 2-1:1.1: cannot start listening: -22 [ 95.065013][ T5817] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 95.108078][ T5817] snd_usb_pod: probe of 2-1:1.1 failed with error -22 [ 95.177189][ T5817] usb 2-1: USB disconnect, device number 2 [ 95.335819][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 96.801042][ T5817] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 97.000624][ T5817] usb 1-1: Using ep0 maxpacket: 16 [ 97.016367][ T5817] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 97.027271][ T5817] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 97.100274][ T5817] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 97.109416][ T5817] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.133702][ T5817] usb 1-1: config 0 descriptor?? [ 97.220826][ T5817] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 99.780491][ T8] IPVS: starting estimator thread 0... [ 99.805650][ T5923] Zero length message leads to an empty skb [ 99.812699][ T5923] netlink: 'syz.1.29': attribute type 27 has an invalid length. [ 99.820541][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 99.823498][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 99.890618][ T5928] IPVS: using max 17 ests per chain, 40800 per kthread [ 100.435211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.435987][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 100.453830][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.537820][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 100.546622][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.630512][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 102.803823][ T5772] usb 1-1: USB disconnect, device number 2 [ 103.820779][ T5951] netlink: 4 bytes leftover after parsing attributes in process `syz.3.36'. [ 104.339956][ T5772] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 104.786832][ T5772] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 104.882130][ T5965] netlink: 'syz.0.41': attribute type 27 has an invalid length. [ 104.958082][ T5772] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 104.969760][ T786] IPVS: starting estimator thread 0... [ 104.978769][ T5772] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 105.004385][ T5772] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 105.050051][ T5772] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 105.090534][ T5967] IPVS: using max 26 ests per chain, 62400 per kthread [ 105.106340][ T5772] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 105.126845][ T5772] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 105.156263][ T5772] usb 4-1: Product: syz [ 105.182685][ T5772] usb 4-1: Manufacturer: syz [ 105.201875][ T5772] cdc_wdm 4-1:1.0: skipping garbage [ 105.207173][ T5772] cdc_wdm 4-1:1.0: skipping garbage [ 105.218581][ T5772] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 105.233471][ T5772] cdc_wdm 4-1:1.0: Unknown control protocol [ 105.907242][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.914083][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.920778][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.927416][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.934318][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.941029][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.947624][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.954520][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.961224][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.967929][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.975442][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.982138][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 105.988780][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 105.995424][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 106.002044][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 106.008684][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 106.015133][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 106.021780][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 106.028284][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 106.034909][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 106.113521][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 106.113524][ T23] usb 4-1: USB disconnect, device number 2 [ 108.577712][ T5994] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 108.939096][ T5997] netlink: 124 bytes leftover after parsing attributes in process `syz.3.47'. [ 110.778169][ T6005] syz.3.50[6005]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 111.050968][ T6007] IPVS: length: 528 != 8 [ 111.056630][ T6007] process 'syz.3.50' launched '/dev/fd/5' with NULL argv: empty string added [ 111.075612][ T6007] xt_hashlimit: size too large, truncated to 1048576 [ 115.120169][ T5836] IPVS: starting estimator thread 0... [ 115.210122][ T6016] IPVS: using max 20 ests per chain, 48000 per kthread [ 115.484779][ T28] IPVS: starting estimator thread 0... [ 115.842551][ T6024] IPVS: using max 15 ests per chain, 36000 per kthread [ 119.561891][ T6049] comedi comedi3: pcmda12: I/O port conflict (0x6,16) [ 119.680058][ T28] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 119.900736][ T28] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 119.947281][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.003363][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.024710][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.040864][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.053040][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.064608][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.093918][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.111216][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.143025][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.157506][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.187045][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.207007][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.243533][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.256865][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.276247][ T28] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 120.297020][ T28] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 120.320884][ T28] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 120.340152][ T28] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 120.354697][ T28] usb 4-1: Product: syz [ 120.359255][ T28] usb 4-1: Manufacturer: syz [ 120.364154][ T28] usb 4-1: SerialNumber: syz [ 120.374143][ T28] usb 4-1: config 0 descriptor?? [ 122.181932][ T6046] warning: `syz.3.61' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 122.316249][ T5772] usb 4-1: USB disconnect, device number 3 [ 132.936343][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 132.943204][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 132.963255][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 133.012470][ T6114] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 133.069581][ T6114] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 133.214250][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 133.230559][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 133.252858][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 133.268183][ T6114] wlan0 speed is unknown, defaulting to 1000 [ 133.351513][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.364016][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.992566][ T6128] binder: BINDER_SET_CONTEXT_MGR already set [ 134.998879][ T6128] binder: 6127:6128 ioctl 4018620d 200000004a80 returned -16 [ 136.845767][ T6136] comedi comedi3: pcmda12: I/O port conflict (0x6,16) [ 138.819989][ T23] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 139.039374][ T23] usb 4-1: Using ep0 maxpacket: 16 [ 139.059274][ T23] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 139.105370][ T23] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 139.170132][ T23] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 139.179443][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.232754][ T23] usb 4-1: config 0 descriptor?? [ 139.271027][ T23] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 141.870465][ T5816] usb 4-1: USB disconnect, device number 4 [ 142.804972][ T6158] siw: device registration error -23 [ 144.684868][ T6163] mmap: syz.3.90 (6163) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 144.775904][ T6167] siw: device registration error -23 [ 145.674212][ T6163] program syz.3.90 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 146.437599][ T6173] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 158.544192][ T5817] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 159.184180][ T5817] usb 4-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 159.197138][ T5817] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.254616][ T5817] usb 4-1: config 0 descriptor?? [ 159.275977][ T5817] pwc: Samsung MPC-C10 USB webcam detected. [ 159.564678][ T5817] pwc: send_video_command error -71 [ 159.574376][ T5817] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 159.664576][ T6233] siw: device registration error -23 [ 159.950810][ T5817] Philips webcam: probe of 4-1:0.0 failed with error -71 [ 160.324699][ T5817] usb 4-1: USB disconnect, device number 5 [ 160.916389][ T5817] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 160.934164][ T6242] netlink: 'syz.0.107': attribute type 27 has an invalid length. [ 161.343920][ T5817] usb 4-1: device descriptor read/all, error -71 [ 166.350785][ T6265] siw: device registration error -23 [ 169.247943][ T6275] netlink: 'syz.3.121': attribute type 27 has an invalid length. [ 169.639028][ T6278] program syz.1.116 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 170.210106][ T5772] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 170.447421][ T5772] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 170.481151][ T5772] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 170.559360][ T5772] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 170.600117][ T5772] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 170.659989][ T5772] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 170.730324][ T5772] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 170.790849][ T5772] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 170.819322][ T5772] usb 2-1: Product: syz [ 170.843872][ T5772] usb 2-1: Manufacturer: syz [ 170.890750][ T5772] cdc_wdm 2-1:1.0: skipping garbage [ 170.896020][ T5772] cdc_wdm 2-1:1.0: skipping garbage [ 170.951759][ T5772] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 170.957759][ T5772] cdc_wdm 2-1:1.0: Unknown control protocol [ 171.152367][ C1] wdm_int_callback: 320 callbacks suppressed [ 171.152384][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.164996][ C1] wdm_int_callback: 320 callbacks suppressed [ 171.165008][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.180070][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.186751][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.193119][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.199905][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.210276][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.216917][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.223266][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.229928][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.236305][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.242934][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.249379][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.256025][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.263312][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.270025][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.276295][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.282918][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.289952][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 171.296639][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 171.321481][ T5757] usb 2-1: USB disconnect, device number 3 [ 171.327407][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 174.942526][ T6309] netlink: 'syz.0.131': attribute type 27 has an invalid length. [ 177.123180][ T6318] program syz.2.132 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 178.170050][ T23] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 178.360746][ T23] usb 3-1: too many configurations: 9, using maximum allowed: 8 [ 178.381381][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.419967][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.461023][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.502866][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.522138][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.549896][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.591259][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.625381][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.671225][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.710021][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.762033][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.782485][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.834903][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.870001][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.898852][ T23] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 178.909215][ T23] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 178.951953][ T23] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 178.973203][ T23] usb 3-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 179.000124][ T23] usb 3-1: Product: syz [ 179.020104][ T23] usb 3-1: Manufacturer: syz [ 179.050178][ T23] usb 3-1: SerialNumber: syz [ 179.093012][ T23] usb 3-1: config 0 descriptor?? [ 180.340737][ T5816] usb 3-1: USB disconnect, device number 2 [ 181.652218][ T6345] netlink: 'syz.0.143': attribute type 27 has an invalid length. [ 182.375599][ T6346] tmpfs: Bad value for 'mpol' [ 183.686758][ T6356] netlink: 'syz.0.152': attribute type 27 has an invalid length. [ 183.789489][ T23] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 187.304227][ T5776] Bluetooth: hci3: link tx timeout [ 187.312518][ T5776] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 187.448173][ T5784] Bluetooth: hci3: link tx timeout [ 187.453627][ T5784] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 187.867685][ T23] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 187.896114][ T23] usb 3-1: can't read configurations, error -71 [ 189.800243][ T5776] Bluetooth: hci3: command 0x0406 tx timeout [ 191.538038][ T6393] netlink: 'syz.1.155': attribute type 27 has an invalid length. [ 192.309992][ T5757] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 192.541013][ T5757] usb 1-1: too many configurations: 9, using maximum allowed: 8 [ 192.612844][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.633443][ T6402] netlink: 8 bytes leftover after parsing attributes in process `syz.1.157'. [ 192.636281][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.665278][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.688973][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.714857][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.732716][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.779348][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.822017][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.837266][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.848056][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.863215][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.874312][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.900047][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.919310][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 192.968093][ T5757] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 192.997859][ T5757] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 193.043976][ T5757] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 193.058890][ T5757] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 193.180397][ T5757] usb 1-1: Product: syz [ 193.189903][ T5757] usb 1-1: Manufacturer: syz [ 193.194665][ T5757] usb 1-1: SerialNumber: syz [ 193.264312][ T5757] usb 1-1: config 0 descriptor?? [ 193.928803][ T5757] usb 1-1: USB disconnect, device number 3 [ 194.135575][ T6412] tmpfs: Bad value for 'mpol' [ 194.469938][ T786] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 194.710544][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.720181][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.142624][ T786] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 196.155100][ T786] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 196.179446][ T786] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 196.220812][ T786] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 196.307441][ T786] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 196.338425][ T786] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 196.583082][ T786] usb 2-1: Product: syz [ 196.677920][ T786] usb 2-1: Manufacturer: syz [ 199.353455][ T6436] netlink: 'syz.2.164': attribute type 27 has an invalid length. [ 199.728693][ T786] usb 2-1: can't set config #1, error -71 [ 199.741048][ T786] usb 2-1: USB disconnect, device number 4 [ 202.619912][ C0] sched: RT throttling activated [ 205.729299][ T28] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 205.973771][ T28] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 206.012151][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.030061][ T28] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 206.056318][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.077211][ T28] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 206.104000][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.125938][ T28] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 206.156138][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.166752][ T28] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 206.178097][ T28] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.200227][ T28] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 9 [ 206.246918][ T28] usb 2-1: unable to read config index 5 descriptor/start: -71 [ 206.269964][ T28] usb 2-1: can't read configurations, error -71 [ 209.676183][ T6480] netlink: 'syz.1.176': attribute type 27 has an invalid length. [ 212.760113][ T5083] Bluetooth: hci1: command 0x0406 tx timeout [ 212.766322][ T5773] Bluetooth: hci2: command 0x0406 tx timeout [ 212.773060][ T5773] Bluetooth: hci0: command 0x0406 tx timeout [ 213.950377][ T6496] usb usb1: usbfs: interface 0 claimed by hub while 'syz.1.179' sets config #512 [ 216.358830][ T5816] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 217.300123][ T5757] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 217.395548][ T5816] usb 4-1: device descriptor read/all, error -71 [ 217.519929][ T5757] usb 1-1: Using ep0 maxpacket: 16 [ 217.560760][ T5757] usb 1-1: unable to get BOS descriptor or descriptor too short [ 217.655541][ T6519] netlink: 'syz.1.187': attribute type 27 has an invalid length. [ 217.722698][ T5757] usb 1-1: config 129 has an invalid interface number: 202 but max is 0 [ 217.731813][ T5757] usb 1-1: config 129 has no interface number 0 [ 217.738414][ T5757] usb 1-1: config 129 interface 202 has no altsetting 0 [ 217.834510][ T5757] usb 1-1: New USB device found, idVendor=0711, idProduct=0179, bcdDevice=1f.6f [ 217.844588][ T5757] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 217.852821][ T5757] usb 1-1: Product: syz [ 217.857605][ T5757] usb 1-1: Manufacturer: syz [ 217.862597][ T5757] usb 1-1: SerialNumber: syz [ 218.264777][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 218.287977][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 218.872241][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 219.160461][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 219.183332][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71 [ 219.205768][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): invalid MAC address, using random [ 219.270176][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71 [ 219.303212][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71 [ 221.055723][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 221.083263][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 221.162120][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 221.483559][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 221.685803][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 221.698477][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 221.712326][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71 [ 221.776030][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 221.912293][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71 [ 222.666769][ T6536] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 222.745239][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71 [ 222.830347][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 222.897257][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71 [ 222.970072][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71 [ 223.010080][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 223.057155][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 223.124443][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 224.301725][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71 [ 224.318183][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 224.332170][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 224.348564][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71 [ 224.362456][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71 [ 224.376857][ T5757] ax88179_178a 1-1:129.202 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 224.484723][ T5757] ax88179_178a 1-1:129.202 eth1: register 'ax88179_178a' at usb-dummy_hcd.0-1, MCT USB 3.0 Gigabit Ethernet Adapter, b2:f4:3c:b7:8f:8b [ 224.571585][ T5757] usb 1-1: USB disconnect, device number 4 [ 224.610578][ T5757] ax88179_178a 1-1:129.202 eth1: unregister 'ax88179_178a' usb-dummy_hcd.0-1, MCT USB 3.0 Gigabit Ethernet Adapter [ 227.016374][ T6552] netlink: 'syz.3.197': attribute type 27 has an invalid length. [ 230.577043][ T5757] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 230.794139][ T5757] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 230.822772][ T5757] usb 3-1: New USB device found, idVendor=0572, idProduct=0041, bcdDevice=70.54 [ 230.852508][ T5757] usb 3-1: New USB device strings: Mfr=1, Product=34, SerialNumber=7 [ 231.859965][ T5757] usb 3-1: Product: syz [ 231.864199][ T5757] usb 3-1: Manufacturer: syz [ 231.868815][ T5757] usb 3-1: SerialNumber: syz [ 231.893681][ T5757] usb 3-1: config 0 descriptor?? [ 231.923207][ T5757] gspca_main: conex-2.14.0 probing 0572:0041 [ 233.053991][ T5757] usb 3-1: USB disconnect, device number 5 [ 235.370736][ T6589] netlink: 'syz.1.207': attribute type 27 has an invalid length. [ 241.336854][ T6620] netlink: 'syz.2.216': attribute type 27 has an invalid length. [ 251.245355][ T27] audit: type=1326 audit(1772417847.432:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6666 comm="syz.0.226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd98b99c799 code=0x7ffc0000 [ 251.695033][ T27] audit: type=1326 audit(1772417847.432:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6666 comm="syz.0.226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd98b99c799 code=0x7ffc0000 [ 251.711977][ T6671] workqueue: Failed to create a rescuer kthread for wq "xfs-reclaim/nullb0": -EINTR [ 251.857839][ T27] audit: type=1326 audit(1772417847.442:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6666 comm="syz.0.226" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fd98b99c799 code=0x7ffc0000 [ 256.128015][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.134777][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.550058][ T6699] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 256.557062][ T6699] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 257.429658][ T6705] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 257.445002][ T6699] vhci_hcd vhci_hcd.0: Device attached [ 257.468619][ T6700] vhci_hcd: connection closed [ 257.501197][ T1140] vhci_hcd: stop threads [ 257.513366][ T1140] vhci_hcd: release socket [ 257.522189][ T1140] vhci_hcd: disconnect device [ 260.730101][ T5816] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 261.000268][ T5816] usb 2-1: Using ep0 maxpacket: 8 [ 261.011470][ T5816] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 261.039452][ T5816] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 261.059987][ T5816] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 261.080367][ T5816] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 261.099995][ T5816] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 261.134496][ T5816] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 261.154739][ T5816] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.384806][ T5816] usb 2-1: GET_CAPABILITIES returned 0 [ 261.400116][ T5816] usbtmc 2-1:16.0: can't read capabilities [ 261.908166][ T6735] input: syz0 as /devices/virtual/input/input6 [ 261.953231][ T6739] usbtmc 2-1:16.0: control status returned 0 [ 262.115329][ T6742] ================================================================== [ 262.123483][ T6742] BUG: KASAN: slab-use-after-free in dvb_device_open+0xca/0x370 [ 262.131207][ T6742] Read of size 8 at addr ffff888141a57218 by task syz.0.243/6742 [ 262.138972][ T6742] [ 262.141362][ T6742] CPU: 1 PID: 6742 Comm: syz.0.243 Not tainted syzkaller #0 [ 262.148691][ T6742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 262.158808][ T6742] Call Trace: [ 262.162142][ T6742] [ 262.165117][ T6742] dump_stack_lvl+0x18c/0x250 [ 262.169855][ T6742] ? __lock_acquire+0x7d40/0x7d40 [ 262.174930][ T6742] ? show_regs_print_info+0x20/0x20 [ 262.180274][ T6742] ? load_image+0x400/0x400 [ 262.184830][ T6742] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 262.190354][ T6742] ? __virt_addr_valid+0x18c/0x540 [ 262.195518][ T6742] ? __virt_addr_valid+0x469/0x540 [ 262.200686][ T6742] print_report+0xa8/0x210 [ 262.205204][ T6742] ? dvb_device_open+0xca/0x370 [ 262.210257][ T6742] kasan_report+0x117/0x150 [ 262.214813][ T6742] ? chrdev_open+0x3e3/0x6a0 [ 262.219449][ T6742] ? dvb_device_open+0xca/0x370 [ 262.224365][ T6742] dvb_device_open+0xca/0x370 [ 262.229096][ T6742] ? do_raw_spin_unlock+0x121/0x230 [ 262.234354][ T6742] chrdev_open+0x5cc/0x6a0 [ 262.238825][ T6742] ? cd_forget+0x160/0x160 [ 262.243297][ T6742] ? fsnotify_perm+0x3ed/0x5e0 [ 262.248121][ T6742] ? cd_forget+0x160/0x160 [ 262.252588][ T6742] do_dentry_open+0x8c6/0x1500 [ 262.257409][ T6742] path_openat+0x27f1/0x3230 [ 262.262076][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 262.268115][ T6742] ? verify_lock_unused+0x140/0x140 [ 262.273455][ T6742] ? do_filp_open+0x430/0x430 [ 262.278184][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 262.284226][ T6742] ? __virt_addr_valid+0x18c/0x540 [ 262.289404][ T6742] do_filp_open+0x1f5/0x430 [ 262.293954][ T6742] ? vfs_tmpfile+0x490/0x490 [ 262.298606][ T6742] ? _raw_spin_unlock+0x28/0x40 [ 262.303497][ T6742] ? alloc_fd+0x58f/0x630 [ 262.307880][ T6742] do_sys_openat2+0x134/0x1d0 [ 262.312604][ T6742] ? do_sys_open+0xe0/0xe0 [ 262.317072][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 262.323103][ T6742] ? lock_chain_count+0x20/0x20 [ 262.328064][ T6742] __x64_sys_openat+0x139/0x160 [ 262.332976][ T6742] do_syscall_64+0x55/0xa0 [ 262.337448][ T6742] ? clear_bhb_loop+0x40/0x90 [ 262.342170][ T6742] ? clear_bhb_loop+0x40/0x90 [ 262.346900][ T6742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 262.352835][ T6742] RIP: 0033:0x7fd98b95cfce [ 262.357307][ T6742] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 262.376997][ T6742] RSP: 002b:00007fd989bd4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 262.385483][ T6742] RAX: ffffffffffffffda RBX: 00007fd989bd56c0 RCX: 00007fd98b95cfce [ 262.393509][ T6742] RDX: 0000000000000e82 RSI: 00007fd989bd4c00 RDI: ffffffffffffff9c [ 262.401523][ T6742] RBP: 00007fd989bd4c00 R08: 0000000000000000 R09: 0000000000000000 [ 262.409536][ T6742] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 262.417732][ T6742] R13: 00007fd98bc16128 R14: 00007fd98bc16090 R15: 00007ffe8b50ddb8 [ 262.425761][ T6742] [ 262.428834][ T6742] [ 262.431191][ T6742] Allocated by task 1: [ 262.435290][ T6742] kasan_set_track+0x4e/0x70 [ 262.439926][ T6742] __kasan_kmalloc+0x8f/0xa0 [ 262.444573][ T6742] dvb_register_device+0x2fd/0x2210 [ 262.449828][ T6742] dvb_register_frontend+0x649/0x930 [ 262.455168][ T6742] vidtv_bridge_probe+0x9ab/0xf80 [ 262.460243][ T6742] platform_probe+0x13b/0x1c0 [ 262.464970][ T6742] really_probe+0x25b/0xb20 [ 262.469514][ T6742] __driver_probe_device+0x18c/0x330 [ 262.474889][ T6742] driver_probe_device+0x4f/0x420 [ 262.479983][ T6742] __driver_attach+0x44e/0x6e0 [ 262.484968][ T6742] bus_for_each_dev+0x235/0x2b0 [ 262.489886][ T6742] bus_add_driver+0x340/0x630 [ 262.494652][ T6742] driver_register+0x23a/0x310 [ 262.499458][ T6742] vidtv_bridge_init+0x3d/0x70 [ 262.504347][ T6742] do_one_initcall+0x242/0x790 [ 262.509161][ T6742] do_initcall_level+0x137/0x1f0 [ 262.514168][ T6742] do_initcalls+0x69/0xd0 [ 262.518575][ T6742] kernel_init_freeable+0x3ed/0x580 [ 262.523832][ T6742] kernel_init+0x1d/0x1c0 [ 262.528297][ T6742] ret_from_fork+0x48/0x80 [ 262.532765][ T6742] ret_from_fork_asm+0x11/0x20 [ 262.537587][ T6742] [ 262.539946][ T6742] Freed by task 6705: [ 262.543960][ T6742] kasan_set_track+0x4e/0x70 [ 262.548598][ T6742] kasan_save_free_info+0x2e/0x50 [ 262.553673][ T6742] ____kasan_slab_free+0x126/0x1e0 [ 262.558838][ T6742] slab_free_freelist_hook+0x130/0x1a0 [ 262.564432][ T6742] __kmem_cache_free+0xba/0x1e0 [ 262.569771][ T6742] dvb_device_open+0x2ee/0x370 [ 262.574590][ T6742] chrdev_open+0x5cc/0x6a0 [ 262.579050][ T6742] do_dentry_open+0x8c6/0x1500 [ 262.583945][ T6742] path_openat+0x27f1/0x3230 [ 262.588591][ T6742] do_filp_open+0x1f5/0x430 [ 262.593130][ T6742] do_sys_openat2+0x134/0x1d0 [ 262.597858][ T6742] __x64_sys_openat+0x139/0x160 [ 262.602762][ T6742] do_syscall_64+0x55/0xa0 [ 262.607227][ T6742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 262.613162][ T6742] [ 262.615514][ T6742] The buggy address belongs to the object at ffff888141a57200 [ 262.615514][ T6742] which belongs to the cache kmalloc-256 of size 256 [ 262.629791][ T6742] The buggy address is located 24 bytes inside of [ 262.629791][ T6742] freed 256-byte region [ffff888141a57200, ffff888141a57300) [ 262.643736][ T6742] [ 262.646088][ T6742] The buggy address belongs to the physical page: [ 262.652558][ T6742] page:ffffea0005069580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x141a56 [ 262.662944][ T6742] head:ffffea0005069580 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 262.671924][ T6742] flags: 0x57ff00000000840(slab|head|node=1|zone=2|lastcpupid=0x7ff) [ 262.680036][ T6742] page_type: 0xffffffff() [ 262.684397][ T6742] raw: 057ff00000000840 ffff888017c41b40 dead000000000122 0000000000000000 [ 262.693025][ T6742] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 262.701729][ T6742] page dumped because: kasan: bad access detected [ 262.708180][ T6742] page_owner tracks the page as allocated [ 262.713927][ T6742] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17624242134, free_ts 0 [ 262.733779][ T6742] post_alloc_hook+0x1c1/0x200 [ 262.738604][ T6742] get_page_from_freelist+0x1951/0x19e0 [ 262.744191][ T6742] __alloc_pages+0x1f0/0x460 [ 262.748863][ T6742] alloc_page_interleave+0x24/0x1e0 [ 262.754106][ T6742] alloc_slab_page+0x5d/0x160 [ 262.758829][ T6742] new_slab+0x87/0x2d0 [ 262.762949][ T6742] ___slab_alloc+0xc5d/0x12f0 [ 262.767673][ T6742] __kmem_cache_alloc_node+0x19e/0x250 [ 262.773179][ T6742] kmalloc_trace+0x2a/0xe0 [ 262.777702][ T6742] bus_add_driver+0x162/0x630 [ 262.782438][ T6742] driver_register+0x23a/0x310 [ 262.787247][ T6742] usb_register_driver+0x206/0x3d0 [ 262.792404][ T6742] do_one_initcall+0x242/0x790 [ 262.797213][ T6742] do_initcall_level+0x137/0x1f0 [ 262.802199][ T6742] do_initcalls+0x69/0xd0 [ 262.806587][ T6742] kernel_init_freeable+0x3ed/0x580 [ 262.811835][ T6742] page_owner free stack trace missing [ 262.817259][ T6742] [ 262.819614][ T6742] Memory state around the buggy address: [ 262.825273][ T6742] ffff888141a57100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 262.833375][ T6742] ffff888141a57180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 262.841472][ T6742] >ffff888141a57200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.849572][ T6742] ^ [ 262.854462][ T6742] ffff888141a57280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 262.862655][ T6742] ffff888141a57300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 262.870758][ T6742] ================================================================== [ 262.887771][ T6742] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 262.895044][ T6742] CPU: 1 PID: 6742 Comm: syz.0.243 Not tainted syzkaller #0 [ 262.902379][ T6742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 262.912487][ T6742] Call Trace: [ 262.915823][ T6742] [ 262.918807][ T6742] dump_stack_lvl+0x18c/0x250 [ 262.923608][ T6742] ? show_regs_print_info+0x20/0x20 [ 262.928854][ T6742] ? load_image+0x400/0x400 [ 262.933409][ T6742] panic+0x2dc/0x730 [ 262.937355][ T6742] ? bpf_jit_dump+0xd0/0xd0 [ 262.942130][ T6742] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 262.947815][ T6742] ? dvb_device_open+0xca/0x370 [ 262.952732][ T6742] ? check_panic_on_warn+0x70/0xa0 [ 262.957904][ T6742] ? dvb_device_open+0xca/0x370 [ 262.962801][ T6742] check_panic_on_warn+0x84/0xa0 [ 262.967835][ T6742] ? dvb_device_open+0xca/0x370 [ 262.972724][ T6742] end_report+0x6f/0x130 [ 262.977022][ T6742] kasan_report+0x128/0x150 [ 262.981570][ T6742] ? chrdev_open+0x3e3/0x6a0 [ 262.986723][ T6742] ? dvb_device_open+0xca/0x370 [ 262.991625][ T6742] dvb_device_open+0xca/0x370 [ 262.996348][ T6742] ? do_raw_spin_unlock+0x121/0x230 [ 263.001595][ T6742] chrdev_open+0x5cc/0x6a0 [ 263.006076][ T6742] ? cd_forget+0x160/0x160 [ 263.010534][ T6742] ? fsnotify_perm+0x3ed/0x5e0 [ 263.015346][ T6742] ? cd_forget+0x160/0x160 [ 263.019802][ T6742] do_dentry_open+0x8c6/0x1500 [ 263.024623][ T6742] path_openat+0x27f1/0x3230 [ 263.029269][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 263.035293][ T6742] ? verify_lock_unused+0x140/0x140 [ 263.040561][ T6742] ? do_filp_open+0x430/0x430 [ 263.045309][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 263.051341][ T6742] ? __virt_addr_valid+0x18c/0x540 [ 263.056804][ T6742] do_filp_open+0x1f5/0x430 [ 263.061353][ T6742] ? vfs_tmpfile+0x490/0x490 [ 263.065993][ T6742] ? _raw_spin_unlock+0x28/0x40 [ 263.070975][ T6742] ? alloc_fd+0x58f/0x630 [ 263.075359][ T6742] do_sys_openat2+0x134/0x1d0 [ 263.080278][ T6742] ? do_sys_open+0xe0/0xe0 [ 263.084790][ T6742] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 263.090819][ T6742] ? lock_chain_count+0x20/0x20 [ 263.095715][ T6742] __x64_sys_openat+0x139/0x160 [ 263.100621][ T6742] do_syscall_64+0x55/0xa0 [ 263.105088][ T6742] ? clear_bhb_loop+0x40/0x90 [ 263.109806][ T6742] ? clear_bhb_loop+0x40/0x90 [ 263.114530][ T6742] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 263.120465][ T6742] RIP: 0033:0x7fd98b95cfce [ 263.124930][ T6742] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 263.144667][ T6742] RSP: 002b:00007fd989bd4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 263.153501][ T6742] RAX: ffffffffffffffda RBX: 00007fd989bd56c0 RCX: 00007fd98b95cfce [ 263.161519][ T6742] RDX: 0000000000000e82 RSI: 00007fd989bd4c00 RDI: ffffffffffffff9c [ 263.169536][ T6742] RBP: 00007fd989bd4c00 R08: 0000000000000000 R09: 0000000000000000 [ 263.177570][ T6742] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 263.185593][ T6742] R13: 00007fd98bc16128 R14: 00007fd98bc16090 R15: 00007ffe8b50ddb8 [ 263.193632][ T6742] [ 263.197266][ T6742] Kernel Offset: disabled [ 263.201606][ T6742] Rebooting in 86400 seconds..