last executing test programs: 14m28.292991742s ago: executing program 2 (id=837): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000002280)=0x6) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0x80080) 14m28.113687227s ago: executing program 2 (id=839): syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x32, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) r2 = memfd_create(&(0x7f0000000180)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xaaSc\xf3]WhI\xf4\x89\x85!mPl\x90\xa5\x93\x19\f\x9a\xae\xd5a\x9bU5\x1a\x86\x9d)5y\xef\x90\xea5\x81\xfeO;\xd4zh?\xbdW\xe0\x84\xe6\x9d\xcb\xcd\xb6\xad3\x7fWY\x02\xa2\x8baG\x00\x0e\x8e/\xc1\xaf\xd0\xbcH9\x04\x00\x00\x00z\x16\xdf\xf3hLpLaA\x89n]>,^M\x82\x8e\xe40\x97_\x809y)Z\xeb\x9d\xbawv\xe9\xc0\x16\xdc\xf5\xcb\xdb\x96\xd6\xba@\xa7\x1bl\xca\xe0\x1e3\x81\xc6S\x86\xf7\xf0\xba\x1b\x14N\xa2\x04\xdb\xb5X\xe4y\xef\xe8\xdb\xd5r\x11\xfb\xe4v\xbcV\xbb\x00\x96CR\xe0~5\x16=:A2\x9c\b\xd9\xa0CB\r\xe9\xb8$\xfe\x8d\xb1Gg\xa9\xac<\xbf\x10]\b9\xd9\x89\xaf\xa6\xd1\x10\x1fq\xba\x06_NW\xdb67Xv(\xa8\xce\x1b\xe6\xbd\x947\x8f)8\xe5\xb3\xac;\x7f+\xf67\xea\x1ei\x92w-)\xa1B/M\x0e7:9\xdb~V\xb7\xd5\x13^v\x14\xe6O\xea\x00\x87\x8dkG\xdf%\xebe\x83\xb97\x01| \xb3\xd8W\xe8o\x17\x97\xd9\x14o\x92\xb9\x9a\x8c\xd7\xcf\xa2\x11\xc3\xa5\xb3\xd2\xdeQ\xa7\x05\x7f\x99Lq(\xcd\\\xa2y\x14or\x1efn\xf2\x97\x96c\xda7\t,', 0x5) ftruncate(r2, 0x0) 14m26.656972462s ago: executing program 2 (id=841): r0 = add_key$user(&(0x7f0000000140), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f0000000000)={r0, r0, r0}, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r3 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x14, 0x2, 0x0, "11010000001400000100b64c0000000f4cb85200000400", 0x30314442}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) r5 = eventfd2(0x43, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1010, 0x89, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000000)={0x1, r5}) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r6, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_LNS_MODE={0x5}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000800) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f00000005c0)={0x0, r5}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) 14m24.972163244s ago: executing program 2 (id=848): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0x2, 0x0, 0x5, 0x4, 0xdd9, 0x2, 0x8, 0x8000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0xc042) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e000300002400240000ff8807c2fb7fe0406e52534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 14m23.863694011s ago: executing program 2 (id=852): setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./config\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a1\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x2, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="0100000000000000000040f7eca4d7"], 0x40) write(r2, 0x0, 0x0) symlinkat(&(0x7f0000000340)='usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000380)='usb_gadget/g1/configs/c.1/ecm.usb0\x00') nanosleep(&(0x7f0000000440)={0x0, 0x1dcd6500}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000004c0)={'syzkaller1\x00', 0x1}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000005c0)={'syzkaller1\x00', 0x0}) bind$packet(r5, &(0x7f0000000600)={0x11, 0x300, r6, 0x1, 0x0, 0x6, @broadcast}, 0x14) write$tun(r0, &(0x7f0000000640)={@void, @val={0x2, 0x80, 0x4000, 0x5, 0x7ff, 0x57c}, @ipv6=@udp={0x7, 0x6, "c42d2f", 0x1104, 0x11, 0x0, @remote, @remote, {[@dstopts={0x3b, 0x0, '\x00', [@enc_lim={0x4, 0x1, 0x8}]}, @routing={0x0, 0x10, 0x1, 0x7, 0x0, [@mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @rand_addr=' \x01\x00', @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2]}, @srh={0xe6, 0xa, 0x4, 0x5, 0x7a, 0x60, 0x3, [@dev={0xfe, 0x80, '\x00', 0x33}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @mcast2]}], {0x4e20, 0x4e22, 0x1014, 0x0, @wg=@data={0x4, 0x7, 0x0, "fff7941273a459432a58a0d2b151f30c7c8cb61f5f51a3fd2cd4921dbbc417822ffb3af5e4a45de8fee649ade182fa998209ea938d8b727ce43c9cdf7a9eb21b2f3da531639964d91f902e52099bfc3a6eac9bf15c40bc57ee2227546a3d76272cbdda730b3b87db5ebec307597ce8bdcb2690fe95bfa8d2a4851488a079c62827caa90777a8e2aa9a356d160c7e66fadb9bd0622d27ed3338ab43cbc6edc145a82d9bd5738d39f91080eec0cd496aa93078edf555d34a0584314e9a9edffa3bd105fb0e6a3d10a6e2add87cedf9b6004f03b6c4af76888724bd273ac64098ff22530a738b7a0f720014913fb6c028dc63db3ff1e0e4738db68a73f0456d14d8909e409cfeb9413563b69f3e20581be59434c7e0c906cd9ad51bc0144dee8a24560550c155976520d3842c7b9c5fd6e76668a3246faea544c224bec826a86b60edecf6382134dad0d8c705d09d4e300ed066598caa01becfa8143a7fc89ca8c2866b78ec8884c54ab4ccf23ed7d1507483c2eba2becca084e27720c4b75a40d2aad14bfbcf18ef7b70b4a696ec0c4a9bae61d766cb02f4ecd52f04acba3313dbbd4bb165cd6401ccc4c34da25d5ddb99b0c77cce00be74a2bd3dafe6ab2f9894a390b8a96582f0990d3583450c3599175597faf22cb9c01b4481065d1ec92d74719be2c15602647f6db75045dc65320a706b2d44733dff5446f60e1821019b9475f94293a78e8ee0473fcf90391cac6092680a804f3226ed94c95e8d8a8d67d4ab68f830c4c49b74c9cfc73af87c888cbf1adda97cc6b753fc9ea784dcf3f1ee693b6e6bbeabec379683ddda06f2810d48f88160579564baea90bd29b2f73e2f056578cc300345e82748e6ecd0bba9244f3c8ad83d2b81f21f46e9ae02ee537f6fbdb8cf461bb59f6b2b240246b1f4c2dc9464d9864194d3b80c9420359e277ad953933aff30db147c03810d47b76d8188593d0ea689bcefeeec17b8e0d38407568b3a8809879ad2618145096293ed63bb338e4d680d54941e21bd23bfd35dc1e1ff9e719a0f635a50b19813dc85c3080f41fd0fe943369c2ab08317329daadb370c41a1d2ad370fd435b7dc618baacb0c62ee9766f293121296da6d7034587d658e7675be60d8099b6c464b86408db6d7622ca8a74c4bbf31f10a8d7b907baae0c98e69238b39b7688dde5d4405d055c9a82c4f4f3139a3c1097323471acb11ac88957f1999cac77089cfde82cdddd364cd4542d3fe9e1a04e75c33da5be0ff2a9ffedf70a24c54774cc2850dd8d6bae812e2287deb6077c329f44babb112e1afd2cc850e61126d9bbddd316f65adf8e133e03d3cbdff8328b68249aaef7af4ed0145c5926cd370bbe12bee8a304707c9422df855a90c7c498146fc63a2659735072e5e665889c449c5b8a9300a6e0b22b8656a748ffb3989555e5346ef608154c1a7ca74ea10fb5f7852e0750e365ba2b4da42604650f54d831b620cfa204d5bc50b541a568ba04795dce6a30a4bae146080a22f7e7b1c8ba2ca6414b4b5ff52b92483aa0bcbb8778237e6f2ae9aec160d0e02a723df80ae76a5ff5edf99454e0c3bd3ddde1281e2909aad40f47b5e79b709e5b140875e91cf16596be9a2893c5dfd0a066f7368eacc2254af63e89f1a08497aa627f649f21ed09e79ffc73ff5577da0d46a22f6fba104fb3d2cbf5bda3032241b731bfcfe58e68f29ae95b35e5900104181a627cb0ea253045314c93177d983f1135ef2b7a5902dddddb0b6c5821174140a4877a86e848dad5865412b99e0b59ffb2b41d1dde6ed485885485fb6f3659a4fa4773c0b62a50ab471e9db91d04d5430daffe8773032b4f9158de6dd3de4c9fa18b177928c7ef5f95ddb80ea1374616febaac204b99cb900cb2cadb3d11bb193d8ccce23b5a7e9d8bdc5404fc90ec7e0a8f669fa9a6a849d8ad2f857afe0afde32b3b66553078b09aba6a83da4a1c570f02417bcfe0ae19871e1ecf02dc8458a4922cbd71a9d9af9a079eb6805a556522ea559f5599ee52b0dc869a9716d05dfdf5ed6d07b14a4495491e722a7cdd20d0de3ff6fc54c15093d6ce36faf4cbee63b8c85cd37685d0681f980a39bd30fe09cab0f28427dafe5533f682f564a263d68d53f792a9e05b39799c8a7aa8f5f74820ca19db92f3fbf391413f81fee17b169c7ffaf0f5552f550667b3ff42f229ad2cc2ebf540c9585a85eea215762b927a196e01366ba63fb01dfcf14d6928ed6766233bd8ef0215b9092e2af4879ccea34346f7aaeeaa7280ceee5121d45abadcc62212c77fc964a5a1187e71a3ef9d7db086ebcda0f78bbf92c87d3990f2700d38037d2c86001ab57076cb391bef8511137baf3a3a1152c4685416d925c46c0a7d5c5963c2f514ff8f2330fecb0b0220ba52891dc4c4c801723d677ab1990e55f8dd57cd0daf33e8ea39d23f584abe48eef74991c05409167b723ed54608c4645cc5c9c26a352ff8fbe577eada14383488777327df2e097846e47b2a9fd721c865af30f18a39ecdf28df046487ef9826b7daea698f75bff1a1344461d3b6133ae671fe63f3803e8a8aec07b5036b1c9c29edbd1125960aa4ed9d6c4a44876171a583b7140439813b2c661e188ea9cd74d1fd0b74a3c48869dbc2cc364e874f82c06125667f6422c706ba5d877b8954f25096d84d281b0083436a357356e6fd3d6c37f9fee8e098d49df0ac4b7630940b14a12c450be595f87d8f27f28f22ee4fbd33c74905da2e159f439138844f01f8d75f97a3d26080e153942fc1db3905918749fc3fb60ead653107a85585bf7c39816f329835be39fe436e042c5bbf59b09a5ac73a4fe9eb27254a750b69aebd66910a47739c19cf3797b275c2304f37129a27cd1d0621ded5fed17b91fafdc527a5d2b6f23bcedf25edaaf97131a8c07666aed74f2ae00996bfe83f492dc219cbf3334574f9d3f85e229525b4f60164d74d1c71d4ec23eb4eab7092d0fca85dfed59d1660f46f730ac7b6e0b71e75f1fe4efbc89e78afc829bb1b44cb17b9addbf2bb521abbaec9393ebab9a089a53681c53c8c291680659671f57fabaee96106ab7d6e659528a0a6c19f3e056463980a2e508a1b57119eaf26a873af9f5dd62186b4dea5e3785aecf3f07575933f1bc81aea27077d47063209c215d3b168a6c6187307ad3741be303dae31494805bcb43d0e8bb8985073ba651ea7200bd0d06d3c4994f14b92ae537b4c13aadfc5b92ac2ea7e0a78b1195e6ac8b130cd426ff175134581e1de335113665c3d2b0943ce050d9fb4917fb7b96fcfda41cbfff1af6da040a7a333f67508eecd8551f2266691bcf5bfaa29dcf4339a700fd92e35fd5ec04440f2f59c3223169b32a81e70c39e069ea0aad13eabd9dc2b68a6b69ca9d9395558142891796e0f7d28713ae4844df12f45aafa295425367fbd0b9641507f725db1bf11355323de3fc423105b168a6281729f2653dd1cefa7bcbf31d879f729d52defef8b6a61e2dec236dee0a682bc1b5e1a164f61a75177f10ee8217c5ef3375f228dca599c3f456ccaaea6130e1261f09dc0164c30e9f9b779dc00d1556943879e2e48e1398d012652fa108d90f3829adb79a84d971c7497e9d1ce808a5a9e406af9a26cf29a9a9c69d2d3f73b7152fb908f436458bbbbd1fca732d52d3795d572db6dfb2763ec260115b09c0a34da90818e5b2bbf7dfa27240f68b770d93091c9795164a6a96cb04f1040d0251bdd5a72d1db9b03aeb896207d3626965508ca7f7a072c46c35d5d11672cf358a07870381dcf41519d48aaea9b06e7c793661929a3484be94afb65be707d9e7ce15749d5aa5fd0c3b6bf3c7c810f30b3a0c385d212212b83fd96c632a1201765cfc84dcda8094675b6bdf68bd4bad361d4d6c6fce34f7e2c50f201963569e6b8eb1c4ddf98144c4f1beae4463ba551806c7807193e76e7eb7eef5e2b01d62f31df74aaa93ccd7f99ad3c9084291ba7427fa976133666ac3e0c8207d70599d97aa1520b97713bbc3f086e4c051098fc7a431e9a4d5ecf81129a0503d7b95b7fe3b8f02e25e685d319de93f806e172ecd5af2626233fd1d667d328c9fcdd2a2b91eee3a952d2c7cc3d67da39f2bf01c5e36aadbf28a622eef16febe39f744b4b2426199a4a273366ec1115195d13069aa399581bb43e92c8302f229a9d10f198a4cd431032f6978be6694ac483f47dcc5ec1225a3f71ec82f76ee9575aed44ad4742517e5710bdfaf7bf664d8cdf4af950bb17dc766f116745f2df2f21706908d4812a71c1163764b49c1e0da7e795d96906acdb5f04eb382a8ed00e04a1423fb401df072d7d1b83d7932b9e9ff37bdd49070d548a34973f52687f637f64cf9e535dcdc38c52981dfdb5fd90e00881f8cca1f0748961cad7eb747528faab23970edc33bc5a63aaf06b0c517edfd89ab0d937308e5c7ed7bf501b04e6e2277f13e0684a01afdb8d78e2dc6b029bbb6da476203f5ea2f54fba56c7f4440cd6b63d3746663e4e7c0a7baabd31d89ad2597872ba0b9c65a8225adac847262f0daf10cf8e29d9aa0f5a52462a46469a05c87271d55f0c89946b4e35431999d4c4c492e83c1ba52c1b0ce031a00519d49103daf2401cc0e86e3cf4be550c87a4b9d293a9c93b5ffa35b073048e9dc9ba2868209c4a9a4415196210bfaff1dc7e257612bab0407275bee5befed9bb4c8f03d205d08797b1295e98af816e596e4fb01ae19d1154db0c937b1ce6006efb482a4831732a24baa6dbd0c47effb793c659ef3ae3d8ffd00c9dae19e3d668cb54affca40376d34cfad14b866f5a6a7c80b607cc905dd1e9bb19ee616c8cbb891ffdceb18399de5d380687bb8574e432183594e855d83bc6cfdea17ec2b503f954a5c3207055d0a38d1dfd1d05afb11981e6423d2162e83172eb7b3c296ec04e07a1fa84bff5a45d198be5b2256ef44323c4316a51558ea1df415098a61f7d1c48d68ab7fd85fb444b5efa0e402d93a49e1fdc38011bda56f81bc51915d36e69aaab44762cf1e4ff8e8cfde0a227293adabbc11ceddf5add4abc95487a0a7485d0ebe1c4d3ed1a8fe45241dd2de8210629d3a1295821f5eec1d749905ef7abe63d8ab96bacb4fdcb4a2e0ab11fc53f907ba1232cb2adabe5d0de4095508cfd6f8b6c23583180a44ee4f7d5c898b3d46d7ca6dfb0b5e28e00ca066513199af8fa700c9350d3ada25c1e525940d9dbf03afdef9c221f415d6aafc01485718305d44aaa3e519a564cc5289ab69ce347edfe94884cc1fcb4023b07280e5829571e90f22ca71b7461f134b05aaadb572e45a27576b5daecf9f74438a6f4d89e90719ffe9168a79a90a421a71f0ba7509a5389e2ff13c20e53c439b055caa4bb81f62e76e7884ef21ca8400f2a76afe15cf99d6749cc040456db8efed8df341ae87dc340a32e32f24cebd461a60aca9b9394494a957eda00ef82369af142838d2301f5973daea36974f2de4cfecc07e56b7f5090101e5334d804e7f0fa910f4fad9ee9b8d3c1cf675cf1c10f42fef04552696b84f18eee1871f32a0ddaa6d4a2440063615ebcb0384da3a75f62a5e681630938aa8aee20622878beef897f4f5148d7385536111f5c340bf436808483753926dc2e29d5123a8a265952d6a49a635c03429e912c5048d000fd0c52ae7da283d3af56f9e93779464bbc5eaecc076812b755a034283964bb572f5ac0527a4d82d299c58379ce7fc6677400589dde6c6493b82fb61f9417def74147ad62d0547cab8814c924b9b1da4e2b2b8"}}}}}, 0x1136) ioctl$TIOCL_PASTESEL(r1, 0x541c, &(0x7f0000000100)) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x8002, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70400b400000000850000001c000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f0000000440)={'adq12b\x00', [0x300, 0xc0000000, 0x2, 0x400, 0xe, 0x800005, 0x7, 0x6, 0x8, 0x56, 0x2, 0x1, 0x8001, 0xfffffffc, 0x10000b, 0x0, 0x5, 0x4007a, 0x3, 0xf4, 0x89, 0x0, 0x7f, 0x3000000, 0x5, 0xe65, 0x1, 0x2000004, 0xa6b3, 0x0, 0x5]}) 14m22.305650719s ago: executing program 2 (id=860): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0x2, 0x0, 0x5, 0x4, 0xdd9, 0x2, 0x8, 0x8000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0xc042) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e000300002400240000ff8807c2fb7fe0406e52534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 14m6.941413105s ago: executing program 32 (id=860): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0x2, 0x0, 0x5, 0x4, 0xdd9, 0x2, 0x8, 0x8000}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0xc042) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e000300002400240000ff8807c2fb7fe0406e52534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 1m44.015621443s ago: executing program 3 (id=2983): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0xc0c00, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f00000002c0)='source\x81\xfc{\x00\xa8\xfe\xf8\x1b\x98\x12:Hr1\xf0\xd4\'h\x0fh1\xab\x9cV\xc1\xe8\xbe\\\x02s*\x8d\x1dNR1\xc4\xc0\xb9\xab\xcau\xf3\x02\xd5=\xd0\x01', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000100)=0x3) unshare(0x68040000) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x4, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa}}}}}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 1m39.255326049s ago: executing program 3 (id=2993): socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000400)={@cgroup=r3, 0x3, 0x1, 0xa, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f00000003c0)=[0x0]}, 0x40) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000140), 0x10) timer_create(0x0, &(0x7f0000000040)={0x0, 0x3f, 0x0, @tid=r1}, &(0x7f0000000080)) ioctl$SIOCGSTAMPNS(r4, 0x8907, 0x0) sendmsg$can_bcm(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="050000000300000000000000", @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) read(r4, &(0x7f00000018c0)=""/4115, 0x1013) process_mrelease(0xffffffffffffffff, 0x1000000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) 1m36.401220528s ago: executing program 3 (id=3000): ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = io_uring_setup(0x18a6, &(0x7f0000000100)={0x0, 0x4225, 0x80, 0x1, 0x122}) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0xf4000000}) 1m35.265912345s ago: executing program 3 (id=3003): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) timerfd_create(0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x7) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x842d80, 0x0) ioctl$PTP_EXTTS_REQUEST2(r3, 0xc0403d11, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) syz_emit_ethernet(0xaa, &(0x7f00000003c0)={@local, @empty, @val={@void, {0x8100, 0x4, 0x0, 0x2}}, {@llc={0x4, {@llc={0x0, 0x8e, '@', "e3ec04c8a5e3420f2a8709186d9f33b0c1b6ba677d6f3b3ccd59aecc7db33a1bb26640340fd094b8885d33e3dca7dc00a43fe368af53eeaec5af32275573f88dd6a8d3b99ad4c63712b62c571613263ec4f1e44c12404ca3484e82c23719ea9875d7c38124e6ae0ab3953f07862788da255b896abe575c2368c80368a15c160c5ebba8e2524a51568cdd95b2883f677e677bed34b8"}}}}}, 0x0) socket$inet6(0xa, 0x80002, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) 1m33.651616255s ago: executing program 3 (id=3004): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x4682c0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000009b80)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a90000000060a010400000000000000000a0000040900010073797a310000000064000480340001800c0001007061796c6f616400240002800800014000000001080003400000004f080004400000003808000240000000012c0001800a00010072656469720000001c000280080002400000001308000340"], 0x6c1c}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r2], 0x20}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r5) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x100000) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100), 0x111}}, 0x20) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 1m29.442282597s ago: executing program 3 (id=3014): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2c0, 0xffffffff, 0x130, 0x130, 0x98, 0xffffffff, 0xffffffff, 0x228, 0x228, 0x228, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@ip={@private, @multicast1, 0x0, 0x0, 'ip6gre0\x00', 'tunl0\x00', {}, {}, 0x6, 0x0, 0x60}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@rand_addr, @remote, 0x0, 0x0, 'ip6erspan0\x00', 'wlan1\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@set={{0x40}, {{0x4, [0x2, 0x4, 0x4, 0x5, 0x6, 0x4], 0x6}}}, @common=@socket0={{0x20}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, 0x0, 0x0) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) tgkill(0x0, 0x0, 0x2b) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x80, 0x8) write$tun(r5, 0x0, 0x107c) read$FUSE(r4, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000400)='./binderfs\x00', &(0x7f00000003c0), 0x200000, &(0x7f0000002880)=ANY=[@ANYBLOB='=']) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet(0x2, 0xa, 0x10) mount(0x0, 0x0, 0x0, 0x6004, 0x0) 1m13.980320143s ago: executing program 33 (id=3014): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2c0, 0xffffffff, 0x130, 0x130, 0x98, 0xffffffff, 0xffffffff, 0x228, 0x228, 0x228, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@ip={@private, @multicast1, 0x0, 0x0, 'ip6gre0\x00', 'tunl0\x00', {}, {}, 0x6, 0x0, 0x60}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@ip={@rand_addr, @remote, 0x0, 0x0, 'ip6erspan0\x00', 'wlan1\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@set={{0x40}, {{0x4, [0x2, 0x4, 0x4, 0x5, 0x6, 0x4], 0x6}}}, @common=@socket0={{0x20}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x320) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, 0x0, 0x0) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) tgkill(0x0, 0x0, 0x2b) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(0x0) splice(r4, 0x0, 0xffffffffffffffff, 0x0, 0x80, 0x8) write$tun(r5, 0x0, 0x107c) read$FUSE(r4, 0x0, 0x0) mount$binderfs(0x0, &(0x7f0000000400)='./binderfs\x00', &(0x7f00000003c0), 0x200000, &(0x7f0000002880)=ANY=[@ANYBLOB='=']) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet(0x2, 0xa, 0x10) mount(0x0, 0x0, 0x0, 0x6004, 0x0) 19.238407413s ago: executing program 5 (id=3177): setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000280)=[{0x20, 0x4, 0x9, 0xfffff038}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r1, &(0x7f0000000980)=""/69, 0x45) 17.216324752s ago: executing program 1 (id=3182): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000180)={0x40, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14.164273026s ago: executing program 5 (id=3189): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x0, &(0x7f0000000140)='compr=none\x00') close(0xffffffffffffffff) r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) gettid() r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$panthor(0xffffff9c, 0x0, 0x2, 0x0) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) bind$inet6(r0, 0x0, 0x0) syz_emit_ethernet(0x9a, &(0x7f00000003c0)={@link_local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1b00", 0x64, 0x11, 0x0, @local, @mcast2, {[], {0x4000, 0xe25, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "1983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4b", "b6af91bfb69252b136c8f50eaee89ebe", {"26e39726e261b1997fe90de7841c2e1f", "8def4140df2b9c11e876f120f5f7bfc5"}}}}}}}}, 0x0) creat(0x0, 0xa) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, 0xffffffffffffffff) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x3, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x42, 0x1ff) 13.044649023s ago: executing program 4 (id=3192): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000002c0), 0x0) write(0xffffffffffffffff, &(0x7f0000000380)='2\x00', 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r0, &(0x7f0000000440), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r1, &(0x7f0000000540)='2\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r3, &(0x7f00000006c0)='6\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000780)='2\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_num_groups\x00', 0x1, 0x0) write(r4, &(0x7f0000000840)='6\x00', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, 0x0) 13.033644583s ago: executing program 5 (id=3193): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000002c0), 0x0) write(0xffffffffffffffff, &(0x7f0000000380)='2\x00', 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r0, &(0x7f0000000440), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r1, &(0x7f0000000540)='2\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r3, &(0x7f00000006c0)='6\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000780)='2\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_num_groups\x00', 0x1, 0x0) write(r4, &(0x7f0000000840)='6\x00', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') 12.869004907s ago: executing program 4 (id=3194): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) memfd_create(0x0, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x40106183, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 12.801156139s ago: executing program 5 (id=3195): syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b00010000000109040100"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) pwritev(r0, &(0x7f0000000e40)=[{&(0x7f0000000980)="1d", 0x1}], 0x1, 0x7fff, 0x1) 11.283377726s ago: executing program 4 (id=3196): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) signalfd(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0xa, 0x9, 0x3, 0xe4, 0x40, 0x2c, 0x0, 0x30, 0x19, 0x7}, {0x41000, 0x54000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x8, 0x58, 0x3, 0x3, 0x1}, {0xdddd1000, 0x3000, 0xe, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0x6000, 0x8000000, 0x3, 0x5d, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x7, 0xe}, {0x0, 0x9000, 0xb, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0x10, 0xa0, 0xb1, 0x8, 0x1, 0x2, 0x80, 0xf, 0x1, 0xfd}, {0x3000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0xd000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x18, 0x2, 0x3, 0x7, 0x9}, {0x100000, 0x2d}, {0x10000, 0x86}, 0x80000031, 0x0, 0x8000000, 0x42024, 0xb, 0x1, 0x3000, [0x6840000000000000, 0x3, 0xef6, 0xff]}) ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f0000000040)={0xc000, 0x4, 0x5, 0x7, 0x6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x4, 0x800}, &(0x7f0000000080)=0x8) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r5, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port0\x00', 0xa3, 0x1b1c07, 0x0, 0x0, 0x1000}) readv(r5, &(0x7f0000000080)=[{&(0x7f0000002600)=""/46, 0x2e}], 0x1) close_range(r5, r5, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r5, 0xc0bc5351, &(0x7f00000000c0)={0x31, 0x0, 'client1\x00', 0x6, "fd318f59fd26a98d", "e1f174d7edb652e68dc3cea58ac1c780531ff3d3d263992b8f88c74b210faf9f", 0xfffffffc, 0xfffffffc}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 11.203830988s ago: executing program 1 (id=3197): setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x3, &(0x7f0000000280)=[{0x20, 0x4, 0x9, 0xfffff038}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r1, &(0x7f0000000980)=""/69, 0x45) 8.582256322s ago: executing program 5 (id=3201): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'batadv0\x00', 0x0}) r1 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="05a300000000000000000d00000008000300", @ANYRES32=r0], 0x1c}}, 0x20088c4) 7.103981698s ago: executing program 1 (id=3202): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100)='jffs2\x00', 0x0, &(0x7f0000000140)='compr=none\x00') close(0xffffffffffffffff) r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) gettid() r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$panthor(0xffffff9c, 0x0, 0x2, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) bind$inet6(r0, 0x0, 0x0) syz_emit_ethernet(0x9a, &(0x7f00000003c0)={@link_local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "1b00", 0x64, 0x11, 0x0, @local, @mcast2, {[], {0x4000, 0xe25, 0x64, 0x0, @wg=@response={0x2, 0x0, 0x2, "1983426a97e3503bbbc12ef01ae488918c1ea89a08a25f78de9f802d2628cc4b", "b6af91bfb69252b136c8f50eaee89ebe", {"26e39726e261b1997fe90de7841c2e1f", "8def4140df2b9c11e876f120f5f7bfc5"}}}}}}}}, 0x0) creat(0x0, 0xa) r2 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f00000005c0)='fd', 0x0, 0xffffffffffffffff) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) rmdir(&(0x7f0000000280)='./file0/file0\x00') syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000700)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x3, 0x0) unlinkat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x42, 0x1ff) 7.018616809s ago: executing program 4 (id=3204): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0e\x00\x00\x00\x00\x00\x00', 0x6) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x200c8100, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x40106183, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) 6.950522411s ago: executing program 0 (id=3205): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000002c0), 0x0) write(0xffffffffffffffff, &(0x7f0000000380)='2\x00', 0x1) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r0, &(0x7f0000000440), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r1, &(0x7f0000000540)='2\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='2\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r3, &(0x7f00000006c0)='6\x00', 0x1) write(0xffffffffffffffff, &(0x7f0000000780)='2\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_num_groups\x00', 0x1, 0x0) write(r4, &(0x7f0000000840)='6\x00', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') 6.894275923s ago: executing program 5 (id=3206): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x4682c0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000009b80)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a90000000060a010400000000000000000a0000040900010073797a310000000064000480340001800c0001007061796c6f616400240002800800014000000001080003400000004f080004400000003808000240000000012c0001800a00010072656469720000001c00028008000240000000130800034000000029080001400000000e0900020073797a32"], 0x6c1c}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r5) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x100000) syz_clone(0x20000, 0x0, 0x0, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100), 0x111}}, 0x20) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 6.802829455s ago: executing program 1 (id=3207): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x44, &(0x7f0000000180)={0x40, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.59251334s ago: executing program 0 (id=3208): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448e0, &(0x7f0000000000)="a2cf747f43d3") 6.471760593s ago: executing program 0 (id=3209): syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b00010000000109040100"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) pwritev(r0, &(0x7f0000000e40)=[{&(0x7f0000000980)="1d", 0x1}], 0x1, 0x7fff, 0x1) 5.643066723s ago: executing program 4 (id=3210): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f0000000040)='syzkaller\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r1, &(0x7f0000000980)=""/69, 0x45) 5.562292925s ago: executing program 0 (id=3211): socket$pppl2tp(0x18, 0x1, 0x1) r0 = syz_open_procfs(0x0, 0x0) newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000002a80), 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) ioctl$BINDER_FREEZE(r0, 0x400c620e, &(0x7f00000001c0)={r2, 0x0, 0xd}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000180)=0x204, 0xffffffffffffffcc) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) write(r4, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f798032ed4237ad618305d0bffb28dac3b13bd148e2d7e8798ce2deb330ec7cdfdc5cddd477f3ffd22b884e91529740da75f625d46b48a6aa4c40adced23638423cdc401bdd228b0590432be970bd3c9c7b2a6ee3dabba57022a222a4b012ef17e0385b92f034fe82ff530fddd4285581275eecee8a722e309654717a604b740ca6dbc00e7c878d6dd35f55413fc7", 0x488) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffd}}, 0x2e) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x3}}, 0x26) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r7, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r7, 0x40047435, &(0x7f0000000200)=0x1) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x10, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) 4.578258169s ago: executing program 0 (id=3212): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040), 0x24000000) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, 0x90) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x200, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$tipc(0x1e, 0x5, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) pselect6(0x40, &(0x7f00000001c0)={0x8, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x20000000009, 0x5, 0x0, 0x1, 0x9}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) 3.350787109s ago: executing program 1 (id=3213): fcntl$lock(0xffffffffffffffff, 0x24, 0x0) openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) signalfd(0xffffffffffffffff, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0xa, 0x9, 0x3, 0xe4, 0x40, 0x2c, 0x0, 0x30, 0x19, 0x7}, {0x41000, 0x54000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x8, 0x58, 0x3, 0x3, 0x1}, {0xdddd1000, 0x3000, 0xe, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0x6000, 0x8000000, 0x3, 0x5d, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x7, 0xe}, {0x0, 0x9000, 0xb, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x83}, {0x1000, 0x80a0000, 0x10, 0xa0, 0xb1, 0x8, 0x1, 0x2, 0x80, 0xf, 0x1, 0xfd}, {0x3000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0xd000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x18, 0x2, 0x3, 0x7, 0x9}, {0x100000, 0x2d}, {0x10000, 0x86}, 0x80000031, 0x0, 0x8000000, 0x42024, 0xb, 0x1, 0x3000, [0x6840000000000000, 0x3, 0xef6, 0xff]}) ioctl$KVM_TRANSLATE(r3, 0xc018ae85, &(0x7f0000000040)={0xc000, 0x4, 0x5, 0x7, 0x6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x4, 0x800}, &(0x7f0000000080)=0x8) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r5, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port0\x00', 0xa3, 0x1b1c07, 0x0, 0x0, 0x1000}) readv(r5, &(0x7f0000000080)=[{&(0x7f0000002600)=""/46, 0x2e}], 0x1) close_range(r5, r5, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r5, 0xc0bc5351, &(0x7f00000000c0)={0x31, 0x0, 'client1\x00', 0x6, "fd318f59fd26a98d", "e1f174d7edb652e68dc3cea58ac1c780531ff3d3d263992b8f88c74b210faf9f", 0xfffffffc, 0xfffffffc}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 182.401606ms ago: executing program 4 (id=3214): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/class/net/bridge0/bridge/multicast_snooping\x00', 0x1, 0x0) write$binfmt_format(r0, &(0x7f0000000040)='0\x00', 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000003"], 0x48) close(r1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xba7e}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(r3, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r6) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x30, r7, 0x1, 0x900, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x30}}, 0x0) 152.507997ms ago: executing program 1 (id=3222): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, 0x0, &(0x7f0000000040)='syzkaller\x00'}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000002c0)={0xd, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x1000000000a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r1, &(0x7f0000000980)=""/69, 0x45) 0s ago: executing program 0 (id=3215): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r0, 0x6, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r0, 0x40089413, &(0x7f00000000c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x2) prlimit64(r1, 0xb, 0x0, &(0x7f0000000180)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) kernel console output (not intermixed with test programs): -1: USB disconnect, device number 26 [ 859.847716][T13852] jffs2: notice: (13852) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 859.932010][ T28] audit: type=1800 audit(1787234428.611:115): pid=13852 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2234" name="control" dev="configfs" ino=36183 res=0 errno=0 [ 860.178376][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 30 seconds [ 860.191564][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 30 seconds [ 860.203309][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 30 seconds [ 860.215446][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 30 seconds [ 862.388753][T13886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 862.440966][T13891] jffs2: notice: (13891) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 862.564131][ T28] audit: type=1800 audit(1787234431.261:116): pid=13891 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2244" name="control" dev="configfs" ino=36253 res=0 errno=0 [ 862.672050][ T27] usb 2-1: new full-speed USB device number 50 using dummy_hcd [ 864.654384][ T27] usb 2-1: unable to get BOS descriptor or descriptor too short [ 864.812540][ T27] usb 2-1: not running at top speed; connect to a high speed hub [ 864.834134][ T27] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 864.842682][ T27] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 864.851244][ T27] usb 2-1: config 14 has no interface number 0 [ 864.860093][ T27] usb 2-1: config 14 has no interface number 1 [ 864.874970][ T27] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 864.897255][ T27] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0x1B, skipping [ 864.938907][ T27] usb 2-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 864.949913][ T27] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 0, changing to 10 [ 864.961237][ T27] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has invalid wMaxPacketSize 0 [ 864.971664][ T27] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 864.992350][ T27] usb 2-1: config 14 interface 57 has no altsetting 0 [ 865.002056][ T27] usb 2-1: config 14 interface 228 has no altsetting 0 [ 865.021736][ T27] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 865.043266][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 865.051675][ T27] usb 2-1: Product: syz [ 865.076290][ T27] usb 2-1: Manufacturer: syz [ 865.081224][ T27] usb 2-1: SerialNumber: syz [ 865.538692][ T27] legousbtower 2-1:14.57: interrupt endpoints not found [ 865.760037][ T27] legousbtower 2-1:14.228: interrupt endpoints not found [ 866.290332][T13924] jffs2: notice: (13924) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 866.416609][ T28] audit: type=1800 audit(1787234435.081:117): pid=13924 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2253" name="control" dev="configfs" ino=37116 res=0 errno=0 [ 868.026820][ T27] usb 2-1: USB disconnect, device number 50 [ 869.142046][ T27] logitech-hidpp-device 0005:046D:B012.0017: Device not connected [ 870.157914][T13964] jffs2: notice: (13964) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 870.418430][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.425464][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.144124][ T28] audit: type=1800 audit(1787234439.811:118): pid=13964 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2263" name="control" dev="configfs" ino=37194 res=0 errno=0 [ 873.412318][ T27] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 873.484480][T14004] jffs2: notice: (14004) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 873.539422][ T28] audit: type=1800 audit(1787234442.231:119): pid=14004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2275" name="control" dev="configfs" ino=37256 res=0 errno=0 [ 873.632165][ T27] usb 2-1: Using ep0 maxpacket: 32 [ 873.639694][ T27] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 873.652886][ T27] usb 2-1: config 0 has no interface number 0 [ 873.669787][ T27] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 873.693585][ T27] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 873.711781][ T27] usb 2-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 873.723191][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 873.747482][ T27] usb 2-1: config 0 descriptor?? [ 874.229466][ T5809] logitech-hidpp-device 0005:046D:B012.0018: Device not connected [ 874.385207][ T27] uclogic 0003:28BD:0094.0019: pen parameters not found [ 874.402038][ T27] uclogic 0003:28BD:0094.0019: interface is invalid, ignoring [ 874.618244][ T27] usb 2-1: USB disconnect, device number 51 [ 875.592225][ T27] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 875.785198][ T27] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 875.815428][ T27] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 875.841052][ T27] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 875.877561][ T27] usb 2-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 875.916778][ T27] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 875.942939][ T27] pegasus 2-1:1.0: Missing or invalid endpoints [ 876.275808][ T5781] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 876.287914][ T5781] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 876.296965][ T5781] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 876.306649][ T5781] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 876.322218][ T5781] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 876.332596][ T5781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 876.618109][T14035] jffs2: notice: (14035) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 876.747674][ T28] audit: type=1800 audit(1787234445.441:120): pid=14035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2284" name="control" dev="configfs" ino=36458 res=0 errno=0 [ 877.033783][T14031] chnl_net:caif_netlink_parms(): no params data found [ 877.252737][T14031] bridge0: port 1(bridge_slave_0) entered blocking state [ 877.260970][T14031] bridge0: port 1(bridge_slave_0) entered disabled state [ 877.286710][T14031] bridge_slave_0: entered allmulticast mode [ 877.378924][T14031] bridge_slave_0: entered promiscuous mode [ 877.487548][T14031] bridge0: port 2(bridge_slave_1) entered blocking state [ 877.499764][T14031] bridge0: port 2(bridge_slave_1) entered disabled state [ 877.519498][T14031] bridge_slave_1: entered allmulticast mode [ 877.572406][T14031] bridge_slave_1: entered promiscuous mode [ 877.875053][T14031] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 877.986042][T14031] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 878.083766][T12141] logitech-hidpp-device 0005:046D:B012.001A: Device not connected [ 878.113959][T14031] team0: Port device team_slave_0 added [ 878.129860][T14031] team0: Port device team_slave_1 added [ 878.270410][T14031] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 878.282405][T14031] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.362283][T14031] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 878.389052][T12141] usb 2-1: USB disconnect, device number 52 [ 878.397913][T14031] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 878.412057][ T5781] Bluetooth: hci3: command tx timeout [ 878.442287][T14031] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 878.478381][T14031] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 878.843152][T14031] hsr_slave_0: entered promiscuous mode [ 878.874623][T14031] hsr_slave_1: entered promiscuous mode [ 878.904860][T14031] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 878.935232][T14031] Cannot create hsr debugfs directory [ 879.048416][T14076] jffs2: notice: (14076) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 879.515740][T14088] jffs2: notice: (14088) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 879.708794][ T28] audit: type=1800 audit(1787234448.401:121): pid=14088 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2293" name="control" dev="configfs" ino=37522 res=0 errno=0 [ 880.492297][ T5781] Bluetooth: hci3: command tx timeout [ 880.922079][T11898] hsr_slave_0: left promiscuous mode [ 880.928492][T11898] hsr_slave_1: left promiscuous mode [ 880.958220][T11898] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 880.983400][T11898] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 881.023450][T11898] bridge_slave_1: left allmulticast mode [ 881.029399][T11898] bridge_slave_1: left promiscuous mode [ 881.049046][T11898] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.078343][T14114] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 881.090417][T11898] bridge_slave_0: left allmulticast mode [ 881.096743][T11898] bridge_slave_0: left promiscuous mode [ 881.107623][T14114] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.125321][T11898] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.192911][T14114] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 881.235364][T14114] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.547942][T14130] jffs2: notice: (14130) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 881.926845][T14138] jffs2: notice: (14138) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 882.071240][ T28] audit: type=1800 audit(1787234450.761:122): pid=14138 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2301" name="control" dev="configfs" ino=36672 res=0 errno=0 [ 882.572424][ T5781] Bluetooth: hci3: command tx timeout [ 882.632855][T11898] bond0 (unregistering): Released all slaves [ 883.928631][T11898] team0 (unregistering): Port device team_slave_1 removed [ 884.058450][T11898] team0 (unregistering): Port device team_slave_0 removed [ 884.652250][ T5781] Bluetooth: hci3: command tx timeout [ 885.078949][T14161] jffs2: notice: (14161) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 885.211481][T14166] jffs2: notice: (14166) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 885.312557][ T28] audit: type=1800 audit(1787234453.991:123): pid=14166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2310" name="control" dev="configfs" ino=36713 res=0 errno=0 [ 886.407753][T14031] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 886.468148][T14031] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 886.559744][T14031] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 886.605021][T14031] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 886.885724][T14190] jffs2: notice: (14190) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 886.908003][T14031] 8021q: adding VLAN 0 to HW filter on device bond0 [ 886.985746][T14031] 8021q: adding VLAN 0 to HW filter on device team0 [ 887.035852][ T3464] bridge0: port 1(bridge_slave_0) entered blocking state [ 887.043080][ T3464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 887.105067][ T3464] bridge0: port 2(bridge_slave_1) entered blocking state [ 887.112494][ T3464] bridge0: port 2(bridge_slave_1) entered forwarding state [ 887.247333][ T28] audit: type=1800 audit(1787234455.941:124): pid=14195 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2319" name="control" dev="configfs" ino=37838 res=0 errno=0 [ 887.638471][T14208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 887.668004][T14208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 887.836185][T14031] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 887.933713][T14031] veth0_vlan: entered promiscuous mode [ 887.954976][T14031] veth1_vlan: entered promiscuous mode [ 888.007550][T14031] veth0_macvtap: entered promiscuous mode [ 888.028890][T14031] veth1_macvtap: entered promiscuous mode [ 888.051214][T14031] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 888.067542][T14031] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 888.085076][T14031] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.110839][T14031] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.120998][T14031] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.130053][T14031] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 888.272948][T11898] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 888.287277][T11898] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 888.355264][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 888.366368][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 888.534402][T14225] devpts: called with bogus options [ 888.930028][T14231] jffs2: notice: (14231) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 889.285712][T13723] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 889.302210][T13723] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 889.323295][T13723] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 889.338840][T13723] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 889.348732][T13723] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 889.357726][T13723] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 890.258711][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 60 seconds [ 890.270114][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 60 seconds [ 890.281339][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 60 seconds [ 890.292517][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 60 seconds [ 890.754996][T14239] chnl_net:caif_netlink_parms(): no params data found [ 891.462519][T13723] Bluetooth: hci1: command tx timeout [ 892.003477][T14270] jffs2: notice: (14270) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 892.164785][T14239] bridge0: port 1(bridge_slave_0) entered blocking state [ 892.216857][T14239] bridge0: port 1(bridge_slave_0) entered disabled state [ 892.247413][T14239] bridge_slave_0: entered allmulticast mode [ 892.269494][T14239] bridge_slave_0: entered promiscuous mode [ 892.491607][T14239] bridge0: port 2(bridge_slave_1) entered blocking state [ 892.525650][T14239] bridge0: port 2(bridge_slave_1) entered disabled state [ 892.544419][T14239] bridge_slave_1: entered allmulticast mode [ 892.561759][T14239] bridge_slave_1: entered promiscuous mode [ 892.646003][T14239] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 892.684486][T14239] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 892.824868][T14239] team0: Port device team_slave_0 added [ 892.903515][T14239] team0: Port device team_slave_1 added [ 893.542523][T13723] Bluetooth: hci1: command tx timeout [ 893.687251][T14239] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 893.696670][T14239] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 893.847429][T14239] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 893.972289][T14239] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 893.979419][T14239] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 894.047181][T14239] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 894.797826][T14239] hsr_slave_0: entered promiscuous mode [ 894.851789][T14239] hsr_slave_1: entered promiscuous mode [ 894.864534][T14239] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 894.882209][T14239] Cannot create hsr debugfs directory [ 894.940990][T14362] jffs2: notice: (14362) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 895.612976][T13723] Bluetooth: hci1: command tx timeout [ 897.282503][T14402] jffs2: notice: (14402) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 897.692274][T13723] Bluetooth: hci1: command tx timeout [ 898.167013][ T3464] hsr_slave_0: left promiscuous mode [ 898.183741][ T3464] hsr_slave_1: left promiscuous mode [ 898.210217][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 898.226764][ T3464] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 898.239690][ T3464] bridge_slave_1: left allmulticast mode [ 898.250620][ T3464] bridge_slave_1: left promiscuous mode [ 898.256859][ T3464] bridge0: port 2(bridge_slave_1) entered disabled state [ 898.307300][ T3464] ¾x9ÿ: left allmulticast mode [ 898.322185][ T3464] ¾x9ÿ: left promiscuous mode [ 898.332549][ T3464] bridge0: port 1(1¾x9ÿ) entered disabled state [ 899.385098][ T3464] bond2 (unregistering): Released all slaves [ 899.639646][ T3464] bond1 (unregistering): Released all slaves [ 899.709196][T14440] jffs2: notice: (14440) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 899.933572][ T3464] bond0 (unregistering): Released all slaves [ 900.596495][ T3464] team0 (unregistering): Port device team_slave_1 removed [ 900.649837][ T3464] team0 (unregistering): Port device team_slave_0 removed [ 901.674835][ T5141] udevd[5141]: worker [12958] /devices/virtual/block/nbd4 is taking a long time [ 902.004346][T14434] bridge0: port 2(bridge_slave_1) entered disabled state [ 902.012179][T14434] bridge0: port 1(bridge_slave_0) entered disabled state [ 902.282786][T14467] jffs2: notice: (14467) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 902.561475][T14434] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 902.613523][T14434] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 902.977985][T14434] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.987096][T14434] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 902.996491][T14434] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 903.005664][T14434] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 903.172184][T14239] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 903.209744][T14239] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 903.249384][T14239] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 903.311902][T14239] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 903.789858][T14239] 8021q: adding VLAN 0 to HW filter on device bond0 [ 903.811013][T14239] 8021q: adding VLAN 0 to HW filter on device team0 [ 903.876417][ T2905] bridge0: port 1(bridge_slave_0) entered blocking state [ 903.883758][ T2905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 903.961918][ T2905] bridge0: port 2(bridge_slave_1) entered blocking state [ 903.969335][ T2905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 904.116613][ T3464] IPVS: stop unused estimator thread 0... [ 904.125531][T14498] jffs2: notice: (14498) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 904.809614][T14239] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 904.978273][T14239] veth0_vlan: entered promiscuous mode [ 905.026014][T14239] veth1_vlan: entered promiscuous mode [ 905.129982][T14239] veth0_macvtap: entered promiscuous mode [ 905.159118][T14239] veth1_macvtap: entered promiscuous mode [ 905.204921][T14239] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 905.238784][T14239] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 905.266647][T14239] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.289473][T14239] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.321675][T14239] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.331060][T14239] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.514387][ T3464] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.544519][ T3464] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 905.633405][T14312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 905.655879][T14312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 906.092843][T14533] jffs2: notice: (14533) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 906.357768][ T28] audit: type=1800 audit(1787234475.051:125): pid=14533 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2328" name="control" dev="configfs" ino=40370 res=0 errno=0 [ 908.514395][T14548] jffs2: notice: (14548) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 908.841705][ T5781] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 908.856918][ T5781] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 908.867801][ T5781] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 908.876541][ T5781] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 908.886873][ T5781] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 908.896011][ T5781] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 910.109211][T14554] chnl_net:caif_netlink_parms(): no params data found [ 910.707118][T14572] jffs2: notice: (14572) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 910.941951][ T28] audit: type=1800 audit(1787234479.621:126): pid=14572 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2406" name="control" dev="configfs" ino=40461 res=0 errno=0 [ 910.972987][ T5781] Bluetooth: hci2: command tx timeout [ 911.282818][T14585] jffs2: notice: (14585) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 911.431359][T14554] bridge0: port 1(bridge_slave_0) entered blocking state [ 911.444110][T14554] bridge0: port 1(bridge_slave_0) entered disabled state [ 911.451595][T14554] bridge_slave_0: entered allmulticast mode [ 911.459658][T14554] bridge_slave_0: entered promiscuous mode [ 911.469292][T14554] bridge0: port 2(bridge_slave_1) entered blocking state [ 911.512105][T14554] bridge0: port 2(bridge_slave_1) entered disabled state [ 911.557919][T14554] bridge_slave_1: entered allmulticast mode [ 911.590572][T14554] bridge_slave_1: entered promiscuous mode [ 911.994791][T14554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 912.029502][T14554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 912.118679][T14554] team0: Port device team_slave_0 added [ 912.136855][T14554] team0: Port device team_slave_1 added [ 912.153513][T14606] jffs2: notice: (14606) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 912.205105][T14554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 912.215760][T14554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 912.289671][ T28] audit: type=1800 audit(1787234480.961:127): pid=14606 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2415" name="control" dev="configfs" ino=39687 res=0 errno=0 [ 912.342161][T14554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 912.363332][T14554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 912.378054][T14554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 912.410361][T14554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 912.649850][T14616] jffs2: notice: (14616) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 912.681403][T14554] hsr_slave_0: entered promiscuous mode [ 912.689241][T14554] hsr_slave_1: entered promiscuous mode [ 912.702666][T14554] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 912.710516][T14554] Cannot create hsr debugfs directory [ 913.052266][ T5781] Bluetooth: hci2: command tx timeout [ 914.398672][T14635] jffs2: notice: (14635) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 914.590182][ T28] audit: type=1800 audit(1787234483.281:128): pid=14635 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2424" name="control" dev="configfs" ino=40586 res=0 errno=0 [ 914.879809][T14651] jffs2: notice: (14651) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 915.132105][T13723] Bluetooth: hci2: command tx timeout [ 915.231437][T14660] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 916.514510][T14554] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 916.587621][T14554] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 916.874350][T14663] syz.4.2428 (14663): drop_caches: 2 [ 917.062503][T14679] jffs2: notice: (14679) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 917.203822][ T28] audit: type=1800 audit(1787234485.901:129): pid=14679 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2434" name="control" dev="configfs" ino=40663 res=0 errno=0 [ 917.232177][T13723] Bluetooth: hci2: command tx timeout [ 917.490786][T14674] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.499841][T14674] bridge0: port 1(bridge_slave_0) entered disabled state [ 918.386035][T14674] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 918.484429][T14674] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 919.249251][T14674] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 919.286398][T14674] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 919.293921][T14695] jffs2: notice: (14695) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 919.322095][T14674] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 919.331133][T14674] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 919.737544][T14554] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 919.759811][T14554] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 919.894819][ T12] hsr_slave_0: left promiscuous mode [ 919.925662][ T12] hsr_slave_1: left promiscuous mode [ 919.995315][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 920.024874][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 920.040303][ T12] bridge_slave_1: left allmulticast mode [ 920.046498][ T12] bridge_slave_1: left promiscuous mode [ 920.063344][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 920.089316][ T12] bridge_slave_0: left allmulticast mode [ 920.090666][T14710] jffs2: notice: (14710) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 920.102044][ T12] bridge_slave_0: left promiscuous mode [ 920.137295][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 920.319359][ T12] team0 (unregistering): Port device vlan2 removed [ 920.339786][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 90 seconds [ 920.350562][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 90 seconds [ 920.362201][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 90 seconds [ 920.373598][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 90 seconds [ 920.395035][ T28] audit: type=1800 audit(1787234489.081:130): pid=14710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2442" name="control" dev="configfs" ino=41154 res=0 errno=0 [ 921.451264][T14729] jffs2: notice: (14729) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 922.029619][ T12] team0 (unregistering): Port device team_slave_1 removed [ 922.110305][ T12] team0 (unregistering): Port device team_slave_0 removed [ 922.764530][T14743] jffs2: notice: (14743) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 922.832001][ T28] audit: type=1800 audit(1787234491.521:131): pid=14743 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2453" name="control" dev="configfs" ino=41189 res=0 errno=0 [ 924.348443][T14554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 924.516741][T14757] jffs2: notice: (14757) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 924.534947][T14554] 8021q: adding VLAN 0 to HW filter on device team0 [ 924.625251][ T2905] bridge0: port 1(bridge_slave_0) entered blocking state [ 924.632652][ T2905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 924.704957][ T2905] bridge0: port 2(bridge_slave_1) entered blocking state [ 924.712621][ T2905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 925.379984][T14779] jffs2: notice: (14779) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 926.072442][ T28] audit: type=1800 audit(1787234494.251:132): pid=14782 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2461" name="control" dev="configfs" ino=40860 res=0 errno=0 [ 926.315979][T14554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 926.438337][T14554] veth0_vlan: entered promiscuous mode [ 926.485963][T14554] veth1_vlan: entered promiscuous mode [ 926.609055][T14554] veth0_macvtap: entered promiscuous mode [ 926.631659][T14554] veth1_macvtap: entered promiscuous mode [ 926.668221][T14554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 926.690215][T14554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 926.711345][T14554] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.721446][T14554] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.751936][T14554] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.760842][T14554] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 926.968863][ T2905] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 926.992498][ T2905] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 927.039819][ T2905] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 927.059561][ T2905] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 927.101622][T14800] jffs2: notice: (14800) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 927.264922][T14803] can0: slcan on ttyS3. [ 927.398374][T14807] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2468'. [ 927.422711][T14803] can0 (unregistered): slcan off ttyS3. [ 927.431322][T14810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2468'. [ 928.429960][T14821] jffs2: notice: (14821) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 929.232016][ T28] audit: type=1800 audit(1787234497.541:133): pid=14836 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2471" name="control" dev="configfs" ino=41688 res=0 errno=0 [ 930.874254][T14870] jffs2: notice: (14870) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 931.022756][T12141] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 931.222026][T12141] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 931.242179][T12141] usb 4-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 931.256763][T14886] jffs2: notice: (14886) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 931.277646][T12141] usb 4-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 931.287557][T12141] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.297259][T12141] usb 4-1: Product: syz [ 931.302403][T12141] usb 4-1: Manufacturer: syz [ 931.308745][T12141] usb 4-1: SerialNumber: syz [ 931.583879][T12141] ti_usb_3410_5052 4-1:2.0: TI USB 5052 2 port adapter converter detected [ 931.658726][T12141] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 931.697144][T12141] usb 4-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 931.744626][ T28] audit: type=1800 audit(1787234500.431:134): pid=14886 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2486" name="control" dev="configfs" ino=41748 res=0 errno=0 [ 931.857810][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.867509][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.915276][T14898] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2489'. [ 932.105816][T14906] syz.1.2491: attempt to access beyond end of device [ 932.105816][T14906] nbd1: rw=0, sector=1, nr_sectors = 1 limit=0 [ 932.119368][T14906] qnx4: unable to read the superblock [ 933.054129][T14910] jffs2: notice: (14910) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 934.187479][T14928] IPVS: Unknown mcast interface: pim6reg [ 934.204120][T14927] jffs2: notice: (14927) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 934.327525][T14932] lo speed is unknown, defaulting to 1000 [ 934.334703][T14932] lo speed is unknown, defaulting to 1000 [ 934.355933][T14932] lo speed is unknown, defaulting to 1000 [ 934.395414][T14932] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 935.050260][T14932] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 935.058115][T14857] ti_usb_3410_5052_2 ttyUSB0: ti_get_lsr - get port status command failed, -110 [ 935.068718][T14857] ti_usb_3410_5052_2 ttyUSB0: ti_close - cannot send close port command, -32 [ 935.078064][ T28] audit: type=1800 audit(1787234503.351:135): pid=14936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2499" name="control" dev="configfs" ino=41804 res=0 errno=0 [ 935.100856][T10477] usb 4-1: USB disconnect, device number 27 [ 935.123208][ T28] audit: type=1800 audit(1787234503.821:136): pid=14936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2499" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 935.202863][T10477] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 935.248138][T14932] lo speed is unknown, defaulting to 1000 [ 935.266907][T14932] lo speed is unknown, defaulting to 1000 [ 935.274820][T10477] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 935.310205][T14932] lo speed is unknown, defaulting to 1000 [ 935.334141][T10477] ti_usb_3410_5052 4-1:2.0: device disconnected [ 935.344439][T14942] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2502'. [ 935.353881][T14932] lo speed is unknown, defaulting to 1000 [ 935.673872][T14950] jffs2: notice: (14950) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 937.045556][T14942] bridge0: port 2(bridge_slave_1) entered disabled state [ 937.053364][T14942] bridge0: port 1(bridge_slave_0) entered disabled state [ 937.058452][T14967] jffs2: notice: (14967) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 937.243589][ T28] audit: type=1800 audit(1787234505.941:137): pid=14970 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2510" name="control" dev="configfs" ino=42422 res=0 errno=0 [ 938.946172][T14999] jffs2: notice: (14999) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 939.153386][T14942] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 939.570767][T14942] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 941.003360][T15015] jffs2: notice: (15015) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 941.263862][ T28] audit: type=1800 audit(1787234509.961:138): pid=15020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2521" name="control" dev="configfs" ino=42469 res=0 errno=0 [ 941.893681][T14942] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 941.912450][T14942] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 941.921372][T14942] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 941.931398][T14942] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 942.213443][T15028] jffs2: notice: (15028) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 944.301589][T15051] jffs2: notice: (15051) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 944.530352][ T28] audit: type=1800 audit(1787234513.201:139): pid=15061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2531" name="control" dev="configfs" ino=42561 res=0 errno=0 [ 945.120582][T15067] jffs2: notice: (15067) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 945.175121][T15070] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2537'. [ 945.830077][T15078] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2539'. [ 947.808358][T15096] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2545'. [ 947.893413][T15098] jffs2: notice: (15098) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 948.135366][ T28] audit: type=1800 audit(1787234516.831:140): pid=15106 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2546" name="control" dev="configfs" ino=43085 res=0 errno=0 [ 949.712248][T15118] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2553'. [ 950.730945][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 120 seconds [ 950.742269][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 120 seconds [ 950.753479][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 120 seconds [ 950.872646][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 120 seconds [ 950.923480][T15134] jffs2: notice: (15134) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 951.041124][T15137] jffs2: notice: (15137) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 951.369152][ T28] audit: type=1800 audit(1787234520.061:141): pid=15139 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2559" name="control" dev="configfs" ino=43139 res=0 errno=0 [ 951.895612][T15149] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2560'. [ 951.923149][ T28] audit: type=1800 audit(1787234520.621:142): pid=15139 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2559" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 953.093787][T15169] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2569'. [ 953.221998][ T5833] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 953.254720][T15173] jffs2: notice: (15173) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 953.430539][ T5833] usb 2-1: config index 0 descriptor too short (expected 71, got 53) [ 953.461068][ T5833] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 953.584418][ T5833] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.00 [ 953.678887][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.753195][ T5833] usb 2-1: Product: syz [ 953.776086][T15179] jffs2: notice: (15179) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 953.807174][ T5833] usb 2-1: Manufacturer: syz [ 953.835568][ T5833] usb 2-1: SerialNumber: syz [ 953.929395][ T5833] mos7720 2-1:1.0: required endpoints missing [ 954.106916][T15184] binder: 15180:15184 ioctl c0306201 200000000680 returned -14 [ 954.201098][T15164] mos7720 2-1:1.0: required endpoints missing [ 954.390566][ T28] audit: type=1800 audit(1787234523.051:143): pid=15181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2570" name="control" dev="configfs" ino=43198 res=0 errno=0 [ 954.574424][T12141] usb 2-1: USB disconnect, device number 53 [ 954.629593][T15190] syz.4.2572 uses obsolete (PF_INET,SOCK_PACKET) [ 954.704753][T15192] autofs4:pid:15192:autofs_fill_super: called with bogus options [ 954.852801][T15192] netlink: 'syz.4.2572': attribute type 10 has an invalid length. [ 955.162208][ T28] audit: type=1800 audit(1787234523.751:144): pid=15181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2570" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 955.772737][T15208] jffs2: notice: (15208) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 956.255531][T15212] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2579'. [ 956.602427][T15221] jffs2: notice: (15221) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 957.460163][ T28] audit: type=1800 audit(1787234526.071:145): pid=15225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2582" name="control" dev="configfs" ino=42916 res=0 errno=0 [ 958.067622][T12141] kernel write not supported for file /input/mice (pid: 12141 comm: kworker/0:1) [ 958.548355][T15244] jffs2: notice: (15244) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 959.559596][T15256] netlink: 'syz.0.2594': attribute type 1 has an invalid length. [ 959.567953][T15256] netlink: 'syz.0.2594': attribute type 2 has an invalid length. [ 959.583690][T15255] jffs2: notice: (15255) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 959.844765][T15264] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2597'. [ 960.628503][ T28] audit: type=1800 audit(1787234529.321:146): pid=15270 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2593" name="control" dev="configfs" ino=42995 res=0 errno=0 [ 961.071251][T15283] jffs2: notice: (15283) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 962.425671][T15303] jffs2: notice: (15303) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 964.030992][ T28] audit: type=1800 audit(1787234532.721:147): pid=15308 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2607" name="control" dev="configfs" ino=43379 res=0 errno=0 [ 964.067025][T15316] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2611'. syzkaller syzkaller login: [ 967.160618][T15347] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2622'. [ 967.244617][T15349] jffs2: notice: (15349) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 967.464051][ T28] audit: type=1800 audit(1787234536.111:148): pid=15353 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2623" name="control" dev="configfs" ino=44209 res=0 errno=0 [ 968.917096][T15368] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2629'. [ 969.670004][T15381] jffs2: notice: (15381) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 970.602814][ T28] audit: type=1800 audit(1787234539.301:149): pid=15390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2634" name="control" dev="configfs" ino=44363 res=0 errno=0 [ 971.114236][T15403] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2639'. [ 971.557614][T15406] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2640'. [ 973.171479][T15420] jffs2: notice: (15420) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 973.639258][T15426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 973.686361][T15426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 973.720576][T15430] jffs2: notice: (15430) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 973.748748][T15426] ieee802154 phy0 wpan0: encryption failed: -22 [ 975.095259][ T28] audit: type=1800 audit(1787234543.781:150): pid=15436 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2646" name="control" dev="configfs" ino=44463 res=0 errno=0 [ 975.399001][T15437] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 975.422116][T15437] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 975.450135][T15437] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 975.458323][T15437] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 975.497358][T15437] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 975.507433][T15437] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 976.254318][T15437] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 976.294038][T15437] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 976.327023][T15437] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 976.509209][T15437] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 976.524798][T15437] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 976.599421][T15454] jffs2: notice: (15454) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 977.300587][T13723] Bluetooth: hci4: command 0x0406 tx timeout [ 977.349343][T15461] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2657'. [ 977.468749][T15467] jffs2: notice: (15467) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 977.532463][T13723] Bluetooth: hci1: command 0x0c1a tx timeout [ 977.532560][ T5781] Bluetooth: hci3: command 0x0c1a tx timeout [ 977.679190][ T28] audit: type=1800 audit(1787234546.361:151): pid=15473 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2660" name="control" dev="configfs" ino=44528 res=0 errno=0 [ 977.792152][ T5833] usb 2-1: new full-speed USB device number 54 using dummy_hcd [ 977.873828][T15476] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 978.047753][ T5833] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 978.081163][T15477] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 978.169913][ T5833] usb 2-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 978.222884][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 978.283568][ T5833] usb 2-1: Product: syz [ 978.328827][ T5833] usb 2-1: Manufacturer: syz [ 978.329412][T15477] CIFS: Attempting to mount //127.0.0.1/share [ 978.333878][ T5781] Bluetooth: hci2: command 0x0c1a tx timeout [ 978.359272][ T5833] usb 2-1: SerialNumber: syz [ 978.377059][ T5833] usb 2-1: config 0 descriptor?? [ 978.394482][ T5833] asix: probe of 2-1:0.0 failed with error -22 [ 979.395851][T15477] CIFS: VFS: Error connecting to socket. Aborting operation. [ 979.404263][T15477] CIFS: VFS: cifs_mount failed w/return code = -4 [ 979.418520][T15486] jffs2: notice: (15486) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 979.458477][ T5781] Bluetooth: hci4: command 0x0406 tx timeout [ 979.613536][T13723] Bluetooth: hci1: command 0x0c1a tx timeout [ 979.620002][ T5781] Bluetooth: hci3: command 0x0c1a tx timeout [ 980.412086][ T5781] Bluetooth: hci2: command 0x0c1a tx timeout [ 980.666911][ T5833] usb 2-1: USB disconnect, device number 54 [ 980.904586][T15498] IPVS: Unknown mcast interface: pim6reg [ 980.950779][T15501] jffs2: notice: (15501) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 981.700147][ T5781] Bluetooth: hci3: command 0x0c1a tx timeout [ 981.706349][ T1189] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 150 seconds [ 981.707677][T13723] Bluetooth: hci1: command 0x0c1a tx timeout [ 981.717323][ T1189] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 150 seconds [ 981.785954][ T1189] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 150 seconds [ 981.832282][ T1189] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 150 seconds [ 981.897177][ T28] audit: type=1800 audit(1787234550.591:152): pid=15508 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2670" name="control" dev="configfs" ino=43610 res=0 errno=0 [ 982.058793][T15510] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2671'. [ 982.279557][ T28] audit: type=1800 audit(1787234550.971:153): pid=15508 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2670" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 982.502095][T13723] Bluetooth: hci2: command 0x0c1a tx timeout [ 982.507192][T15521] jffs2: notice: (15521) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 982.700986][ T5833] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 983.037257][ T5833] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 983.100500][ T5833] usb 4-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 983.160165][ T5833] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.211693][ T5833] usb 4-1: config 0 descriptor?? [ 983.397655][T15535] bridge0: entered allmulticast mode [ 983.464092][ T5833] usbhid 4-1:0.0: can't add hid device: -71 [ 983.480402][ T5833] usbhid: probe of 4-1:0.0 failed with error -71 [ 983.509675][ T5833] usb 4-1: USB disconnect, device number 28 [ 983.519470][T15540] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2682'. [ 983.667600][T15545] jffs2: notice: (15545) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 984.751948][ T5833] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 984.937628][ T28] audit: type=1800 audit(1787234553.631:154): pid=15551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2684" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 985.104720][ T5833] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 985.170344][ T5833] usb 4-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 985.239584][ T5833] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 985.314558][ T5833] usb 4-1: config 0 descriptor?? [ 985.367779][T15562] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2686'. [ 985.618140][T15562] bridge0: left allmulticast mode [ 985.759917][ T5833] usb 4-1: can't set config #0, error -71 [ 985.852117][ T5833] usb 4-1: USB disconnect, device number 29 [ 986.405192][T15582] jffs2: notice: (15582) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 987.711238][T15594] fuse: Unknown parameter 'ÿ0000000000000000026100000000000000000003' [ 991.035893][T14342] Bluetooth: hci0: Frame reassembly failed (-84) [ 991.567463][T15620] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2705'. [ 991.951327][T15626] autofs4:pid:15626:autofs_fill_super: called with bogus options [ 991.970324][T15626] ip6gre1: entered allmulticast mode [ 991.989056][T14339] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 992.012188][T13723] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 992.514017][ T5781] Bluetooth: hci3: Malformed LE Event: 0x1b [ 992.572909][T15629] jffs2: notice: (15629) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 993.791598][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.798064][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.132032][ T5833] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 994.254013][T15650] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2715'. [ 994.328250][ T5833] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 994.381141][ T5833] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 994.445026][ T5833] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 994.510097][ T5833] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 994.588855][ T5833] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 994.648964][ T5833] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.154767][ T5833] usb 4-1: USB disconnect, device number 30 [ 996.217921][T15674] jffs2: notice: (15674) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 996.252082][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 996.871044][T15680] Config c/1 of g_uac2 needs at least one function. [ 996.964774][T15680] udc usbip-vudc.0: failed to start g_uac2: -22 [ 997.062262][T15680] configfs-gadget.g_uac2: probe of gadget.32 failed with error -22 [ 997.135413][T15680] UDC core: g_uac2: couldn't find an available UDC or it's busy [ 997.332127][T15699] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2726'. [ 997.462250][T12141] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 997.522312][ T5833] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 997.664372][T12141] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 997.689614][T12141] usb 2-1: config 0 has no interfaces? [ 997.696119][T12141] usb 2-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 997.705484][ T5833] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 997.709428][T12141] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 997.720070][ T5833] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 997.744924][ T5833] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice= 1.00 [ 997.758993][T12141] usb 2-1: config 0 descriptor?? [ 997.761683][ T5833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 997.779978][ T5833] usb 5-1: Product: syz [ 997.793137][ T5833] usb 5-1: Manufacturer: syz [ 997.798180][ T5833] usb 5-1: SerialNumber: syz [ 997.999635][T12141] usb 2-1: USB disconnect, device number 55 [ 998.403032][ T5833] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 998.588453][ T5833] usb 4-1: unable to get BOS descriptor or descriptor too short [ 998.602043][ T5833] usb 4-1: not running at top speed; connect to a high speed hub [ 998.616474][ T5833] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 998.629603][ T5833] usb 4-1: New USB device found, idVendor=0c72, idProduct=000c, bcdDevice= e.3d [ 998.644854][ T5833] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 998.655378][ T5833] usb 4-1: Manufacturer: ã  [ 998.660014][ T5833] usb 4-1: SerialNumber: Ïѳ㻧幥í¬í€®îŠâ³Œç»Ÿç™¦é­‘湘櫨ï¸ë¾á‡–뻓컊ï—먯툦è”툉è­åˆ¯ä»œêŸ¸î£¦é›¨ì¢šè»¸è­˜ã¥±ä–´ç¹ªÆ±ÛŠå¾Ÿá„œë¦–쟅溣역콴Ʊâ†ì”᳕ෙ녠ï¸éž§è³­ãŸì‡ºë˜äŒ¼ïµ°ëœ°ç„˜à½–侊î”ꌸ㬥쫾황㧨⠗텄놨堥鑘뇆ࠧ崬ä¥å‘휱ˎ幮걼൓콥넃䯽ᅈ鷆掌费Āꫢ [ 998.933173][T15731] jffs2: notice: (15731) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 998.941210][ T5833] peak_usb 4-1:1.0 can0: sending cmd f=0x6 n=0x1 failure: -22 [ 998.977895][ T5833] peak_usb 4-1:1.0: unable to read PCAN-USB serial number (err -22) [ 999.637623][T14982] usb 5-1: USB disconnect, device number 26 [ 1000.047592][ T5833] peak_usb: probe of 4-1:1.0 failed with error -22 [ 1000.070415][ T5833] usb 4-1: USB disconnect, device number 31 [ 1000.094815][T15741] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2735'. [ 1000.154586][T15741] ip6gre1: left allmulticast mode [ 1000.352068][T12141] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1000.542084][T12141] usb 2-1: Using ep0 maxpacket: 8 [ 1000.556876][T12141] usb 2-1: config index 0 descriptor too short (expected 1307, got 27) [ 1000.572067][T12141] usb 2-1: config 0 has an invalid interface number: 149 but max is -1 [ 1000.580433][T12141] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1000.612020][T12141] usb 2-1: config 0 has no interface number 0 [ 1000.618228][T12141] usb 2-1: too many endpoints for config 0 interface 149 altsetting 215: 148, using maximum allowed: 30 [ 1000.663038][T12141] usb 2-1: config 0 interface 149 altsetting 215 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1000.673723][T12141] usb 2-1: config 0 interface 149 altsetting 215 has 1 endpoint descriptor, different from the interface descriptor's value: 148 [ 1000.699666][T12141] usb 2-1: config 0 interface 149 has no altsetting 0 [ 1001.326409][T15753] fuse: Unknown parameter '00000000000000000000' [ 1002.184913][T12141] usb 2-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=c3.de [ 1002.194368][T12141] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1002.202719][T12141] usb 2-1: Product: syz [ 1002.206959][T12141] usb 2-1: Manufacturer: syz [ 1002.211738][ T5833] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1002.212157][T12141] usb 2-1: SerialNumber: syz [ 1002.256676][T12141] usb 2-1: config 0 descriptor?? [ 1002.278284][T12141] hub 2-1:0.149: bad descriptor, ignoring hub [ 1002.285638][T12141] hub: probe of 2-1:0.149 failed with error -5 [ 1002.416684][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1002.441911][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1002.468359][ T5833] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1002.481782][ T5833] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1002.495725][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.514050][ T5833] usb 5-1: config 0 descriptor?? [ 1002.632630][T14982] usb 2-1: USB disconnect, device number 56 [ 1002.945444][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1002.969649][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1002.978023][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1002.990446][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1002.998947][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.011996][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.020689][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.046473][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.066427][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.089433][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.109739][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.129573][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.154333][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1003.180905][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1004.081272][ T5833] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 1004.095186][ T5833] plantronics 0003:047F:FFFF.001B: No inputs registered, leaving [ 1004.145969][ T5833] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 1004.167688][T15769] jffs2: notice: (15769) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1005.623840][ T5833] usb 5-1: USB disconnect, device number 27 [ 1005.860601][T15783] hub 8-0:1.0: USB hub found [ 1005.867451][T15783] hub 8-0:1.0: 1 port detected [ 1005.952848][T15781] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1006.796209][T15786] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2748'. [ 1007.344929][T15795] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2751'. [ 1007.367522][T15795] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1008.262088][ T5833] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1008.281167][T15803] jffs2: notice: (15803) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1008.442049][ T5833] usb 5-1: device descriptor read/64, error -71 [ 1009.422051][ T5833] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1009.582122][ T5833] usb 5-1: device descriptor read/64, error -71 [ 1009.723885][ T5833] usb usb5-port1: attempt power cycle [ 1010.162157][ T5833] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1010.852611][ T5833] usb 5-1: device descriptor read/8, error -71 [ 1011.862075][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 180 seconds [ 1011.872956][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 180 seconds [ 1011.884359][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 180 seconds [ 1011.889453][T15837] jffs2: notice: (15837) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1011.912917][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 180 seconds [ 1012.066321][T15842] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2765'. [ 1012.883513][ T28] audit: type=1800 audit(1787234581.581:155): pid=15843 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2764" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 1013.021945][ T5833] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1013.064809][ T5833] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1013.086969][ T5833] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1013.109850][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1013.172684][ T5833] usb 5-1: config 0 descriptor?? [ 1013.181352][ T5833] pwc: Askey VC010 type 2 USB webcam detected. [ 1013.566061][T15863] comedi comedi0: comedi_config --init_data is deprecated [ 1013.606445][ T5833] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1013.645335][ T5833] pwc: recv_control_msg error -32 req 02 val 2700 [ 1013.685359][ T5833] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1013.724347][ T5833] pwc: recv_control_msg error -32 req 04 val 1000 [ 1013.768072][ T5833] pwc: recv_control_msg error -32 req 04 val 1300 [ 1013.801148][ T5833] pwc: recv_control_msg error -32 req 04 val 1400 [ 1013.862339][ T5833] pwc: recv_control_msg error -32 req 02 val 2000 [ 1013.911642][ T5833] pwc: recv_control_msg error -32 req 02 val 2100 [ 1013.941389][ T5833] pwc: recv_control_msg error -32 req 04 val 1500 [ 1013.990709][ T5833] pwc: recv_control_msg error -32 req 02 val 2500 [ 1014.059709][ T5833] pwc: recv_control_msg error -32 req 02 val 2400 [ 1014.120824][ T5833] pwc: recv_control_msg error -32 req 02 val 2600 [ 1014.187764][ T5833] pwc: recv_control_msg error -32 req 02 val 2900 [ 1014.490435][T15870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1014.492320][ T5833] pwc: recv_control_msg error -71 req 04 val 1100 [ 1014.512370][T15870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1014.556839][ T5833] pwc: recv_control_msg error -71 req 04 val 1200 [ 1014.748621][ T5833] pwc: Registered as video103. [ 1014.803003][ T5833] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input18 [ 1015.032388][ T5833] usb 5-1: USB disconnect, device number 31 [ 1015.728758][T15886] jffs2: notice: (15886) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1015.770267][T15888] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2778'. [ 1016.025360][ T5781] Bluetooth: hci3: ACL packet for unknown connection handle 201 [ 1016.322486][ T5840] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1016.633685][ T5840] usb 5-1: Using ep0 maxpacket: 8 [ 1016.695700][ T28] audit: type=1800 audit(1787234585.391:156): pid=15896 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2776" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 1016.725888][ T5840] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 1016.742287][ T5840] usb 5-1: config 2 has no interface number 0 [ 1016.752026][ T5840] usb 5-1: config 2 interface 31 has no altsetting 0 [ 1016.789578][ T5840] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1016.820116][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1016.838480][ T5840] usb 5-1: Product: syz [ 1016.845494][ T5840] usb 5-1: Manufacturer: syz [ 1016.850317][ T5840] usb 5-1: SerialNumber: syz [ 1017.891100][T15910] rt1719: probe of 0-0049 failed with error -5 [ 1017.910502][T15910] i2c i2c-0: new_device: Instantiated device rt1719 at 0x49 [ 1017.937918][T15908] wusb3801 0-0004: supply vbus not found, using dummy regulator [ 1018.247362][T15908] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x04 [ 1018.359744][ T5840] ch9200: probe of 5-1:2.31 failed with error -22 [ 1018.830852][ T5840] usb 5-1: USB disconnect, device number 32 [ 1020.063650][T15929] jffs2: notice: (15929) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1020.173280][T15934] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2791'. [ 1020.310021][ T28] audit: type=1800 audit(1787234588.931:157): pid=15937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2790" name="control" dev="configfs" ino=45414 res=0 errno=0 [ 1021.987074][ T5141] udevd[5141]: worker [12958] /devices/virtual/block/nbd4 timeout; kill it [ 1022.011005][ T5141] udevd[5141]: seq 17030 '/devices/virtual/block/nbd4' killed [ 1022.287970][T15967] jffs2: notice: (15967) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1022.338397][T15969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1022.349583][T15969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1022.369507][T15972] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2805'. [ 1022.558708][ T28] audit: type=1800 audit(1787234591.251:158): pid=15974 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2804" name="control" dev="configfs" ino=46366 res=0 errno=0 [ 1023.412074][T15985] netlink: 'syz.3.2809': attribute type 1 has an invalid length. [ 1024.180095][T16002] jffs2: notice: (16002) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1024.778875][ T28] audit: type=1800 audit(1787234593.471:159): pid=16004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2815" name="control" dev="configfs" ino=46398 res=0 errno=0 [ 1025.072028][ T28] audit: type=1800 audit(1787234593.761:160): pid=16004 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2815" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 1025.198985][T16011] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2817'. [ 1025.332059][ T5833] usb 5-1: new full-speed USB device number 33 using dummy_hcd [ 1025.537406][ T5833] usb 5-1: config 250 has an invalid interface number: 199 but max is 0 [ 1025.555099][ T5833] usb 5-1: config 250 contains an unexpected descriptor of type 0x2, skipping [ 1025.566104][ T5833] usb 5-1: config 250 has an invalid interface number: 24 but max is 0 [ 1025.583265][ T5833] usb 5-1: config 250 has 2 interfaces, different from the descriptor's value: 1 [ 1025.606569][ T5833] usb 5-1: config 250 has no interface number 0 [ 1025.623070][ T5833] usb 5-1: config 250 has no interface number 1 [ 1025.644092][ T5833] usb 5-1: config 250 interface 199 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1025.657706][ T5833] usb 5-1: config 250 interface 199 altsetting 0 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 1025.674495][ T5833] usb 5-1: config 250 interface 199 altsetting 0 endpoint 0x4 has invalid maxpacket 1056, setting to 64 [ 1025.687339][ T5833] usb 5-1: config 250 interface 199 altsetting 0 endpoint 0xF has invalid maxpacket 512, setting to 64 [ 1025.707896][ T5833] usb 5-1: too many endpoints for config 250 interface 24 altsetting 197: 89, using maximum allowed: 30 [ 1025.724349][ T5833] usb 5-1: config 250 interface 24 altsetting 197 has 0 endpoint descriptors, different from the interface descriptor's value: 89 [ 1025.744181][ T5833] usb 5-1: config 250 interface 24 has no altsetting 0 [ 1025.757334][ T5833] usb 5-1: New USB device found, idVendor=046d, idProduct=089d, bcdDevice=a4.4a [ 1025.768990][ T5833] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.786222][ T5833] usb 5-1: Product: syz [ 1025.791331][ T5833] usb 5-1: Manufacturer: syz [ 1025.799765][ T5833] usb 5-1: SerialNumber: syz [ 1025.814905][T16009] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1026.262107][ T5833] usb 5-1: USB disconnect, device number 33 [ 1026.550450][T16027] VFS: Can't find a romfs filesystem on dev mtdblock0. [ 1026.550450][T16027] [ 1027.634121][T16041] jffs2: notice: (16041) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1027.901370][ T28] audit: type=1800 audit(1787234596.581:161): pid=16041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2827" name="control" dev="configfs" ino=46454 res=0 errno=0 [ 1028.503086][T16046] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2828'. [ 1028.535688][ T28] audit: type=1800 audit(1787234597.211:162): pid=16041 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2827" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 1029.533209][T16064] jffs2: notice: (16064) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1029.810394][ T28] audit: type=1800 audit(1787234598.501:163): pid=16073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2833" name="control" dev="configfs" ino=46558 res=0 errno=0 [ 1030.882174][T16083] jffs2: notice: (16083) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1031.346570][T16089] syzkaller0: entered promiscuous mode [ 1031.363665][T16089] syzkaller0: entered allmulticast mode [ 1031.740906][ T28] audit: type=1800 audit(1787234600.431:164): pid=16091 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2838" name="control" dev="configfs" ino=45659 res=0 errno=0 [ 1032.383143][T16104] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2842'. [ 1032.842064][ T5833] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1033.091933][ T5833] usb 2-1: Using ep0 maxpacket: 32 [ 1033.104986][ T5833] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1033.135842][ T5833] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1033.151537][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1033.171541][ T5833] usb 2-1: Product: syz [ 1033.185361][ T5833] usb 2-1: Manufacturer: syz [ 1033.190011][ T5833] usb 2-1: SerialNumber: syz [ 1033.222702][ T5833] usb 2-1: config 0 descriptor?? [ 1033.239498][T16106] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1033.273352][ T5833] hub 2-1:0.0: bad descriptor, ignoring hub [ 1033.307503][ T5833] hub: probe of 2-1:0.0 failed with error -5 [ 1033.506718][T16115] bond1: (slave vlan2): Opening slave failed [ 1033.539224][T16122] jffs2: notice: (16122) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1034.420686][ T28] audit: type=1800 audit(1787234603.111:165): pid=16129 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2848" name="control" dev="configfs" ino=45722 res=0 errno=0 [ 1035.062076][ T5833] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 1035.241886][ T5833] usb 4-1: Using ep0 maxpacket: 8 [ 1035.249030][ T5833] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1035.260997][ T5833] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1035.270807][ T5833] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1035.281958][ T5833] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1035.291973][ T5833] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1035.305091][ T5833] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1035.314337][ T5833] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1035.530048][ T5833] usb 4-1: usb_control_msg returned -32 [ 1035.536119][ T5833] usbtmc 4-1:16.0: can't read capabilities [ 1036.407510][T16155] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2857'. [ 1036.812096][T13723] Bluetooth: hci2: command 0x0c1a tx timeout [ 1037.327759][T16162] jffs2: notice: (16162) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1040.244645][T16187] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2866'. [ 1040.253805][T16187] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2866'. [ 1040.263399][T16187] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2866'. [ 1040.385916][T16190] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2867'. [ 1040.552312][T14983] usb 2-1: USB disconnect, device number 57 [ 1040.611989][T14982] usb 4-1: USB disconnect, device number 32 [ 1040.721275][T16196] jffs2: notice: (16196) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1041.942343][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 210 seconds [ 1041.953375][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 210 seconds [ 1041.964961][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 210 seconds [ 1041.976067][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 210 seconds [ 1042.902107][T14982] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1043.161571][T14982] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1043.172151][T14982] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1043.182384][T14982] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1043.195343][T14982] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1043.247071][T16222] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2877'. [ 1043.276764][T14982] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1043.296275][T14982] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1044.521638][T16237] jffs2: notice: (16237) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1044.614141][T14982] [drm] Initialized gud 1.0.0 20200422 for 5-1:1.0 on minor 2 [ 1045.382165][T14982] gud 5-1:1.0: [drm] Cannot find any crtc or sizes [ 1045.413023][T14982] usb 5-1: USB disconnect, device number 34 [ 1045.435910][T14983] gud 5-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 1045.504540][ T28] audit: type=1800 audit(1787234614.201:166): pid=16242 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2882" name="fillfile" dev="jffs2" ino=2 res=0 errno=0 [ 1045.794784][T16258] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2888'. [ 1045.890862][T16260] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2889'. [ 1048.846301][ T28] audit: type=1326 audit(1787234617.531:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.018534][ T28] audit: type=1326 audit(1787234617.581:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.109268][ T28] audit: type=1326 audit(1787234617.611:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.199634][ T28] audit: type=1326 audit(1787234617.611:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.296681][ T28] audit: type=1326 audit(1787234617.611:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.379190][ T28] audit: type=1326 audit(1787234617.621:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.441995][ T28] audit: type=1326 audit(1787234617.631:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.511891][ T28] audit: type=1326 audit(1787234617.631:174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1049.578156][ T28] audit: type=1326 audit(1787234617.631:176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16278 comm="syz.0.2895" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f744019e0d9 code=0x7ffc0000 [ 1050.498081][T16287] jffs2: notice: (16287) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1050.526997][T16289] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1050.826769][ T28] kauditd_printk_skb: 154 callbacks suppressed [ 1050.826857][ T28] audit: type=1800 audit(1787234619.521:330): pid=16296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2896" name="control" dev="configfs" ino=46831 res=0 errno=0 [ 1052.356858][T16306] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2902'. [ 1052.398017][T16306] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2902'. [ 1053.169972][T16310] Bluetooth: hci0: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 1053.304767][T14345] Bluetooth: hci0: Frame reassembly failed (-84) [ 1053.622086][ T5840] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1054.000964][ T5840] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1054.063801][ T5840] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1054.157343][ T5840] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.382961][ T5840] usb 2-1: config 0 descriptor?? [ 1054.407345][ T5840] pwc: Askey VC010 type 2 USB webcam detected. [ 1054.735297][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.741747][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.832563][ T5840] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1054.840170][ T5840] pwc: recv_control_msg error -32 req 02 val 2700 [ 1055.372599][T13723] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 1055.606708][ T5840] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1055.627614][ T5840] pwc: recv_control_msg error -32 req 04 val 1000 [ 1055.792018][ T5840] pwc: recv_control_msg error -32 req 04 val 1300 [ 1055.849020][T16344] jffs2: notice: (16344) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1056.055527][ T28] audit: type=1800 audit(1787234624.751:331): pid=16345 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2911" name="control" dev="configfs" ino=47139 res=0 errno=0 [ 1056.476251][T16352] jffs2: notice: (16352) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1056.932147][ T5840] pwc: recv_control_msg error -71 req 04 val 1400 [ 1056.942985][ T5840] pwc: recv_control_msg error -71 req 02 val 2000 [ 1056.963429][ T5840] pwc: recv_control_msg error -71 req 02 val 2100 [ 1056.985863][ T5840] pwc: recv_control_msg error -71 req 04 val 1500 [ 1056.998941][T16359] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2917'. [ 1057.012487][ T5840] pwc: recv_control_msg error -71 req 02 val 2500 [ 1057.028468][ T5840] pwc: recv_control_msg error -71 req 02 val 2400 [ 1057.044943][ T5840] pwc: recv_control_msg error -71 req 02 val 2600 [ 1057.204342][ T5840] pwc: recv_control_msg error -71 req 02 val 2900 [ 1057.205883][T16364] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2917'. [ 1057.222958][ T5840] pwc: recv_control_msg error -71 req 02 val 2800 [ 1057.311631][ T5840] pwc: recv_control_msg error -71 req 04 val 1100 [ 1057.460430][ T5840] pwc: recv_control_msg error -71 req 04 val 1200 [ 1057.776337][ T5840] pwc: Registered as video103. [ 1057.797623][ T5840] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input19 [ 1057.846182][ T5840] usb 2-1: USB disconnect, device number 58 [ 1058.034755][T16369] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2920'. [ 1058.293047][T16378] jffs2: notice: (16378) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1058.482043][ T28] audit: type=1800 audit(1787234627.171:332): pid=16380 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2923" name="control" dev="configfs" ino=46914 res=0 errno=0 [ 1058.584389][T16383] atomic_op ffff88805da03198 conn xmit_atomic 0000000000000000 [ 1060.589921][T16403] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2924'. [ 1061.192378][T16406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1061.202278][T16406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1061.712769][T16412] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2934'. [ 1061.769075][T16412] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2934'. [ 1062.087890][T16419] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1062.151156][T16419] overlayfs: failed to look up (tracing) for ino (-66) [ 1065.983908][T16443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1066.026646][T16443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1066.553151][T16452] o2cb: This node has not been configured. [ 1066.559500][T16452] o2cb: Cluster check failed. Fix errors before retrying. [ 1066.567077][T16452] (syz.4.2946,16452,0):user_dlm_register:674 ERROR: status = -22 [ 1066.575033][T16452] (syz.4.2946,16452,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file1" [ 1067.355008][T16459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2948'. [ 1067.525683][T16460] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2948'. [ 1067.767900][T16467] tmpfs: Bad value for 'mpol' [ 1068.633597][T16467] ftl_cs: FTL header not found. [ 1068.767788][T16467] block2mtd: mtd1: [/dev/loop0] erase_size = 0KiB [1] [ 1069.718423][T16492] kAFS: bad VL server IP address [ 1069.792749][T16496] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1071.207140][T16508] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2963'. [ 1071.472941][T16511] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2963'. [ 1072.033527][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 240 seconds [ 1072.044578][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 240 seconds [ 1072.162075][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 240 seconds [ 1072.173555][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 240 seconds [ 1072.539927][T16497] syz.3.2960 (16497): drop_caches: 2 [ 1073.401572][T16530] Driver unsupported XDP return value 0 on prog (id 131) dev N/A, expect packet loss! [ 1073.417652][T16530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1073.429803][T16530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1073.682019][T14982] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 1073.877723][T14982] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1073.908995][T14982] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 1073.930831][T14982] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.950319][T14982] usb 4-1: Product: syz [ 1073.958462][T14982] usb 4-1: Manufacturer: syz [ 1073.976362][T14982] usb 4-1: SerialNumber: syz [ 1074.276957][T14982] snd-usb-6fire 4-1:1.0: invalid firmware version in device: be b3 00 00. please reconnect to power. if this failure still happens, check your firmware installation. [ 1074.320638][T14982] snd-usb-6fire: probe of 4-1:1.0 failed with error -22 [ 1074.481686][T14982] usb 4-1: USB disconnect, device number 33 [ 1077.246298][T16554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2979'. [ 1077.335974][T16557] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2979'. [ 1078.882890][T16560] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2977'. [ 1079.829784][T16563] syz.4.2981: vmalloc error: size 70368744185856, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz4,mems_allowed=0-1 [ 1079.862351][T16563] CPU: 1 PID: 16563 Comm: syz.4.2981 Not tainted syzkaller #0 [ 1079.870172][T16563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1079.880368][T16563] Call Trace: [ 1079.883751][T16563] [ 1079.886768][T16563] dump_stack_lvl+0x18c/0x250 [ 1079.891714][T16563] ? show_regs_print_info+0x20/0x20 [ 1079.897049][T16563] ? load_image+0x420/0x420 [ 1079.901897][T16563] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1079.908528][T16563] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1079.915080][T16563] warn_alloc+0x246/0x340 [ 1079.919483][T16563] ? zone_watermark_ok_safe+0x230/0x230 [ 1079.925073][T16563] __vmalloc_node_range+0x129/0x1320 [ 1079.930405][T16563] ? __mutex_trylock_common+0x160/0x270 [ 1079.936020][T16563] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1079.942370][T16563] ? rcu_is_watching+0x15/0xb0 [ 1079.947152][T16563] ? trace_contention_end+0x39/0xe0 [ 1079.952368][T16563] ? __mutex_lock+0x30d/0xc80 [ 1079.957155][T16563] ? tomoyo_path_number_perm+0x56b/0x5e0 [ 1079.962860][T16563] ? free_vm_area+0x50/0x50 [ 1079.967393][T16563] ? dvb_demux_do_ioctl+0x317/0x530 [ 1079.972724][T16563] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1079.978223][T16563] ? mutex_lock_nested+0x20/0x20 [ 1079.983222][T16563] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1079.989049][T16563] vmalloc+0x79/0x90 [ 1079.992969][T16563] ? dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1079.999075][T16563] dvb_dmxdev_set_buffer_size+0xbe/0x1f0 [ 1080.004759][T16563] dvb_demux_do_ioctl+0x454/0x530 [ 1080.009815][T16563] dvb_usercopy+0x195/0x2b0 [ 1080.014337][T16563] ? dvb_dmxdev_buffer_read+0x4a0/0x4a0 [ 1080.020117][T16563] ? dvb_generic_ioctl+0xb0/0xb0 [ 1080.025081][T16563] ? dvb_demux_poll+0x210/0x210 [ 1080.030387][T16563] dvb_demux_ioctl+0x29/0x30 [ 1080.034990][T16563] __se_sys_ioctl+0xfd/0x170 [ 1080.039652][T16563] do_syscall_64+0x55/0xb0 [ 1080.044079][T16563] ? clear_bhb_loop+0x40/0x90 [ 1080.048876][T16563] ? clear_bhb_loop+0x40/0x90 [ 1080.053751][T16563] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1080.059670][T16563] RIP: 0033:0x7f3096b9e0d9 [ 1080.064161][T16563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1080.084608][T16563] RSP: 002b:00007f3097b41028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1080.093197][T16563] RAX: ffffffffffffffda RBX: 00007f3096e25fa0 RCX: 00007f3096b9e0d9 [ 1080.101181][T16563] RDX: 0000400000002000 RSI: 0000000000006f2d RDI: 0000000000000003 [ 1080.109221][T16563] RBP: 00007f3096c35024 R08: 0000000000000000 R09: 0000000000000000 [ 1080.117236][T16563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1080.125215][T16563] R13: 00007f3096e26038 R14: 00007f3096e25fa0 R15: 00007fff35fb4528 [ 1080.133214][T16563] [ 1080.172070][T16563] Mem-Info: [ 1080.175395][T16563] active_anon:3288 inactive_anon:52968 isolated_anon:0 [ 1080.175395][T16563] active_file:21724 inactive_file:37176 isolated_file:0 [ 1080.175395][T16563] unevictable:1518 dirty:48 writeback:0 [ 1080.175395][T16563] slab_reclaimable:11676 slab_unreclaimable:95141 [ 1080.175395][T16563] mapped:24995 shmem:51059 pagetables:754 [ 1080.175395][T16563] sec_pagetables:0 bounce:0 [ 1080.175395][T16563] kernel_misc_reclaimable:0 [ 1080.175395][T16563] free:1285356 free_pcp:11834 free_cma:0 [ 1080.351238][T16563] Node 0 active_anon:13152kB inactive_anon:202972kB active_file:86884kB inactive_file:148512kB unevictable:6736kB isolated(anon):0kB isolated(file):0kB mapped:99980kB dirty:192kB writeback:0kB shmem:193900kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12036kB pagetables:3016kB sec_pagetables:0kB all_unreclaimable? no [ 1082.266065][T16563] Node 1 active_anon:0kB inactive_anon:0kB active_file:12kB inactive_file:192kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1082.333757][T16563] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1082.532021][T16563] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1082.537986][T16563] Node 0 DMA32 free:1180464kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:13120kB inactive_anon:271908kB active_file:86244kB inactive_file:148328kB unevictable:1564kB writepending:192kB present:3129332kB managed:2586824kB mlocked:28kB bounce:0kB free_pcp:22272kB local_pcp:21072kB free_cma:0kB [ 1082.576255][T16563] lowmem_reserve[]: 0 0 0 0 0 [ 1082.581183][T16563] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:640kB inactive_file:184kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 1082.615457][T16563] lowmem_reserve[]: 0 0 0 0 0 [ 1082.620289][T16563] Node 1 Normal free:3892632kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:12kB inactive_file:192kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:20688kB local_pcp:9448kB free_cma:0kB [ 1082.673643][T16563] lowmem_reserve[]: 0 0 0 0 0 [ 1082.842479][T16563] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1082.860303][T16563] Node 0 DMA32: 175*4kB (UE) 351*8kB (UE) 290*16kB (UME) 346*32kB (UME) 73*64kB (UME) 407*128kB (UME) 102*256kB (UME) 56*512kB (UM) 6*1024kB (UME) 3*2048kB (UME) 256*4096kB (UM) = 1191636kB [ 1082.889712][T16563] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1082.906979][T16563] Node 1 Normal: 278*4kB (UME) 64*8kB (UME) 34*16kB (UME) 165*32kB (UME) 44*64kB (UE) 11*128kB (UME) 2*256kB (UE) 1*512kB (M) 1*1024kB (E) 2*2048kB (UE) 946*4096kB (M) = 3892632kB [ 1083.436273][T16563] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1083.455390][T16563] Node 0 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1083.466696][T16563] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1083.480356][T16563] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1083.528012][T16563] 122208 total pagecache pages [ 1083.536962][T16563] 0 pages in swap cache [ 1083.541231][T16563] Free swap = 124728kB [ 1083.549009][T16563] Total swap = 124996kB [ 1083.569525][T16563] 2097051 pages RAM [ 1083.579382][T16563] 0 pages HighMem/MovableOnly [ 1083.594286][T16563] 416959 pages reserved [ 1083.605743][T16563] 0 pages cma reserved [ 1083.705868][T16587] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2987'. [ 1083.821740][T16592] comedi comedi4: comedi_config --init_data is deprecated [ 1084.949672][T16606] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2992'. [ 1085.002557][T16608] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2992'. [ 1085.089096][T16610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1085.122857][T16610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1085.155004][T16610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1085.173822][T16610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1086.778420][T16620] jffs2: notice: (16620) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1087.092247][ T5840] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1087.262154][ T5840] usb 2-1: device descriptor read/64, error -71 [ 1088.872152][ T5840] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1090.681946][ T5840] usb 2-1: device descriptor read/64, error -71 [ 1090.812439][ T5840] usb usb2-port1: attempt power cycle [ 1091.334964][T16656] 8021q: adding VLAN 0 to HW filter on device team0 [ 1092.081922][T16656] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1092.547787][T16664] netlink: 'syz.1.3008': attribute type 1 has an invalid length. [ 1092.624472][T16667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1092.633376][T16667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1092.902964][T16674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3004'. [ 1092.914530][T16674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3004'. [ 1093.092122][T14983] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1093.122548][ T5840] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1093.158111][ T5840] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1093.167816][ T5840] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.176122][ T5840] usb 2-1: Product: syz [ 1093.180568][ T5840] usb 2-1: Manufacturer: syz [ 1093.185527][ T5840] usb 2-1: SerialNumber: syz [ 1093.262691][ T173] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1093.304068][T14983] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1093.314360][T14983] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1093.324199][T14983] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1093.334164][T14983] usb 5-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.01 [ 1093.343277][T14983] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1093.355195][T16671] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1093.781560][ T5840] usb 5-1: USB disconnect, device number 35 [ 1093.840493][ T5781] Bluetooth: hci0: Reading Intel version command failed (-71) [ 1094.637835][ T173] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1094.657589][ T173] ath9k_htc: Failed to initialize the device [ 1094.749363][T16679] mmap: syz.1.3011 (16679) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1094.935317][T16684] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3021'. [ 1096.769371][ T173] usb 2-1: ath9k_htc: USB layer deinitialized [ 1096.831467][T16689] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3021'. [ 1096.851944][T14983] usb 2-1: USB disconnect, device number 61 [ 1097.242282][T16694] netlink: 'syz.1.3017': attribute type 1 has an invalid length. [ 1097.270692][T16694] netlink: 'syz.1.3017': attribute type 1 has an invalid length. [ 1097.301008][T16694] netlink: 192 bytes leftover after parsing attributes in process `syz.1.3017'. [ 1097.381582][T16698] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1100.380720][T16715] syz.1.3024 (16715): attempted to duplicate a private mapping with mremap. This is not supported. [ 1103.618743][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 270 seconds [ 1103.629704][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 270 seconds [ 1103.641262][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 270 seconds [ 1103.654678][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 270 seconds [ 1103.664655][T16726] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3027'. [ 1103.718460][T16727] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3027'. [ 1104.482620][T16735] ve: renamed from veth0_vlan [ 1104.632687][T16737] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3028'. [ 1105.462505][ T173] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 1105.752244][ T173] usb 5-1: Using ep0 maxpacket: 16 [ 1105.873543][ T173] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1105.898225][ T173] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1105.909527][ T173] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1105.924799][ T173] usb 5-1: New USB device found, idVendor=045e, idProduct=9994, bcdDevice=fc.3c [ 1105.934507][ T173] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.965860][ T173] usb 5-1: config 0 descriptor?? [ 1109.294543][ T173] usbhid 5-1:0.0: can't add hid device: -71 [ 1109.320979][ T173] usbhid: probe of 5-1:0.0 failed with error -71 [ 1109.346165][ T173] usb 5-1: USB disconnect, device number 36 [ 1109.422254][T16765] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3043'. [ 1109.453885][T16765] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3043'. [ 1110.364451][T16772] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3042'. [ 1110.413148][T16772] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3042'. [ 1112.879344][T13723] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1112.890020][T13723] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1112.902046][T13723] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1112.916537][T13723] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1112.924609][T13723] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1112.932671][T13723] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1114.963463][T16801] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3053'. [ 1115.017839][T16801] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3053'. [ 1115.052187][ T5781] Bluetooth: hci0: command tx timeout [ 1115.082219][T16787] chnl_net:caif_netlink_parms(): no params data found [ 1115.330816][T16787] bridge0: port 1(bridge_slave_0) entered blocking state [ 1115.368628][T16787] bridge0: port 1(bridge_slave_0) entered disabled state [ 1115.398523][T16787] bridge_slave_0: entered allmulticast mode [ 1115.427847][T16787] bridge_slave_0: entered promiscuous mode [ 1115.453179][T16787] bridge0: port 2(bridge_slave_1) entered blocking state [ 1115.473368][T16787] bridge0: port 2(bridge_slave_1) entered disabled state [ 1115.497099][T16787] bridge_slave_1: entered allmulticast mode [ 1116.674992][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.681409][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.713802][T16787] bridge_slave_1: entered promiscuous mode [ 1117.031123][T16787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1117.044530][T16787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1117.083270][T16787] team0: Port device team_slave_0 added [ 1117.163709][ T5781] Bluetooth: hci0: command tx timeout [ 1117.305063][T16787] team0: Port device team_slave_1 added [ 1117.653708][T16787] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1117.660709][T16787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1117.687236][T16787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1117.715373][T16787] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1117.729049][T16787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1117.768266][T16787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1117.936127][T16787] hsr_slave_0: entered promiscuous mode [ 1117.943884][T16787] hsr_slave_1: entered promiscuous mode [ 1119.606858][ T5781] Bluetooth: hci0: command tx timeout [ 1119.880742][T16787] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1119.911534][T16787] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1119.925546][T16787] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1119.956749][T16787] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1120.092879][T12141] usb 5-1: new full-speed USB device number 37 using dummy_hcd [ 1120.137359][T16787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1120.190538][T16787] 8021q: adding VLAN 0 to HW filter on device team0 [ 1120.205997][ T2905] bridge0: port 1(bridge_slave_0) entered blocking state [ 1120.213572][ T2905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1120.235118][ T2905] bridge0: port 2(bridge_slave_1) entered blocking state [ 1120.242330][ T2905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1120.305924][T12141] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1120.336408][T12141] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1120.371978][T12141] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1120.381159][T12141] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.992066][ T5781] Bluetooth: hci0: command tx timeout [ 1122.228456][T12141] usb 5-1: GET_CAPABILITIES returned 0 [ 1122.242192][T12141] usbtmc 5-1:16.0: can't read capabilities [ 1122.375285][T16787] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1122.438509][T12141] usb 5-1: USB disconnect, device number 37 [ 1122.520768][T16850] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3065'. [ 1123.063918][T16787] veth0_vlan: entered promiscuous mode [ 1123.121258][T16787] veth1_vlan: entered promiscuous mode [ 1123.183044][T16787] veth0_macvtap: entered promiscuous mode [ 1123.195997][T16787] veth1_macvtap: entered promiscuous mode [ 1123.248572][T16787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1123.266794][T16787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1123.286952][T16787] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.303336][T16787] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.316822][T16787] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.328839][T16787] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.488682][ T2905] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1123.508301][ T2905] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1123.549713][T14339] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1123.564424][T14339] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1123.823315][T16880] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3074'. [ 1125.959770][T16914] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3090'. [ 1126.061661][T16916] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3091'. [ 1133.422151][T16955] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3106'. [ 1135.017041][T11986] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 300 seconds [ 1135.027991][T11986] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 300 seconds [ 1135.039568][T11986] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 300 seconds [ 1135.050647][T11986] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 300 seconds [ 1135.123851][T16974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1135.133337][T16974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.380315][T16987] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3115'. [ 1138.792028][T16995] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3110'. [ 1142.277314][T17020] jffs2: notice: (17020) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1142.351977][ T28] audit: type=1800 audit(1787234711.041:333): pid=17020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3124" name="control" dev="configfs" ino=50225 res=0 errno=0 [ 1142.484469][ T5810] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 1142.908554][ T5810] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1142.922603][ T5810] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1142.930776][ T5810] usb 6-1: Product: syz [ 1142.935138][ T5810] usb 6-1: Manufacturer: syz [ 1142.939849][ T5810] usb 6-1: SerialNumber: syz [ 1143.106431][ T5810] usb 6-1: config 0 descriptor?? [ 1143.132102][ T5833] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 1143.322096][ T5833] usb 5-1: Using ep0 maxpacket: 32 [ 1143.334240][ T5810] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1143.344418][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1143.355755][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1143.366309][ T5833] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1143.376594][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1143.423286][ T5833] usb 5-1: config 0 descriptor?? [ 1143.449620][ T5833] hub 5-1:0.0: USB hub found [ 1143.660790][ T5833] hub 5-1:0.0: 1 port detected [ 1143.723822][T17038] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3131'. [ 1144.320102][T14984] hub 5-1:0.0: activate --> -90 [ 1144.558650][ C0] raw-gadget.0 gadget.5: ignoring, device is not running [ 1146.671682][T14984] hub 5-1:0.0: hub_ext_port_status failed (err = -32) [ 1146.729045][T14984] usb 5-1-port1: cannot disable (err = -32) [ 1146.751493][ T5810] dvb_usb_rtl28xxu: probe of 6-1:0.0 failed with error -71 [ 1146.766348][ T5810] usb 6-1: USB disconnect, device number 2 [ 1146.942180][T14983] usb 5-1: USB disconnect, device number 38 [ 1147.020332][T17057] jffs2: notice: (17057) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1147.714699][ T28] audit: type=1800 audit(1787234716.411:334): pid=17057 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3136" name="control" dev="configfs" ino=50282 res=0 errno=0 [ 1148.517355][T17076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1148.554648][T17076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.052064][T17078] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3142'. [ 1151.960407][T17097] jffs2: notice: (17097) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1152.059722][ T28] audit: type=1800 audit(1787234720.751:335): pid=17097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3148" name="control" dev="configfs" ino=50337 res=0 errno=0 [ 1152.551900][T14984] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 1152.747543][T14984] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1152.764935][T14984] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1152.776767][T14984] usb 5-1: Product: syz [ 1152.781074][T14984] usb 5-1: Manufacturer: syz [ 1152.813917][T14984] usb 5-1: SerialNumber: syz [ 1152.827537][T14984] usb 5-1: config 0 descriptor?? [ 1153.073258][T14984] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1153.402101][ T5833] usb 2-1: new low-speed USB device number 62 using dummy_hcd [ 1153.597549][ T5833] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1153.616462][ T5833] usb 2-1: config 0 has no interfaces? [ 1153.625533][ T5833] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1153.644955][ T5833] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1153.678474][ T5833] usb 2-1: config 0 descriptor?? [ 1155.825626][T14984] dvb_usb_rtl28xxu: probe of 5-1:0.0 failed with error -110 [ 1155.873459][T12141] usb 2-1: USB disconnect, device number 62 [ 1155.907080][T14984] usb 5-1: USB disconnect, device number 39 [ 1155.977103][T17123] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3156'. [ 1156.783125][T17129] jffs2: notice: (17129) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1158.449764][ T28] audit: type=1800 audit(1787234727.141:336): pid=17129 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3158" name="control" dev="configfs" ino=50382 res=0 errno=0 [ 1161.022025][T14982] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 1161.254161][T14982] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1161.270679][T14982] usb 5-1: config 0 has no interfaces? [ 1161.277512][T14982] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1161.298014][T14982] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1161.344899][T14982] usb 5-1: config 0 descriptor?? [ 1161.563461][ T5810] usb 5-1: USB disconnect, device number 40 [ 1161.652382][T17160] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3168'. [ 1161.764581][T17163] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1161.777478][T17163] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1162.033472][T17165] jffs2: notice: (17165) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1162.103372][ T28] audit: type=1800 audit(1787234730.771:337): pid=17165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3169" name="control" dev="configfs" ino=50442 res=0 errno=0 [ 1165.452904][T16005] block nbd4: Possible stuck request ffff888022090000: control (read@0,1024B). Runtime 330 seconds [ 1165.463898][T16005] block nbd4: Possible stuck request ffff888022090200: control (read@1024,1024B). Runtime 330 seconds [ 1165.493628][T16005] block nbd4: Possible stuck request ffff888022090400: control (read@2048,1024B). Runtime 330 seconds [ 1165.540054][T16005] block nbd4: Possible stuck request ffff888022090600: control (read@3072,1024B). Runtime 330 seconds [ 1166.679049][T17201] jffs2: notice: (17201) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1166.710601][T17203] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3179'. [ 1166.792181][ T28] audit: type=1800 audit(1787234735.481:338): pid=17201 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3180" name="control" dev="configfs" ino=50126 res=0 errno=0 [ 1166.969755][T17208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1166.992491][T17208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1167.372203][T14984] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 1168.996126][T14984] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1169.015845][T14984] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1169.040926][T14984] usb 2-1: Product: syz [ 1169.056020][T14984] usb 2-1: Manufacturer: syz [ 1169.061958][T14984] usb 2-1: SerialNumber: syz [ 1169.080657][T14984] usb 2-1: config 0 descriptor?? [ 1169.306528][T14984] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1170.259934][T17232] jffs2: notice: (17232) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1170.361589][T17237] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3191'. [ 1171.153090][ T28] audit: type=1800 audit(1787234739.841:339): pid=17232 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3189" name="control" dev="configfs" ino=50585 res=0 errno=0 [ 1171.308843][T14984] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 1171.336645][T14984] usb 2-1: USB disconnect, device number 63 [ 1173.262786][T14984] usb 6-1: new low-speed USB device number 3 using dummy_hcd [ 1173.467147][T14984] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1173.479334][T14984] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1173.502370][T14984] usb 6-1: config 0 has no interface number 0 [ 1173.508735][T14984] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1173.535780][T14984] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1173.569537][T14984] usb 6-1: config 0 descriptor?? [ 1173.594006][T14984] iowarrior 6-1:0.1: no interrupt-in endpoint found [ 1173.802763][T14984] usb 6-1: USB disconnect, device number 3 [ 1177.277081][T17279] jffs2: notice: (17279) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1177.394672][ T28] audit: type=1800 audit(1787234746.061:340): pid=17279 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3202" name="control" dev="configfs" ino=50650 res=0 errno=0 [ 1177.536443][T17289] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3206'. [ 1177.615678][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.622142][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.862069][ T5833] usb 2-1: new full-speed USB device number 64 using dummy_hcd [ 1177.898496][T17298] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1177.982554][T17298] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1178.082646][ T5833] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1178.103796][ T5833] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1178.130726][ T5833] usb 2-1: Product: syz [ 1178.138100][ T5833] usb 2-1: Manufacturer: syz [ 1178.146713][ T5833] usb 2-1: SerialNumber: syz [ 1178.158041][ T5833] usb 2-1: config 0 descriptor?? [ 1178.464520][ T5833] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1178.704859][T17289] bridge0: port 2(bridge_slave_1) entered disabled state [ 1178.712593][T17289] bridge0: port 1(bridge_slave_0) entered disabled state [ 1179.885984][ T5833] dvb_usb_rtl28xxu: probe of 2-1:0.0 failed with error -71 [ 1180.784007][ T5833] usb 2-1: USB disconnect, device number 64 [ 1180.992453][T17289] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1181.323229][T17289] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1183.926865][T17289] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.942117][T17289] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.951055][T17289] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.981929][T17289] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1185.312270][ T29] INFO: task udevd:12958 blocked for more than 143 seconds. [ 1185.319683][ T29] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1186.046214][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1186.245762][ T29] task:udevd state:D stack:25752 pid:12958 ppid:5141 flags:0x00004006 [ 1186.291867][ T29] Call Trace: [ 1186.295210][ T29] [ 1186.331834][ T29] __schedule+0x15ae/0x4660 [ 1186.342543][ T29] ? asan.module_dtor+0x20/0x20 [ 1186.379840][ T29] ? mark_lock+0x94/0x320 [ 1186.397556][ T29] ? __lock_acquire+0x7d80/0x7d80 [ 1186.422086][ T29] ? lock_chain_count+0x20/0x20 [ 1186.427080][ T29] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1186.442025][ T29] ? _raw_spin_lock_irqsave+0x100/0x100 [ 1186.447638][ T29] schedule+0xbd/0x170 [ 1186.473638][ T29] io_schedule+0x80/0xd0 [ 1186.478237][ T29] folio_wait_bit_common+0x881/0xfa0 [ 1186.511245][ T29] ? folio_wait_bit+0x30/0x30 [ 1186.516448][ T29] ? _compound_head+0x120/0x120 [ 1186.521412][ T29] ? filemap_add_folio+0x190/0x3d0 [ 1186.526788][ T29] ? __filemap_get_folio+0x71e/0xbe0 [ 1186.532220][ T29] ? blkdev_writepage+0x30/0x30 [ 1186.537255][ T29] do_read_cache_folio+0x1c0/0x7f0 [ 1186.542619][ T29] ? blkdev_writepage+0x30/0x30 [ 1186.547569][ T29] read_part_sector+0xd2/0x350 [ 1186.552513][ T29] adfspart_check_POWERTEC+0x93/0xed0 [ 1186.558043][ T29] ? adfspart_check_ADFS+0x620/0x620 [ 1186.563497][ T29] ? put_partition+0x360/0x360 [ 1186.568400][ T29] ? alloc_pages+0x4e1/0x740 [ 1186.573277][ T29] bdev_disk_changed+0x755/0x1450 [ 1186.578510][ T29] ? bdev_resize_partition+0xf0/0xf0 [ 1186.587664][ T29] ? _atomic_dec_and_lock+0x93/0x120 [ 1186.596999][ T29] ? iput+0x33f/0x900 [ 1186.601118][ T29] blkdev_get_whole+0x30d/0x390 [ 1186.606271][ T29] blkdev_get_by_dev+0x3a9/0x610 [ 1186.611323][ T29] blkdev_open+0x14e/0x360 [ 1186.615995][ T29] do_dentry_open+0x880/0x14b0 [ 1186.621005][ T29] ? blkdev_mmap+0x1b0/0x1b0 [ 1186.625885][ T29] path_openat+0x284f/0x3270 [ 1186.630779][ T29] ? do_sys_openat2+0xda/0x1d0 [ 1186.635688][ T29] ? __x64_sys_openat+0x139/0x160 [ 1186.640805][ T29] ? verify_lock_unused+0x140/0x140 [ 1186.647929][ T29] ? do_filp_open+0x430/0x430 [ 1186.654682][ T29] do_filp_open+0x1f2/0x430 [ 1186.659301][ T29] ? vfs_tmpfile+0x620/0x620 [ 1186.664224][ T29] ? _raw_spin_unlock+0x28/0x40 [ 1186.669217][ T29] ? alloc_fd+0x590/0x640 [ 1186.673756][ T29] do_sys_openat2+0x134/0x1d0 [ 1186.678579][ T29] ? do_sys_open+0xe0/0xe0 [ 1186.683161][ T29] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1186.689373][ T29] ? lock_chain_count+0x20/0x20 [ 1186.696692][ T29] __x64_sys_openat+0x139/0x160 [ 1186.701676][ T29] do_syscall_64+0x55/0xb0 [ 1186.708908][ T29] ? clear_bhb_loop+0x40/0x90 [ 1186.715562][ T29] ? clear_bhb_loop+0x40/0x90 [ 1186.720433][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1186.729030][ T29] RIP: 0033:0x7fc0b5de3407 [ 1186.733653][ T29] RSP: 002b:00007ffd5452cd90 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1186.742221][ T29] RAX: ffffffffffffffda RBX: 00007fc0b5d57880 RCX: 00007fc0b5de3407 [ 1186.750304][ T29] RDX: 00000000000a0800 RSI: 0000559c16fbf8c0 RDI: ffffffffffffff9c [ 1186.758425][ T29] RBP: 0000559c16fae910 R08: 0000000000000000 R09: 0000000000000000 [ 1186.766537][ T29] R10: 0000000000000000 R11: 0000000000000202 R12: 0000559c16fdaa20 [ 1186.774685][ T29] R13: 0000559c16fc6410 R14: 0000000000000000 R15: 0000559c16fdaa20 [ 1186.782900][ T29] [ 1186.786280][ T29] [ 1186.786280][ T29] Showing all locks held in the system: [ 1186.794191][ T29] 1 lock held by khungtaskd/29: [ 1186.799151][ T29] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 1186.809850][ T29] 1 lock held by udevd/12958: [ 1186.814776][ T29] #0: ffff8881417e84c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x11b/0x610 [ 1186.825203][ T29] 1 lock held by syz-executor/14239: [ 1186.830602][ T29] #0: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 [ 1186.842063][ T29] 3 locks held by kworker/u4:22/14339: [ 1186.847714][ T29] #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1186.859828][ T29] #1: ffffc90003ac7d00 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1186.874806][ T29] #2: ffffffff8d137640 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x4c/0x530 [ 1186.886046][ T29] 2 locks held by getty/15331: [ 1186.903873][ T29] #0: ffff88814ccb90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1186.917823][ T29] #1: ffffc900000e22f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 1186.929740][ T29] 2 locks held by kworker/0:7/17319: [ 1186.938813][ T29] #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1186.951496][ T29] #1: ffffc90003977d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1186.964015][ T29] [ 1186.971849][ T29] ============================================= [ 1186.971849][ T29] [ 1186.981995][ T29] NMI backtrace for cpu 1 [ 1186.986356][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1186.993557][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1187.003718][ T29] Call Trace: [ 1187.007045][ T29] [ 1187.009973][ T29] dump_stack_lvl+0x18c/0x250 [ 1187.014669][ T29] ? __wake_up_klogd+0xd9/0x100 [ 1187.019534][ T29] ? show_regs_print_info+0x20/0x20 [ 1187.024841][ T29] ? load_image+0x420/0x420 [ 1187.029362][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 1187.034298][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 1187.040475][ T29] ? load_image+0x420/0x420 [ 1187.044988][ T29] ? wq_watchdog_touch+0xef/0x170 [ 1187.050202][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 1187.056287][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 1187.062619][ T29] watchdog+0xf59/0xfa0 [ 1187.066812][ T29] ? watchdog+0x1e1/0xfa0 [ 1187.071163][ T29] kthread+0x2fa/0x390 [ 1187.075232][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1187.080531][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1187.085143][ T29] ret_from_fork+0x48/0x80 [ 1187.089576][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1187.094180][ T29] ret_from_fork_asm+0x11/0x20 [ 1187.098952][ T29] [ 1187.102154][ T29] Sending NMI from CPU 1 to CPUs 0: [ 1187.107461][ C0] NMI backtrace for cpu 0 [ 1187.107471][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 1187.107486][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1187.107495][ C0] RIP: 0010:__sanitizer_cov_trace_pc+0x10/0x60 [ 1187.107519][ C0] Code: 89 fb e8 13 00 00 00 48 8b 3d fc 0d 05 0d 48 89 de 5b e9 33 a8 57 00 cc cc cc f3 0f 1e fa 48 8b 04 24 65 48 8b 0d c0 45 7c 7e <65> 8b 15 c1 45 7c 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 [ 1187.107532][ C0] RSP: 0018:ffffc90000007f18 EFLAGS: 00000002 [ 1187.107545][ C0] RAX: ffffffff817b0cb1 RBX: 0000000000000004 RCX: ffffffff8ce93440 [ 1187.107555][ C0] RDX: ffffffff8ce93440 RSI: 0000000000000004 RDI: 0000000000000000 [ 1187.107565][ C0] RBP: ffffc90000007fd0 R08: ffffffff8e8c7e2f R09: 1ffffffff1d18fc5 [ 1187.107575][ C0] R10: dffffc0000000000 R11: fffffbfff1d18fc6 R12: 1ffff92000000fe4 [ 1187.107586][ C0] R13: 1ffff110171c581a R14: ffff8880b8e2c0d0 R15: 0000011462a143de [ 1187.107596][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1187.107609][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1187.107620][ C0] CR2: 0000558b0b877000 CR3: 000000007d1d8000 CR4: 00000000003506f0 [ 1187.107633][ C0] Call Trace: [ 1187.107639][ C0] [ 1187.107644][ C0] tick_irq_enter+0x131/0x310 [ 1187.107667][ C0] ? tick_nohz_stop_idle+0x2c0/0x2c0 [ 1187.107687][ C0] ? __irq_exit_rcu+0x115/0x190 [ 1187.107702][ C0] ? irq_exit_rcu+0x20/0x20 [ 1187.107719][ C0] irq_enter_rcu+0x9e/0xf0 [ 1187.107734][ C0] sysvec_apic_timer_interrupt+0x97/0xc0 [ 1187.107755][ C0] [ 1187.107759][ C0] [ 1187.107764][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1187.107782][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 1187.107800][ C0] Code: 19 1a 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 e5 38 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9 [ 1187.107811][ C0] RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2 [ 1187.107822][ C0] RAX: c5a191bff3087200 RBX: ffffffff81630d54 RCX: c5a191bff3087200 [ 1187.107834][ C0] RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d32a0 [ 1187.107848][ C0] RBP: ffffffff8ce07eb8 R08: ffff8880b8e36bab R09: 1ffff110171c6d75 [ 1187.107858][ C0] R10: dffffc0000000000 R11: ffffed10171c6d76 R12: 1ffffffff19c0fbc [ 1187.107869][ C0] R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000 [ 1187.107886][ C0] ? do_idle+0x334/0x5c0 [ 1187.107911][ C0] default_idle+0x13/0x20 [ 1187.107933][ C0] default_idle_call+0x6c/0xa0 [ 1187.107952][ C0] do_idle+0x334/0x5c0 [ 1187.107970][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 1187.107986][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1187.108010][ C0] cpu_startup_entry+0x43/0x60 [ 1187.108026][ C0] rest_init+0x2e2/0x300 [ 1187.108043][ C0] ? time_init+0x40/0x40 [ 1187.108121][ C0] arch_call_rest_init+0xe/0x10 [ 1187.108136][ C0] start_kernel+0x461/0x4e0 [ 1187.108152][ C0] x86_64_start_reservations+0x2a/0x30 [ 1187.108171][ C0] x86_64_start_kernel+0x60/0x60 [ 1187.108189][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 1187.108215][ C0] [ 1187.522094][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 1187.530456][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1187.539436][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1187.550336][ T29] Call Trace: [ 1187.553724][ T29] [ 1187.556689][ T29] dump_stack_lvl+0x18c/0x250 [ 1187.561481][ T29] ? show_regs_print_info+0x20/0x20 [ 1187.566883][ T29] ? load_image+0x420/0x420 [ 1187.571599][ T29] panic+0x2ca/0x720 [ 1187.575612][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 1187.580136][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 1187.585739][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 1187.591138][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 1187.597421][ T29] watchdog+0xf98/0xfa0 [ 1187.601603][ T29] ? watchdog+0x1e1/0xfa0 [ 1187.606045][ T29] kthread+0x2fa/0x390 [ 1187.610134][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1187.615265][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1187.619969][ T29] ret_from_fork+0x48/0x80 [ 1187.624418][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1187.629144][ T29] ret_from_fork_asm+0x11/0x20 [ 1187.633945][ T29] [ 1187.637229][ T29] Kernel Offset: disabled [ 1187.641584][ T29] Rebooting in 86400 seconds..