last executing test programs: 3m4.365244433s ago: executing program 1 (id=5404): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x8, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8007, 0x0, 0x0, 0x0, 0x1000000b}, [@call={0x85, 0x0, 0x0, 0x28}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0x8, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8007, 0x0, 0x0, 0x0, 0x1000000b}, [@call={0x85, 0x0, 0x0, 0x28}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r1, 0x0, 0xe, 0x0, &(0x7f0000000040)="0000100000000300000a6e000000", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x18, 0x25, 0x301, 0x270bd24, 0x25dfdbff, {0x1}, [@nested={0x4, 0xae}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000820000000000000060b4000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000440)={r7, r5, 0x25, 0x0, @val=@tracing={0x0, 0xa}}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x19, 0x4, 0x8, 0xb}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x19, 0x4, 0x8, 0xb}, 0x50) syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) (async) openat$sequencer(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) (async) r8 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$sock_timeval(r9, 0x1, 0x15, 0x0, 0x0) (async) setsockopt$sock_timeval(r9, 0x1, 0x15, 0x0, 0x0) connect$llc(r9, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @remote}, 0x10) 3m3.960969201s ago: executing program 1 (id=5405): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'veth1_vlan\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="2800000010000104feffff7f030000", @ANYRES32=r2, @ANYBLOB="600000008008000008000300", @ANYRES32], 0x35}, 0x1, 0xd, 0x0, 0x480c5}, 0x10) 3m3.774531032s ago: executing program 1 (id=5408): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000020000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 3m3.510840838s ago: executing program 1 (id=5411): socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, &(0x7f0000000340)=ANY=[], &(0x7f0000001500), 0x200) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) brk(0x200000ffc000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mount$fuse(0x0, 0x0, 0x0, 0x80000, 0x0) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) statx(r2, &(0x7f0000000040)='./file0\x00', 0x100, 0x40, &(0x7f0000000180)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000080)={0x1, 0x1, &(0x7f00000000c0)=[r4], &(0x7f00000001c0), &(0x7f00000013c0), 0x0, 0x0, 0x4}) 3m0.45878154s ago: executing program 1 (id=5429): r0 = socket(0x15, 0x5, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000010c0), &(0x7f0000001100)=0x4) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) socket$inet_sctp(0x2, 0x5, 0x84) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r6, 0x8030ae7c, &(0x7f0000000280)) 2m53.465904218s ago: executing program 1 (id=5460): syz_usb_connect(0x0, 0x2b2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) poll(&(0x7f0000000100)=[{r0, 0x400}], 0x1, 0x6) r1 = syz_open_dev$usbfs(0x0, 0x200009, 0x1b1041) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x44, 0x86}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDGKBDIACR(r4, 0x4b4a, 0xffffffffffffffff) 2m43.128244829s ago: executing program 3 (id=5499): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000040000000800000006"], 0x48) r5 = socket$inet6(0xa, 0x80002, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r4, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r5}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xc8ae}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x8000, 0x77}}}}, [@NL80211_ATTR_REKEY_DATA={0x3c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="d7d13258c2d4e05046ab8aaf28c1753674520d803e77564b4ace66e4ab8e7f24"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="57adf0f36d3bf7b0dc79f0258d4e9c23"}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r6}, 0xc) sendmsg$NL80211_CMD_SET_MAC_ACL(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4040845}, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) clock_getres(0x8, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_TIMESTAMP(r10, 0x1, 0x40, &(0x7f0000000300)=0xffffff7f, 0x4) getsockopt$SO_TIMESTAMP(r10, 0x1, 0x40, 0x0, &(0x7f0000000ac0)) ioctl$KVM_CHECK_EXTENSION(r9, 0xae03, 0x38) 2m42.096999629s ago: executing program 3 (id=5500): r0 = socket(0x15, 0x5, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000010c0), &(0x7f0000001100)=0x4) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) socket$inet_sctp(0x2, 0x5, 0x84) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r7, 0x8030ae7c, &(0x7f0000000280)) 2m39.78247911s ago: executing program 3 (id=5503): inotify_init1(0x80800) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x20, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8000) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x4) fcntl$setown(r2, 0x8, r4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="120100002aafee08f00a5167cb75000000010902240001000000000904010002ffffff000905ff000000000000090501"], 0x0) readv(r5, &(0x7f0000000000)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1) r6 = openat$mice(0xffffffffffffff9c, &(0x7f00000001c0), 0x220000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r3, 0x0, 0x0, 0x1}) socket$inet_udplite(0x2, 0x2, 0x88) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000006380)={0x2020}, 0x2020) ioctl$IOC_PR_RESERVE(r7, 0x401070c9, &(0x7f0000000100)={0x7, 0x3, 0x1}) ptrace$getregs(0xc, 0xffffffffffffffff, 0x4, &(0x7f0000000040)=""/20) gettid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r8 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r8, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0) 2m38.447315453s ago: executing program 32 (id=5460): syz_usb_connect(0x0, 0x2b2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) poll(&(0x7f0000000100)=[{r0, 0x400}], 0x1, 0x6) r1 = syz_open_dev$usbfs(0x0, 0x200009, 0x1b1041) ioctl$USBDEVFS_DISCSIGNAL(r1, 0x8010550e, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x44, 0x86}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDGKBDIACR(r4, 0x4b4a, 0xffffffffffffffff) 2m36.499408854s ago: executing program 3 (id=5511): ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x80b40) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x49d, &(0x7f0000000300)={0x0, 0x44df, 0x1, 0x3, 0x33f}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) r4 = inotify_init1(0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f00000000c0)=ANY=[@ANYRES32=r4, @ANYRES16=r3], 0x0) (async) syz_usb_connect(0x3, 0x2d, &(0x7f00000000c0)=ANY=[@ANYRES32=r4, @ANYRES16=r3], 0x0) eventfd(0xfffffff9) (async) eventfd(0xfffffff9) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0xfffffffffffffffc, 0x1000000002, 0x0, 0x0, 0x6}, 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0xfffffffffffffffc, 0x1000000002, 0x0, 0x0, 0x6}, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) io_uring_enter(r1, 0x627, 0x1764, 0x9, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) unshare(0x6020400) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000080)={{0x0, 0x1, 0x0, 0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r6, 0x80605414, &(0x7f0000000400)) (async) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r6, 0x80605414, &(0x7f0000000400)) r7 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x88) r9 = openat$cgroup_int(r8, &(0x7f00000001c0)='cpu.max.burst\x00', 0x2, 0x0) sendfile(r9, r9, 0x0, 0x10000a006) (async) sendfile(r9, r9, 0x0, 0x10000a006) r10 = socket(0x10, 0x803, 0x0) bind$netlink(r10, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r10, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) getsockname$packet(r10, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r5, 0x0, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0xbc, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, 0xe874, 0x8613}, [@IFLA_MTU={0x8}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xae}, @IFLA_VF_PORTS={0x8c, 0x18, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8, 0x1, 0xba0c}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x49}]}, {0x4}, {0x2c, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "e94631ff25a75f0aebfd8f6fb837962a"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "4a56b95585461a5c8fe3a16dc3ef510e"}]}, {0x1c, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x9, 0x2, '\xaa\xaa\xaa\xaa\xaa'}, @IFLA_PORT_PROFILE={0x9, 0x2, '\x06\xe1\xe6\xaa\xaa'}]}, {0x28, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0xa}, @IFLA_PORT_VF={0x8, 0x1, 0x80000000}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "de2a5265daeb2b9c418874f6f1b68aeb"}]}]}]}, 0xbc}}, 0x408c0) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0xbc, 0x10, 0x403, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r11, 0xe874, 0x8613}, [@IFLA_MTU={0x8}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xae}, @IFLA_VF_PORTS={0x8c, 0x18, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8, 0x1, 0xba0c}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x49}]}, {0x4}, {0x2c, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "e94631ff25a75f0aebfd8f6fb837962a"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "4a56b95585461a5c8fe3a16dc3ef510e"}]}, {0x1c, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x9, 0x2, '\xaa\xaa\xaa\xaa\xaa'}, @IFLA_PORT_PROFILE={0x9, 0x2, '\x06\xe1\xe6\xaa\xaa'}]}, {0x28, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0xa}, @IFLA_PORT_VF={0x8, 0x1, 0x80000000}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "de2a5265daeb2b9c418874f6f1b68aeb"}]}]}]}, 0xbc}}, 0x408c0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async) r12 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000000)={0xd000, 0x14000}) accept4$netrom(r12, 0x0, 0x0, 0x800) 2m35.986570953s ago: executing program 3 (id=5513): r0 = socket(0x15, 0x5, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000010c0), &(0x7f0000001100)=0x4) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x20) socket$inet_sctp(0x2, 0x5, 0x84) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0xc831, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_GET_CLOCK(r6, 0x8030ae7c, &(0x7f0000000280)) 2m32.630851416s ago: executing program 3 (id=5521): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x68, 0x0, 0x9, 0x401, 0x0, 0x0, {0xa}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @local}}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4008085}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r1, 0x9b42751aa0f9695, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r3 = syz_open_dev$ndb(&(0x7f00000003c0), 0x0, 0x80200) ioctl$NBD_SET_SIZE(r3, 0xab02, 0x1d09) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r4, 0x40047440, &(0x7f0000001200)) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioperm(0xc6fa, 0x1ff, 0x5) ioperm(0x200, 0x9, 0x7) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000140)={0x474203, 0x5d4}, 0x18) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='com.apple.FinderInfo\x00') r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x106}}, 0x20) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x22, 0x26, {[@global=@item_012={0x2, 0x1, 0x4, 'z>'}, @global=@item_012={0x2, 0x1, 0x0, "0100"}, @global=@item_4={0x3, 0x1, 0xb, "ab205f49"}, @local=@item_4={0x3, 0x2, 0x1, "68a9853e"}, @global=@item_012={0x1, 0x1, 0x8, '8'}, @main=@item_4={0x3, 0x0, 0x8, "0f1137c6"}, @global=@item_4={0x3, 0x1, 0xf1c8ca0ac040f16a, 'QNl1'}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "ce9abc16"}]}}, 0x0}, 0x0) close(0x3) 2m17.306472571s ago: executing program 33 (id=5521): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x68, 0x0, 0x9, 0x401, 0x0, 0x0, {0xa}, [@NFCTH_NAME={0x9, 0x1, 'syz1\x00'}, @NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @local}}}]}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4008085}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r1, 0x9b42751aa0f9695, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r3 = syz_open_dev$ndb(&(0x7f00000003c0), 0x0, 0x80200) ioctl$NBD_SET_SIZE(r3, 0xab02, 0x1d09) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r4, 0x40047440, &(0x7f0000001200)) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioperm(0xc6fa, 0x1ff, 0x5) ioperm(0x200, 0x9, 0x7) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000140)={0x474203, 0x5d4}, 0x18) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='com.apple.FinderInfo\x00') r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000280), 0x106}}, 0x20) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x22, 0x26, {[@global=@item_012={0x2, 0x1, 0x4, 'z>'}, @global=@item_012={0x2, 0x1, 0x0, "0100"}, @global=@item_4={0x3, 0x1, 0xb, "ab205f49"}, @local=@item_4={0x3, 0x2, 0x1, "68a9853e"}, @global=@item_012={0x1, 0x1, 0x8, '8'}, @main=@item_4={0x3, 0x0, 0x8, "0f1137c6"}, @global=@item_4={0x3, 0x1, 0xf1c8ca0ac040f16a, 'QNl1'}, @local=@item_4={0x3, 0x2, 0x2, "b09ea549"}, @main=@item_4={0x3, 0x0, 0x8, "ce9abc16"}]}}, 0x0}, 0x0) close(0x3) 16.166470635s ago: executing program 5 (id=5954): r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x19, 0x5, 0xa, 0x6, 0x5, 0x9}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io(r1, &(0x7f0000000200)={0x2c, &(0x7f0000000000)={0x40, 0x30, 0x15, {0x15, 0xf, "09dd249061893623d8b936ecb824ec4dae52d8"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$caif_stream(0x25, 0x1, 0x1) r6 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x100, 0x3, 0x1d}, &(0x7f00000000c0)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r6, 0x16, &(0x7f0000000040)={&(0x7f0000002000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x60, 0x10, r5, 0x0, 0x0, 0x0, 0x40002202, 0x1, {0x1}}) io_uring_enter(r6, 0x3516, 0x3e000000, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r2, 0x16, 0x0, @void}, 0x10) 12.645206907s ago: executing program 5 (id=5959): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000140)='./bus\x00', 0x0, 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}]}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000940)='./file0\x00', 0x0, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r5, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000140)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={r6}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000000000000000000005000000b7080000000000007b8af8ff00000000b70800000e0000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400f30000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000640)={@map=r6, 0xffffffffffffffff, 0x6, 0x2020, 0xffffffffffffffff, @void, @void, @value=0xffffffffffffffff}, 0x20) mknodat(r4, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) chdir(&(0x7f00000000c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x40, 0x0) mkdir(&(0x7f0000000240)='./bus\x00', 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001500)=ANY=[@ANYBLOB="28000000240007012bbd7000ffdbdf2503740000080001800400de800c0004"], 0x28}}, 0x48010) 11.603606179s ago: executing program 5 (id=5962): socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="2e010000ed454210cd0c99009bf4000203010902120001000000000904"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, &(0x7f0000000340)=ANY=[], &(0x7f0000001500), 0x200) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) brk(0x200000ffc000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mount$fuse(0x0, 0x0, 0x0, 0x80000, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) statx(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x100, 0x40, &(0x7f0000000180)) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(0xffffffffffffffff, 0xc03864bc, &(0x7f0000000080)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f00000001c0), &(0x7f00000013c0), 0x0, 0x0, 0x4}) 10.742458232s ago: executing program 2 (id=5963): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff010000fffffffffffffff50000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 10.627298969s ago: executing program 2 (id=5964): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/15, @ANYRES32=0x0, @ANYBLOB='\x00'/25], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0xffff}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000000), &(0x7f0000000140)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.590281214s ago: executing program 6 (id=5965): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0xff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$vim2m(0x0, 0xa, 0x2) r3 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r3, 0x80079a0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(r4, 0x4, 0x22bc2fc78e92c4cb) modify_ldt$write(0x1, &(0x7f0000000000)={0xfff, 0x100000, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) modify_ldt$write2(0x11, 0x0, 0x0) lseek(r3, 0x0, 0x4) r5 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') preadv(r5, &(0x7f0000000800)=[{&(0x7f0000000140)=""/145, 0x91}], 0x1, 0xfffffffa, 0x3) pread64(r5, 0x0, 0x0, 0x6) r6 = socket$qrtr(0x2a, 0x2, 0x0) bind$qrtr(r6, &(0x7f0000000300)={0x2a, 0x1, 0xfffffffe}, 0xc) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) getpid() ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x7a) 10.422292202s ago: executing program 2 (id=5967): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket(0x2, 0x4, 0x0) socket(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000e00)=[{{&(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000000)=""/64, 0x40}, {&(0x7f0000000340)=""/79, 0x4f}, {&(0x7f00000003c0)=""/202, 0xca}, {&(0x7f0000000200)=""/39, 0x27}], 0x4}, 0x8001}, {{&(0x7f00000005c0)=@caif=@dgm, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000ec0)=""/93, 0x5d}, {&(0x7f00000006c0)=""/251, 0xfb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000880)=""/72, 0x48}, {&(0x7f0000000900)=""/240, 0xf0}], 0x5}, 0x10}, {{&(0x7f0000000a80)=@rc={0x1f, @none}, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000b00)=""/247, 0xf7}, {&(0x7f0000000f40)=""/210, 0xd2}], 0x2, &(0x7f0000000d40)=""/138, 0x8a}, 0x1}], 0x3, 0x40010101, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) unshare(0x28040680) timerfd_create(0x7, 0x0) futex_waitv(&(0x7f00000047c0)=[{0x5, 0x0, 0x82}], 0x1, 0x0, 0x0, 0x1) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000640)={0x9, {0xf8000000, 0x4, 0x2008, 0x4}}) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) writev(r3, &(0x7f00000025c0)=[{&(0x7f0000000240)='4', 0x1}], 0x1) socket$packet(0x11, 0x2, 0x300) write$khugepaged_scan(0xffffffffffffffff, &(0x7f0000000040), 0x8) r4 = socket$alg(0x26, 0x5, 0x0) r5 = socket(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000000606010200000000000000000300000a050001"], 0x28}, 0x1, 0x0, 0x0, 0x8094}, 0xc0) sendmsg$nl_generic(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001e00010202000000000000000a000000"], 0x14}}, 0x0) bind$alg(r4, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x14}}, 0x0) syz_open_dev$I2C(&(0x7f0000000100), 0x3, 0x20400) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) socket(0x1e, 0x4, 0x0) 8.806931104s ago: executing program 6 (id=5969): r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x19, 0x5, 0xa, 0x6, 0x5, 0x9}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io(r1, &(0x7f0000000200)={0x2c, &(0x7f0000000000)={0x40, 0x30, 0x15, {0x15, 0xf, "09dd249061893623d8b936ecb824ec4dae52d8"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = fsmount(0xffffffffffffffff, 0x0, 0x80) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$caif_stream(0x25, 0x1, 0x1) r6 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x100, 0x3, 0x1d}, &(0x7f00000000c0)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r6, 0x16, &(0x7f0000000040)={&(0x7f0000002000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x60, 0x10, r5, 0x0, 0x0, 0x0, 0x40002202, 0x1, {0x1}}) io_uring_enter(r6, 0x3516, 0x3e000000, 0x0, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r2, 0x16, 0x0, @void}, 0x10) 6.147440187s ago: executing program 4 (id=5972): socket$inet6(0xa, 0x3, 0xff) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000140)={0x1, 0x0, [{0x10b, 0x0, 0x1}]}) 6.10787499s ago: executing program 5 (id=5973): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2b, 0x80801, 0x1) sendmsg$NFT_BATCH(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={0x0}}, 0x20000000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_EDID(r2, 0xc0285629, &(0x7f0000000440)={0x0, 0x7, 0x0, '\x00', &(0x7f0000000400)}) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102384, 0x18ff0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x350, 0xffffffff, 0x1b0, 0x0, 0xe0, 0xfeffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xff, 0x0, 0xff000000, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'ip6erspan0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x23, 0x3, 0x2}, 0x2f2, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x4, 0x3}, {0xffffffffffffffff, 0x1, 0x1}, {0x3, 0x5, 0x6}, 0x10000}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}, {{@ipv6={@private0, @rand_addr=' \x01\x00', [0xff, 0x0, 0xff000000], [0x0, 0xffffffff, 0xff000000, 0xffffff00], 'macvtap0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x2c, 0x79, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x9}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4048010) socket(0x10, 0x3, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000480)={0x0, r1}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x10, 0x4, 0x10001, 0x1, 0x28, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5}, 0x50) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) 5.998376091s ago: executing program 4 (id=5974): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000800", @ANYRES32, @ANYBLOB="000000000000000000fdfffff500000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_open_dev$vim2m(0x0, 0x8, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r5, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r4}, 0x20) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x13, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000080000000850000002b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32, @ANYBLOB="0000000000000000b703000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r8, 0x0, 0x12, 0x0, &(0x7f0000000340)="c1dfb080cd21d308098ee6889900", 0x0, 0xadf0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 5.962938106s ago: executing program 2 (id=5975): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000006c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x688, 0x3c8, 0x280, 0x190, 0x3c8, 0x3c8, 0x5b8, 0x5b8, 0x5b8, 0x5b8, 0x5b8, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'wg0\x00', {}, {0xff}, 0x21, 0x0, 0x0, 0x4f}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0xff, 0x0, 0x0, 0x6, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @rand_addr=' \x01\x00', @private2, [0x0, 0xff], [0xffffff00, 0xffffffff, 0xffffff00], [], 0x0, 0x10}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x700, 0x4, 0x7}}]}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast1, 'veth1_to_bridge\x00', {0x6}}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @ipv4={'\x00', '\xff\xff', @empty=0xac00}, [0x0, 0x0, 0xffffff00], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x32}, 0x0, 0x108, 0x148, 0x48000000, {}, [@common=@srh={{0x30}, {0x1d, 0x6, 0x81, 0xb1, 0xd39, 0x16e8, 0x1044}}, @common=@ah={{0x30}, {[0x2, 0x4d5], 0x0, 0x6, 0x3}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x9, 0x2b, @ipv4=@private=0xa010101, 0x4e23}}}, {{@ipv6={@loopback, @local, [0xff, 0x0, 0xff, 0xffffffff], [0xffffff00, 0xff000000, 0xff000000, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x2, 0xfe}}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @inet=@rpfilter={{0x28}, {0x9}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6e8) 5.294331565s ago: executing program 2 (id=5977): socket$netlink(0x10, 0x3, 0x8000000004) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x802, 0x6b929545a606890f) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) r1 = gettid() timer_create(0x8, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)=0x5) pipe(&(0x7f0000000100)) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f00000000c0)='nfs\x00', 0x0, &(0x7f0000000000)='\x04\x00\x00\x00\x04\xb0\xfe\x98\x9a!s\x91]\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}h\xc6\x0e\xd9\v\xda\xbfS\x16 \x04\r\xcd\xdb\x9a\xd4\xaf\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\x02\x000xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0f00000004000000080000000800000000000000", @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffdffd, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000180)="0b032200e0ff25000200475400f6a13bb10000a8880008004803", 0x10000, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x1c4, 0x0, 0xa, 0x3, 0x0, 0x0, {0x8, 0x0, 0x3}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_USERDATA={0xce, 0x6, "e76cb0c8757d1e777ac70757535d5090b7962c80c4ed0cb86afa817bda6da22cb55cc93972f63630236c3eb75cf9a98e1e7f874df90b81cfe433523cc9ce7b0cdecf221930504d7ea63d54fffd1c02ce21ba09d3fde3603ccbedd07a7f75c43ecfeb033d49195477381dae1ac52e7c0daeef6987d92cad92e74762f0015eb6e3a4a8c081ccfe42c74d87c3296eadab7225ce7e04f7ea935fe2c310d53918e62a5291892e5a2b90245bfc44e90f4ab123c3bead97a01b2736af5ae485b9764eda5dfd7bd0cbded408a025"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0xc1, 0x6, "adf4c4006992ced000104859e34575c27e5155d93802721a698484975c418a3a25b73879f505af87bc002b36ce42f445fb9a06c32936bc1c3d0347a6e54594122c375b73ef3b36e8b3a08a9c0643bd1778f45d042310d0a7a5852464001abe5f716006f890051f9889ca562ffc221bff11582bd7fd8b98ff3be3ceb726d6ba9c21ebfc442524ef7ac95b44a3dc7086c189fc0055cc0d0f69d5f6b20b7091830a3e14b696fee04f3a2918d88d6f245e48ec85ed4c4a56625d11ce0f1d78"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x1ec}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r8, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r7, {0xdbd}}, './file0\x00'}) 2.563859024s ago: executing program 0 (id=5987): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000c40)='hybla', 0x5) sendmmsg$inet(r0, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000", 0x41}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035", 0x107}], 0x2}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000b80)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5eda1ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb56343f3eded2dca93ed6641", 0xb0}, {&(0x7f0000000d00)="31cef842d9c50636f60fc0cfdac56c75f1687f0c56287423f5eed69f117e766bdbad0c2171ad6227e1173ab6efa2fcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbe385ea382294882839a22674037b8910bd8a1420e33eb1be6f10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba9547e1e343b451d9025c4e153612d4674b9411fb4de295599abbcb388d291aa839ab0954e6a8dfc19c3c1533a11d81e03a4879bd736f1caacc2bbf1194598a652677efb930a5b6ee292c57402e0cc07a9a26ee794e46e604a9aec550d12af09f782e1f6a996f0756604847689d37ee3047e61531a8672447cb501b2560bc0e0c5fb2c9f341ed3972b30190e930af9", 0x105}], 0x2}}, {{0x0, 0x0, &(0x7f0000000a00)=[{0x0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000001e00)="d17d33c9b319aa0962eaa09c3dbe11d5e7d3d4e324f055383c8c9731038e18920eec700b840c1b66109d8d82e6ac5b5010281b3efc548f1d10be8fb9324ba2b103d62099142a18c824deef7e121e3c7212485ae3f167ce4c2324d8fdd56d0ae4b53010e9150250ddc9f7200f39514393c526fb184cdf7aa8a00b562f7e6a57434f2c72de36cb5f6fc70c46d4471b159b6933ea39e5965aacbe7287d1fcb24fb4cbdba522eb4fe54165ef946c62c04b0717e5fa02149dd959590114ddb7e9f65c936d48710b6e99150ce0a856c66901008ee0d87ae204d39c911d682d23268a116eff5a4968b827bc918dfe9b99a16268b5f053d2277ddf668128276591b49ec43664161e06c2f66e67d56429b82659b994e85aa51cfe1d4ee71b41b2a6cd5642af01d9d98469cbbea90d38199a32b5d9ad386eceeb92ee65826a038a1e82adbf48cbdb349ccc8726a5bf64a84413b3849959dd882afadd7d7fc1f3a67c48699f057608bee796e2ad055e1d93a9c3a7286cc076c5537b5dd5f7a9ac29a176d170e784efa68dabf6b9fd9f9fd5598599dbdbad4c36d2bb38c0437c4c15c698b59ac652bd964cba668aa8ce9e1eff68f0e0fb27ab3a2af4a22d24387e85a0f8271a14afcaa55c02bd1ba1da24a0911dd554901d706de6e507b9ebc64d7ca1114f1c113414a7e2526829069b0230875ba231425b230ce63d17dcd268321182009007007ed8c84fe10182186fb17f9468d5954ae17d85222e7f132695750359953157ce468d471371a33705a882fbd8a66f79e9e17cca23604df60a0d19a18d00abdc50f45657a92b78f4d7814a70854f26798aef24d0553a7892cafb7da4217bbe8402cd2390a1d4044067205d31658e1e5072d9592caf3dcf1e3a9d8f2122c255b515ddcbfbd16ee16e73852b92d5fcc6e29903c2ecfb1cc807788c58d120fc369cb2fc476061ea845d9f33fa5f33020bc8e32135affd1a078aaf81cc738c0a4ca6110b10c13c7bd26b254547b8d7e38bed4010c81684d6ab5d26f709a30be961248103fba6394655cec6329b9498b6adb950fb6dfa3d3dff269b8d6dffe3d6106e0ce87e0e5ccb7e7dcc66d594d1cd08a7ecfa81ec65293b5b842d4d68688ac46802935288f4bb448cf3ceeb3b6d5b96c038a6c1704ce60d35546dd5a62263b8de79442ae5834a1ddf8308a8b342f06860cda4c67dd58892f91cffe6dc2423135cdda00e2b934ca8df672f2535ca7b34536c5c733f8ebf22eb5ba8d304febbd1cd524bb3de967afc792c72b62953d79b03ed84abb78dbfd464d8760f491482bc0fad74375eb883436ec6dc349de5d481d0f69084715b3e68041e92d977a79da1113eebdf1d46e0c80ce8cc1476363333b96688d0643c9a50c914d16ee92ea95472712fb755c17a8fa8fcc5cd6329a4c43cd2cd39cd627106984b1347612d4e50740b0e91bab5a4c7a7f539ac6d67d3b70b95b722a902fef8a3b54beb758cf9e81d57b79fddef2245dc", 0x428}, {0x0}], 0x2}}], 0x4, 0x2090) 2.56270241s ago: executing program 6 (id=5988): syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) r0 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRESDEC=r0, @ANYRES64=r0], 0x30}, 0x1, 0x0, 0x0, 0x41}, 0x0) r1 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) io_uring_setup(0x4a86, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r3, 0x0, 0x0) connect$llc(r3, &(0x7f0000000040)={0x1a, 0x1, 0x0, 0x0, 0xe, 0x29, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}}, 0x10) syz_init_net_socket$llc(0x1a, 0x801, 0x0) socket$tipc(0x1e, 0x2, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001030000000904"], 0x0) 2.519940703s ago: executing program 4 (id=5989): syz_usb_connect$uac1(0x4, 0xb1, &(0x7f0000000300)=ANY=[@ANYRES16=0x0, @ANYRESOCT=0x0, @ANYRES16=0x0], 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000009b768405e0483020b9901e40201090227000100000000090400fb015cc7aa00090509"], 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) syz_open_dev$sg(0x0, 0x0, 0x8002) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r5, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r6, 0x10, 0x101}, 0xc) sched_setattr(0x0, 0x0, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x40) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000006c0)={0x34, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x800) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) waitid(0x0, 0x0, &(0x7f0000002ff9), 0x0, 0x0) r8 = mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) mq_notify(r8, &(0x7f0000000200)={0x0, 0x8, 0x1}) mq_timedsend(r8, 0x0, 0x0, 0xa, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x7a, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001020000402505a1a440000102030109026800020101507f0904000001020d00000a24060001183861f1bc052400060000000f017f000000070004000506241a09000f07240a0708057f0905810300025b02030904010000020dedff0804010102020d0000090582022000fc02e30905030220000208ff"], &(0x7f00000002c0)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x6, 0x80, 0x6, 0x20, 0x8}, 0xb9, &(0x7f0000000180)=ANY=[@ANYBLOB="050fb9000507100206ed03000a10030004000428020007100210270000991002842a2b36dfa72e8e11550cf380bc900f2808b08a8ea729ca5ffa9004250893d17496fcf5ad3eff0c2f210a7a849056d3abcd695b1943f4bfe488352ac9a1c394eea344885d569c1cfabbf59e727066e28f128fd269b5ac222bdb7a59e6caf3e900d9680db86cae1d71efbd2d90a5d1fa1fe8abad4d0f75e83107daf6929f8dd6ce98c90f2479b7aafa8f1ebbdf5ddc112c9cb8bc055203100b"], 0x1, [{0x47, &(0x7f0000000240)=@string={0x47, 0x3, "dbb4def644070ac617aed1ab82682353cf7363262a54f2aa1cd85f210f68e5a146091c03df1d27878215048e3f012784437d5beb930083ad50f57b9f6fc663da5acd00bdee"}}]}) 1.570256871s ago: executing program 0 (id=5990): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_REVISION={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x4080}, 0x80) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x11) 1.514225046s ago: executing program 0 (id=5991): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e40030000000000650602f000cd000071187c0000000000c3640000f10000007b0a00fe00000000850000002e00000079af0000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) 1.453653267s ago: executing program 0 (id=5992): r0 = socket$igmp6(0xa, 0x3, 0x2) mq_open(0x0, 0x42, 0x197, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0xfff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400fffffff3208500000025000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_EXPR={0x14, 0x11, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)}, 0x20000041) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) getsockopt(0xffffffffffffffff, 0x10117, 0xfbfffffe, 0x0, 0x0) bind$inet6(r0, &(0x7f0000004540)={0xa, 0x4e21, 0x3, @loopback, 0x80000001}, 0x1c) syz_open_procfs(0x0, &(0x7f0000000000)='net/xfrm_stat\x00') 1.350489638s ago: executing program 5 (id=5993): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @empty}], 0x10) pipe2(&(0x7f00000001c0), 0x4080) vmsplice(r0, &(0x7f0000001cc0)=[{&(0x7f00000000c0)="081a", 0x2}], 0x1, 0x1) (async) syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x4ae60) (async) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x1e, 0x0, 0x0) (async) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x804, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(r3, 0x1, 0x9, &(0x7f0000000200)=0x6, 0x4) (async) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, 0x0) (async) r4 = gettid() timer_create(0x0, &(0x7f0000000240)={0x0, 0x22, 0x1, @tid=r4}, &(0x7f0000000100)) (async) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async, rerun: 64) r5 = userfaultfd(0x801) (rerun: 64) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x38}) (async) socket(0xa, 0x3, 0x3a) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = getpid() (async, rerun: 64) r7 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) (async) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) (async) syz_open_dev$video4linux(&(0x7f0000000280), 0xa, 0x0) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) 998.86693ms ago: executing program 0 (id=5994): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(r1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_IOVA_RANGES(r3, 0x3b84, &(0x7f0000000640)={0x20, r4, 0x7, 0x0, &(0x7f0000000680)=[{}, {}, {}, {}, {}, {}, {}]}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r3, 0x3b82, &(0x7f0000000180)={0x18, r4, 0x2, 0x0, &(0x7f00000001c0)=[{0x0, 0x1}, {0x3, 0x5}]}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000200)={0x28, 0x7, r4, 0x0, &(0x7f0000000240)='LLLLLLLLLLLLLLLLLLLLLLLLL', 0x19, 0x1c}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000280)={0x18, r4}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f00000002c0)={0xffffffffffffffbc, 0x5, 0x0, 0x0, &(0x7f0000000000)='LLHLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x2}) ioctl$IOMMU_IOAS_UNMAP(r3, 0x3b86, &(0x7f0000000600)={0x18, r4, 0xeef, 0x1c}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000380)={0xfcc5, 0x7, r4, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x15c2}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f00000003c0)={0x18, r4}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0xffffff7d, 0x0, r5, 0x0, &(0x7f0000000700)="4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c4c95de8176009b590c0561997d304612e1473821a9a287b825b7e067fa8039abd6dcc5508f52fa4e0fcb4deece62447d116ffe530f9c2a3730339953131b", 0x59, 0x2}) ioctl$IOMMU_IOAS_UNMAP(r3, 0x3b86, &(0x7f0000000500)={0x18, r5, 0x4, 0x5}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 0s ago: executing program 0 (id=5995): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x74}, 0x1, 0x0, 0xf5ff}, 0x0) kernel console output (not intermixed with test programs): =1326 audit(1773738012.210:2038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.024273][T27372] veth3: entered promiscuous mode [ 1521.029401][T27372] veth3: entered allmulticast mode [ 1521.063748][ T30] audit: type=1326 audit(1773738012.210:2039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.162283][ T30] audit: type=1326 audit(1773738012.220:2040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.236519][ T30] audit: type=1326 audit(1773738012.220:2041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.374957][ T30] audit: type=1326 audit(1773738012.220:2042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.421186][T27380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1521.431939][T27380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1521.655213][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 1521.655228][ T30] audit: type=1326 audit(1773738012.955:2073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.691974][ T30] audit: type=1326 audit(1773738013.039:2074): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27367 comm="syz.0.5548" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1521.701611][T23899] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1521.737845][T10592] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1521.739757][T23899] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1521.754320][T23899] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1521.761920][T23899] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1521.772630][T23899] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1521.909779][T10592] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1521.929437][T10592] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1521.966490][T10592] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 1522.014170][T10592] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1522.091011][T10592] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1522.108959][T10592] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1522.115825][ T6105] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1522.116954][T10592] usb 6-1: Product: syz [ 1522.129618][ T6105] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1522.175335][T10592] usb 6-1: Manufacturer: syz [ 1522.180026][T10592] usb 6-1: SerialNumber: syz [ 1522.196891][T10592] usb 6-1: config 0 descriptor?? [ 1522.223598][T10592] garmin_gps 6-1:0.0: Garmin GPS usb/tty converter detected [ 1522.251097][T10592] garmin_gps ttyUSB0: garmin_write_bulk - usb_submit_urb(write bulk) failed with status = -8 [ 1522.283057][T10592] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -8 [ 1522.293336][ T6105] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1522.304249][ T6105] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1522.413779][ T6105] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1522.428068][ T6105] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1522.440847][T27392] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5555'. [ 1522.604117][ T792] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 1522.763807][ T792] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1522.808004][ T792] usb 1-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.00 [ 1522.852440][ T792] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1522.872863][ T6105] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1522.892706][ T792] usb 1-1: config 0 descriptor?? [ 1522.900054][ T6105] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1522.915743][ T792] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1523.114802][T27386] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1523.147466][T27386] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1523.197470][T27386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5554'. [ 1523.266189][T27383] chnl_net:caif_netlink_parms(): no params data found [ 1523.403232][T27386] vlan2: entered allmulticast mode [ 1523.418869][T27386] team0: entered allmulticast mode [ 1523.432689][T27386] team_slave_1: entered allmulticast mode [ 1523.543452][T27412] ÿÿÿÿ: renamed from veth1_vlan (while UP) [ 1523.576265][ T6105] bridge0: port 3(batadv0) entered disabled state [ 1523.646402][ T6105] bridge_slave_1: left allmulticast mode [ 1523.700113][ T6105] bridge0: port 2(bridge_slave_1) entered disabled state [ 1523.760493][ T6105] bridge_slave_0: left allmulticast mode [ 1523.768227][T23899] Bluetooth: hci2: command tx timeout [ 1523.790205][ T6105] bridge_slave_0: left promiscuous mode [ 1524.088379][ T6105] bridge0: port 1(bridge_slave_0) entered disabled state [ 1524.188244][T22984] usb 1-1: USB disconnect, device number 47 [ 1524.692861][ T6105] bond1 (unregistering): Released all slaves [ 1524.713575][ T6105] smc: removing net device bond0 with user defined pnetid SYD2 [ 1524.726186][ T6105] bond0 (unregistering): Released all slaves [ 1524.743513][ T6105] bond2 (unregistering): Released all slaves [ 1525.032642][T10592] usb 6-1: USB disconnect, device number 2 [ 1525.087141][T10592] garmin_gps 6-1:0.0: device disconnected [ 1525.244810][T27383] bridge0: port 1(bridge_slave_0) entered blocking state [ 1525.263935][T27383] bridge0: port 1(bridge_slave_0) entered disabled state [ 1525.271146][T27383] bridge_slave_0: entered allmulticast mode [ 1525.310936][T27383] bridge_slave_0: entered promiscuous mode [ 1525.331946][T27455] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5563'. [ 1525.348841][T27383] bridge0: port 2(bridge_slave_1) entered blocking state [ 1525.366706][T27383] bridge0: port 2(bridge_slave_1) entered disabled state [ 1525.373937][T27383] bridge_slave_1: entered allmulticast mode [ 1525.439992][T27383] bridge_slave_1: entered promiscuous mode [ 1525.596064][T27460] netlink: 104 bytes leftover after parsing attributes in process `syz.5.5564'. [ 1525.748032][T23899] Bluetooth: hci2: command tx timeout [ 1526.985950][T27383] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1527.017264][T27383] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1527.483729][ T5823] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1527.495463][ T5823] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1527.504995][ T30] audit: type=1400 audit(1773738019.138:2075): avc: denied { map } for pid=27475 comm="syz.5.5569" path="socket:[109759]" dev="sockfs" ino=109759 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1527.529619][ T5823] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1527.540734][ T5823] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1527.559922][T27473] bridge0: port 3(syz_tun) entered blocking state [ 1527.565961][ T30] audit: type=1400 audit(1773738019.138:2076): avc: denied { read accept } for pid=27475 comm="syz.5.5569" path="socket:[109759]" dev="sockfs" ino=109759 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1527.568407][T27473] bridge0: port 3(syz_tun) entered disabled state [ 1527.602739][ T5823] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1527.626425][T27473] syz_tun: entered allmulticast mode [ 1527.711107][T27473] syz_tun: entered promiscuous mode [ 1527.727568][T27383] team0: Port device team_slave_0 added [ 1527.739701][T23899] Bluetooth: hci2: command tx timeout [ 1527.749601][T27383] team0: Port device team_slave_1 added [ 1527.767006][T10592] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1527.795432][ T6105] hsr_slave_0: left promiscuous mode [ 1527.801641][ T6105] hsr_slave_1: left promiscuous mode [ 1527.807539][ T6105] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1527.815885][ T6105] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1527.833878][ T6105] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1527.841242][ T6105] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1527.851733][ T6105] veth1_macvtap: left promiscuous mode [ 1527.863153][ T6105] veth0_macvtap: left promiscuous mode [ 1527.880087][ T6105] ÿÿÿÿ: left promiscuous mode [ 1527.893561][ T6105] veth0_vlan: left promiscuous mode [ 1527.931147][T10592] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1527.956017][T10592] usb 6-1: string descriptor 0 read error: -22 [ 1527.978512][T10592] usb 6-1: New USB device found, idVendor=28bd, idProduct=0078, bcdDevice= 0.40 [ 1528.005240][T10592] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1528.258959][ T6105] team0 (unregistering): Port device team_slave_1 removed [ 1528.295758][ T6105] team0 (unregistering): Port device team_slave_0 removed [ 1528.452509][T10592] uclogic 0003:28BD:0078.0039: interface is invalid, ignoring [ 1528.579856][T27383] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1528.589836][T27383] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1528.624697][T27383] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1528.663686][T27383] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1528.675342][T27383] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1528.742216][T27383] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1528.742307][T27495] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5573'. [ 1528.899900][T27383] hsr_slave_0: entered promiscuous mode [ 1528.908883][T27383] hsr_slave_1: entered promiscuous mode [ 1528.928060][T27383] debugfs: 'hsr0' already exists in 'hsr' [ 1528.948082][T27383] Cannot create hsr debugfs directory [ 1529.091281][T22984] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1529.091814][ T6105] IPVS: stop unused estimator thread 0... [ 1529.255740][T22984] usb 3-1: config 1 interface 0 altsetting 6 endpoint 0x82 has invalid maxpacket 1568, setting to 1024 [ 1529.301221][T22984] usb 3-1: config 1 interface 0 altsetting 6 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1529.329703][T22984] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1529.344624][T22984] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1529.364790][T22984] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1529.391180][T22984] usb 3-1: Product: ã  [ 1529.398752][T22984] usb 3-1: Manufacturer: á¦â¯‹â…ћꠕ逻೙åŸíŠƒéŠµÊ¡èŸ²ì„‘氲⨗묯싚︗鿛 [ 1529.419193][T22984] usb 3-1: SerialNumber: Ñ… [ 1529.445158][T27498] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1529.530519][T27474] chnl_net:caif_netlink_parms(): no params data found [ 1529.558628][T23899] Bluetooth: hci4: command tx timeout [ 1529.710454][T23899] Bluetooth: hci2: command tx timeout [ 1529.773712][T27474] bridge0: port 1(bridge_slave_0) entered blocking state [ 1529.796234][T27474] bridge0: port 1(bridge_slave_0) entered disabled state [ 1529.803459][T27474] bridge_slave_0: entered allmulticast mode [ 1529.825833][T27474] bridge_slave_0: entered promiscuous mode [ 1529.840433][T27474] bridge0: port 2(bridge_slave_1) entered blocking state [ 1529.856358][ T30] audit: type=1400 audit(1773738021.595:2077): avc: denied { read } for pid=27497 comm="syz.2.5574" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1529.862947][T27474] bridge0: port 2(bridge_slave_1) entered disabled state [ 1529.900951][T27474] bridge_slave_1: entered allmulticast mode [ 1529.911555][T27474] bridge_slave_1: entered promiscuous mode [ 1529.986500][T27474] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1530.022173][T27474] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1530.123225][T27474] team0: Port device team_slave_0 added [ 1530.132129][T27474] team0: Port device team_slave_1 added [ 1530.173831][T27383] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1530.194721][T27383] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1530.207467][T27474] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1530.218106][T27474] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1530.245016][T27474] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1530.256317][T27383] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1530.269523][T27474] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1530.276802][T27474] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1530.303380][T27474] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1530.315809][T27383] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1530.363815][ T5813] usb 6-1: USB disconnect, device number 3 [ 1530.386362][ T792] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 1530.471117][T27474] hsr_slave_0: entered promiscuous mode [ 1530.492442][T27474] hsr_slave_1: entered promiscuous mode [ 1530.508546][T27474] debugfs: 'hsr0' already exists in 'hsr' [ 1530.532876][T27474] Cannot create hsr debugfs directory [ 1530.539396][ T792] usb 1-1: Using ep0 maxpacket: 16 [ 1530.554893][ T792] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 1530.581036][ T792] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1530.670262][ T792] usb 1-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice=82.8f [ 1530.683470][ T792] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1530.693753][ T792] usb 1-1: Product: syz [ 1530.885794][ T792] usb 1-1: Manufacturer: syz [ 1530.898259][ T792] usb 1-1: SerialNumber: syz [ 1530.921878][ T792] usb 1-1: config 0 descriptor?? [ 1531.080686][ T792] kobil_sct 1-1:0.0: KOBIL USB smart card terminal converter detected [ 1531.186322][ T792] usb 1-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1531.540693][T23899] Bluetooth: hci4: command tx timeout [ 1531.716270][T27498] [U] ^A [ 1531.772313][T22984] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 100 if 0 alt 6 proto 1 vid 0x0525 pid 0xA4A8 [ 1531.863894][T22984] usb 3-1: USB disconnect, device number 100 [ 1532.437846][T22984] usblp0: removed [ 1532.609984][T27383] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1532.654018][T26361] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1532.893417][T26361] usb 6-1: Using ep0 maxpacket: 32 [ 1532.906719][T27383] 8021q: adding VLAN 0 to HW filter on device team0 [ 1532.925506][T26361] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1532.961909][T26361] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1532.975208][T20020] bridge0: port 1(bridge_slave_0) entered blocking state [ 1532.982357][T20020] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1533.001097][T26361] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1533.010954][T26361] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1533.024056][T20020] bridge0: port 2(bridge_slave_1) entered blocking state [ 1533.031147][T20020] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1533.041056][T26361] usb 6-1: Product: syz [ 1533.048489][T26361] usb 6-1: Manufacturer: syz [ 1533.054649][T26361] usb 6-1: SerialNumber: syz [ 1533.074487][T26361] usb 6-1: config 0 descriptor?? [ 1533.083232][T27474] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1533.084008][T26361] usb 6-1: no audio or video endpoints found [ 1533.152549][T27474] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1533.223919][T27474] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1533.281671][T27474] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1533.442875][T10592] usb 1-1: USB disconnect, device number 48 [ 1533.467674][T10592] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1533.480544][T27383] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1533.512260][T10592] kobil_sct 1-1:0.0: device disconnected [ 1533.520657][T23899] Bluetooth: hci4: command tx timeout [ 1533.543540][T27574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1533.580370][T27574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1533.645404][T27574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1533.697701][T27574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1533.752368][T27474] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1533.868419][T10592] usb 6-1: USB disconnect, device number 4 [ 1533.883781][T27474] 8021q: adding VLAN 0 to HW filter on device team0 [ 1533.933111][T26011] bridge0: port 1(bridge_slave_0) entered blocking state [ 1533.940238][T26011] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1534.009859][ T6105] bridge0: port 2(bridge_slave_1) entered blocking state [ 1534.016982][ T6105] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1534.105635][T27383] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1534.404948][T27474] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1534.495087][T27474] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1534.562273][ T30] audit: type=1400 audit(1773738026.550:2078): avc: denied { map } for pid=27625 comm="syz.5.5585" path="socket:[110478]" dev="sockfs" ino=110478 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 1535.141588][T27650] syzkaller0: entered promiscuous mode [ 1535.167776][T27650] syzkaller0: entered allmulticast mode [ 1535.476850][T27474] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1535.502721][T23899] Bluetooth: hci4: command tx timeout [ 1535.674457][T27383] veth0_vlan: entered promiscuous mode [ 1535.742904][T27383] veth1_vlan: entered promiscuous mode [ 1535.893772][T26361] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1536.296203][T27383] veth0_macvtap: entered promiscuous mode [ 1536.454386][T26361] usb 1-1: Using ep0 maxpacket: 32 [ 1536.464432][T26361] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1536.494397][T27383] veth1_macvtap: entered promiscuous mode [ 1536.569156][T26361] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1536.637706][T27383] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1536.687446][T26361] usb 1-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1536.778420][T26361] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1536.826067][T26361] usb 1-1: Product: syz [ 1536.837593][T26361] usb 1-1: Manufacturer: syz [ 1536.855125][T26361] usb 1-1: SerialNumber: syz [ 1536.931268][T26361] usb 1-1: config 0 descriptor?? [ 1536.954701][T26361] usb 1-1: no audio or video endpoints found [ 1536.964247][T27383] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1537.053867][T27474] veth0_vlan: entered promiscuous mode [ 1537.092890][T19490] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1537.140905][ T8900] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1537.162019][ T8900] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1537.188349][ T5813] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1537.219844][ T8900] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1537.233734][ T8900] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1537.261544][T27474] veth1_vlan: entered promiscuous mode [ 1537.274579][T19490] usb 3-1: Using ep0 maxpacket: 32 [ 1537.281266][T19490] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1537.309104][T19490] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1537.349737][T19490] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1537.370550][ T5813] usb 6-1: Using ep0 maxpacket: 32 [ 1537.382634][ T5813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1537.396119][T19490] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1537.424114][ T5813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1537.494107][T27706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1537.501351][T19490] usb 3-1: config 0 descriptor?? [ 1537.521126][ T5813] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1537.532504][T27474] veth0_macvtap: entered promiscuous mode [ 1537.578234][ T5813] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1537.619364][T27706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1537.627801][T27474] veth1_macvtap: entered promiscuous mode [ 1537.638099][ T5813] usb 6-1: config 0 descriptor?? [ 1537.657572][T19490] hub 3-1:0.0: USB hub found [ 1537.663016][T27673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1537.682806][ T5813] hub 6-1:0.0: USB hub found [ 1537.711152][T27673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1537.752639][T19490] hub 3-1:0.0: 9 ports detected [ 1537.764920][T27474] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1537.781241][T19490] hub 3-1:0.0: insufficient power available to use all downstream ports [ 1537.819463][T26011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1537.838632][T26011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1537.851498][ T5813] hub 6-1:0.0: 9 ports detected [ 1537.867781][ T5813] hub 6-1:0.0: insufficient power available to use all downstream ports [ 1537.911236][T27474] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1537.922904][T18148] usb 1-1: USB disconnect, device number 49 [ 1538.024790][T26011] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.053840][T26011] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.113363][T26011] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.153194][ T8902] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1538.170880][T26011] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1538.190104][ T8902] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1538.508264][ T8902] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1538.571060][ T8902] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1538.689924][T26011] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1538.732677][T26011] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1538.874564][ T5813] hub 6-1:0.0: hub_hub_status failed (err = -32) [ 1538.881335][T19490] hub 3-1:0.0: hub_hub_status failed (err = -32) [ 1538.897750][ T5813] hub 6-1:0.0: config failed, can't get hub status (err -32) [ 1538.910300][T19490] hub 3-1:0.0: config failed, can't get hub status (err -32) [ 1539.426765][ T5813] usbhid 6-1:0.0: can't add hid device: -32 [ 1539.432979][T19490] usbhid 3-1:0.0: can't add hid device: -32 [ 1539.448132][ T5813] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 1539.458000][T19490] usbhid 3-1:0.0: probe with driver usbhid failed with error -32 [ 1540.141188][T27733] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5600'. [ 1540.847406][T10592] usb 3-1: USB disconnect, device number 101 [ 1540.975408][T26361] usb 6-1: USB disconnect, device number 5 [ 1540.990525][T27773] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1541.555056][ T5877] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1541.760061][ T5877] usb 5-1: Using ep0 maxpacket: 32 [ 1541.793964][ T5877] usb 5-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 1541.848645][ T5877] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1541.886169][ T5877] usb 5-1: Product: syz [ 1541.912343][ T5877] usb 5-1: Manufacturer: syz [ 1541.941433][ T5877] usb 5-1: SerialNumber: syz [ 1541.962859][ T5877] usb 5-1: config 0 descriptor?? [ 1541.992821][ T5877] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 1542.035289][ T5877] dvb-usb: bulk message failed: -22 (4/0) [ 1542.042384][T24044] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1542.095344][ T5877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1542.106155][T27800] ÿÿÿÿ: renamed from veth1_vlan (while UP) [ 1542.124755][ T5877] dvb-usb: bulk message failed: -22 (5/0) [ 1542.141999][ T5877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1542.198255][ T5877] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1542.223255][T27809] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5611'. [ 1542.236369][T24044] usb 7-1: device descriptor read/64, error -71 [ 1542.261978][ T5877] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 1542.285886][T19794] block nbd3: Possible stuck request ffff888028038000: control (read@0,1024B). Runtime 180 seconds [ 1542.296743][T19794] block nbd3: Possible stuck request ffff888028038200: control (read@1024,1024B). Runtime 180 seconds [ 1542.309638][T19794] block nbd3: Possible stuck request ffff888028038400: control (read@2048,1024B). Runtime 180 seconds [ 1542.321777][T19794] block nbd3: Possible stuck request ffff888028038600: control (read@3072,1024B). Runtime 180 seconds [ 1542.321813][ T5877] usb 5-1: media controller created [ 1542.392637][ T5877] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1542.495054][T24044] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1542.541576][ T24] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1542.561396][ T5877] usb 5-1: selecting invalid altsetting 3 [ 1542.568966][ T5877] ttusb2: set interface to alts=3 failed [ 1542.658330][ T5877] DVB: Unable to find symbol tda10086_attach() [ 1542.668924][ T5877] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 1542.712782][T24044] usb 7-1: device descriptor read/64, error -71 [ 1542.719188][ T5877] dvb-usb: bulk message failed: -22 (4/0) [ 1542.731738][ T5877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1542.760547][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1542.775698][ T5877] dvb-usb: bulk message failed: -22 (5/0) [ 1542.801325][ T24] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 1542.827942][T24044] usb usb7-port1: attempt power cycle [ 1542.833705][ T5877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1542.848108][ T24] usb 3-1: config 0 has no interface number 0 [ 1542.876856][ T24] usb 3-1: config 0 interface 184 has no altsetting 0 [ 1542.892048][ T5877] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 1542.910696][ T24] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1542.938083][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.948308][ T5877] usb 5-1: USB disconnect, device number 85 [ 1543.000456][ T24] usb 3-1: Product: syz [ 1543.004626][ T24] usb 3-1: Manufacturer: syz [ 1543.051445][ T24] usb 3-1: SerialNumber: syz [ 1543.084380][ T5877] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 1543.103659][ T24] usb 3-1: config 0 descriptor?? [ 1543.208799][T24044] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1543.247838][T24044] usb 7-1: device descriptor read/8, error -71 [ 1543.329811][ T24] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 1543.343584][ T24] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 1543.379358][ T5813] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1543.397968][ T24] usb 3-1: USB disconnect, device number 102 [ 1543.504117][T24044] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1543.534538][T24044] usb 7-1: device descriptor read/8, error -71 [ 1543.560913][ T5813] usb 1-1: Using ep0 maxpacket: 32 [ 1543.568873][ T5813] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1543.583293][ T5813] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1543.594038][ T5813] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1543.603957][ T5813] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.616778][ T5813] usb 1-1: config 0 descriptor?? [ 1543.625302][ T5813] hub 1-1:0.0: USB hub found [ 1543.646308][T24044] usb usb7-port1: unable to enumerate USB device [ 1543.761443][T27846] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5616'. [ 1543.773147][T27846] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1543.786243][T27846] vlan2: entered promiscuous mode [ 1543.791505][T27846] vlan2: entered allmulticast mode [ 1543.796604][T27846] hsr_slave_1: entered allmulticast mode [ 1543.815866][ T5813] hub 1-1:0.0: 9 ports detected [ 1543.821320][ T5813] hub 1-1:0.0: insufficient power available to use all downstream ports [ 1544.812784][ T5813] hub 1-1:0.0: hub_hub_status failed (err = -32) [ 1544.863963][ T5813] hub 1-1:0.0: config failed, can't get hub status (err -32) [ 1544.926796][ T5813] usbhid 1-1:0.0: can't add hid device: -32 [ 1544.954567][ T5813] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1544.998819][T27858] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5618'. [ 1545.181216][T27865] comedi comedi3: comedi_config --init_data is deprecated [ 1545.326214][T27868] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20 sclass=netlink_audit_socket pid=27868 comm=syz.2.5620 [ 1545.434508][T27868] 9pnet: Found fid 0 not clunked [ 1546.730706][T27882] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5623'. [ 1546.732527][T24044] usb 1-1: USB disconnect, device number 50 [ 1546.995577][T27888] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5625'. [ 1547.163996][T10592] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1547.297985][T24044] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 1547.513880][T24044] usb 6-1: device descriptor read/64, error -71 [ 1547.609419][T10592] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1547.666263][T10592] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1547.702547][T10592] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1547.728961][T10592] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1547.826449][T24044] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 1547.895056][T10592] usb 3-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1547.911510][T10592] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1548.028264][T24044] usb 6-1: device descriptor read/64, error -71 [ 1548.043647][ T24] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1548.163275][T24044] usb usb6-port1: attempt power cycle [ 1548.223881][ T24] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1548.239473][T10592] usb 3-1: Manufacturer: syz [ 1548.253219][T10592] usb 3-1: config 0 descriptor?? [ 1548.271888][T27908] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1548.286298][ T24] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.295649][ T24] usb 7-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1548.309097][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1548.334084][ T24] usb 7-1: config 0 descriptor?? [ 1548.397162][T27910] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5633'. [ 1548.616095][T24044] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 1548.666731][T24044] usb 6-1: device descriptor read/8, error -71 [ 1548.714476][T10592] hid_parser_main: 24 callbacks suppressed [ 1548.714497][T10592] appleir 0003:05AC:8243.003A: unknown main item tag 0x0 [ 1548.756988][T27917] f2fs: Unknown parameter 'norecoveryhõ›Œ ë†Guîï' [ 1548.800344][T10592] appleir 0003:05AC:8243.003A: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 1548.888668][ T24] usb 3-1: USB disconnect, device number 103 [ 1548.894850][ T5813] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1548.942663][T24044] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 1548.983436][T24044] usb 6-1: device descriptor read/8, error -71 [ 1549.047451][ T5813] usb 1-1: Using ep0 maxpacket: 32 [ 1549.057603][ T5813] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1549.081315][ T5813] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1549.093913][T24044] usb usb6-port1: unable to enumerate USB device [ 1549.114167][ T5813] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1549.132042][ T5813] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.153264][ T5813] usb 1-1: config 0 descriptor?? [ 1549.175002][ T5813] hub 1-1:0.0: USB hub found [ 1549.368920][ T5813] hub 1-1:0.0: 9 ports detected [ 1549.389024][ T5813] hub 1-1:0.0: insufficient power available to use all downstream ports [ 1550.208975][T27931] bond1: Removing last ns target with arp_interval on [ 1550.374117][ T5813] hub 1-1:0.0: hub_hub_status failed (err = -32) [ 1550.383360][ T5813] hub 1-1:0.0: config failed, can't get hub status (err -32) [ 1550.417016][ T5813] usbhid 1-1:0.0: can't add hid device: -32 [ 1550.427256][ T5813] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1550.540107][T27952] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1550.653181][T10592] usb 7-1: USB disconnect, device number 6 [ 1552.501787][T27978] usb usb7: usbfs: process 27978 (syz.4.5650) did not claim interface 0 before use [ 1552.705535][ T24] usb 1-1: USB disconnect, device number 51 [ 1553.116954][T27991] netlink: 104 bytes leftover after parsing attributes in process `syz.5.5654'. [ 1553.876549][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1554.172320][ T1205] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1554.219868][T26361] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1554.394212][ T1205] usb 5-1: Using ep0 maxpacket: 32 [ 1554.529407][ T1205] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1554.622216][ T1205] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1554.637830][T26361] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1554.661007][T26361] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1554.676230][ T1205] usb 5-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1554.723368][ T1205] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1554.733484][T26361] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1554.760891][ T1205] usb 5-1: Product: syz [ 1554.766082][T26361] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.774463][ T1205] usb 5-1: Manufacturer: syz [ 1554.779055][ T1205] usb 5-1: SerialNumber: syz [ 1554.785164][T27998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5657'. [ 1554.920448][T26361] usb 6-1: config 0 descriptor?? [ 1554.928695][ T1205] usb 5-1: config 0 descriptor?? [ 1555.001508][T28010] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5658'. [ 1555.381692][ T1205] usb 5-1: no audio or video endpoints found [ 1555.518201][T27993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1555.531149][T27993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.552429][T27993] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1555.562354][T27993] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.944771][ T5813] usb 5-1: USB disconnect, device number 86 [ 1556.248760][T28016] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5660'. [ 1556.450778][ T5813] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1556.479213][T28035] xt_hashlimit: size too large, truncated to 1048576 [ 1556.524170][T28037] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1556.543409][T28038] netlink: 'syz.0.5662': attribute type 5 has an invalid length. [ 1556.639369][ T5813] usb 7-1: Using ep0 maxpacket: 32 [ 1556.654246][ T5813] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1556.694623][ T5813] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1556.717027][ T5813] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1556.733505][ T5813] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1556.745765][ T5813] usb 7-1: config 0 descriptor?? [ 1556.763876][ T5813] hub 7-1:0.0: USB hub found [ 1556.867729][T26361] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1556.987698][ T5813] hub 7-1:0.0: 9 ports detected [ 1557.029121][T24044] usb 6-1: USB disconnect, device number 10 [ 1557.066649][ T5813] hub 7-1:0.0: insufficient power available to use all downstream ports [ 1557.162834][T26361] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1557.210600][T26361] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1557.223704][T26361] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1557.251253][T26361] usb 5-1: config 0 descriptor?? [ 1557.274126][T26361] pwc: Askey VC010 type 2 USB webcam detected. [ 1557.792999][T26361] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1557.831682][T26361] pwc: recv_control_msg error -32 req 02 val 2700 [ 1557.880040][T26361] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1557.915157][T26361] pwc: recv_control_msg error -32 req 04 val 1000 [ 1557.941586][T26361] pwc: recv_control_msg error -32 req 04 val 1300 [ 1557.957097][T26361] pwc: recv_control_msg error -32 req 04 val 1400 [ 1557.969966][T26361] pwc: recv_control_msg error -32 req 02 val 2000 [ 1557.987270][T26361] pwc: recv_control_msg error -32 req 02 val 2100 [ 1558.002661][T26361] pwc: recv_control_msg error -32 req 04 val 1500 [ 1558.144085][ T24] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1558.153524][T10592] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1558.213258][ T5813] hub 7-1:0.0: hub_hub_status failed (err = -32) [ 1558.243720][ T5813] hub 7-1:0.0: config failed, can't get hub status (err -32) [ 1558.277658][ T5813] usbhid 7-1:0.0: can't add hid device: -32 [ 1558.296463][T10592] usb 6-1: Using ep0 maxpacket: 32 [ 1558.308552][T10592] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1558.308765][ T5813] usbhid 7-1:0.0: probe with driver usbhid failed with error -32 [ 1558.336829][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1558.343472][T26361] pwc: recv_control_msg error -71 req 02 val 2400 [ 1558.364247][T10592] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1558.378628][T26361] pwc: recv_control_msg error -71 req 02 val 2600 [ 1558.389108][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1558.415347][T26361] pwc: recv_control_msg error -71 req 02 val 2900 [ 1558.444020][T26361] pwc: recv_control_msg error -71 req 02 val 2800 [ 1558.444329][ T24] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1558.477253][T10592] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1558.491544][T26361] pwc: recv_control_msg error -71 req 04 val 1100 [ 1558.507975][ T24] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1558.508351][T26361] pwc: recv_control_msg error -71 req 04 val 1200 [ 1558.539982][ T24] usb 1-1: Manufacturer: syz [ 1558.555206][T26361] pwc: Registered as video103. [ 1558.562053][T26361] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input50 [ 1558.581511][T26361] usb 5-1: USB disconnect, device number 87 [ 1558.589700][ T24] usb 1-1: config 0 descriptor?? [ 1558.635085][T10592] gspca_nw80x: reg_w err -71 [ 1558.649402][T10592] nw80x 6-1:3.0: probe with driver nw80x failed with error -71 [ 1558.695153][T10592] usb 6-1: USB disconnect, device number 11 [ 1559.256417][ T24] uclogic 0003:256C:006D.003B: failed retrieving Huion firmware version: -71 [ 1559.296390][ T24] uclogic 0003:256C:006D.003B: failed probing parameters: -71 [ 1559.330809][ T24] uclogic 0003:256C:006D.003B: probe with driver uclogic failed with error -71 [ 1559.406440][ T24] usb 1-1: USB disconnect, device number 52 [ 1559.706421][ T5918] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1559.845740][T10592] usb 7-1: USB disconnect, device number 7 [ 1559.859506][ T5918] usb 6-1: Using ep0 maxpacket: 32 [ 1560.028889][ T5918] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1560.052610][ T5918] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1560.136030][ T5918] usb 6-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1560.164079][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.192919][ T5918] usb 6-1: Product: syz [ 1560.197094][ T5918] usb 6-1: Manufacturer: syz [ 1560.209740][ T5918] usb 6-1: SerialNumber: syz [ 1560.218071][ T5918] usb 6-1: config 0 descriptor?? [ 1560.234698][ T5918] usb 6-1: no audio or video endpoints found [ 1560.469327][ T5918] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1560.983333][ T5918] usb 7-1: Using ep0 maxpacket: 8 [ 1560.992674][ T24] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1560.993790][ T5918] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1561.044594][ T5918] usb 7-1: New USB device found, idVendor=1235, idProduct=8212, bcdDevice= 0.40 [ 1561.056180][ T5918] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.104013][ T5918] usb 7-1: Product: syz [ 1561.140082][ T5918] usb 7-1: Manufacturer: syz [ 1561.153861][T28078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1561.173047][ T5918] usb 7-1: SerialNumber: syz [ 1561.182760][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 1561.189314][ T24] usb 1-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 1561.222590][T28106] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5680'. [ 1561.971632][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1561.997132][T28078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.002980][ T24] usb 1-1: config 0 descriptor?? [ 1562.037619][ T24] gspca_main: sq930x-2.14.0 probing 041e:403c [ 1562.092167][T28078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1562.113539][T28078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.334574][ T24] gspca_sq930x: reg_r 001f failed -71 [ 1562.345978][ T24] sq930x 1-1:0.0: probe with driver sq930x failed with error -71 [ 1562.394926][ T24] usb 1-1: USB disconnect, device number 53 [ 1562.452211][T28111] fuse: Bad value for 'fd' [ 1562.459273][T10592] usb 6-1: USB disconnect, device number 12 [ 1562.625770][ T5918] usb 7-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1562.660023][ T5918] usb 7-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8212); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 1562.679433][ T5918] usb 7-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 1562.807574][ T5918] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1562.866171][ T5918] usb 7-1: USB disconnect, device number 8 [ 1562.906664][ T30] audit: type=1400 audit(1773738056.301:2079): avc: denied { append } for pid=28114 comm="syz.0.5683" name="ptp0" dev="devtmpfs" ino=1265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1562.939345][T25120] udevd[25120]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1563.688128][T10592] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1563.945425][T28135] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5687'. [ 1563.976661][T10592] usb 5-1: Using ep0 maxpacket: 32 [ 1564.108999][T10592] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1564.164650][T10592] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1564.184033][T10592] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1564.241180][T10592] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1564.287809][T10592] usb 5-1: config 0 descriptor?? [ 1564.378900][T10592] hub 5-1:0.0: USB hub found [ 1564.525919][T28147] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5691'. [ 1565.005429][T10592] hub 5-1:0.0: 9 ports detected [ 1565.241464][T10592] hub 5-1:0.0: insufficient power available to use all downstream ports [ 1565.945770][ T5918] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1566.099590][T28159] netlink: 'syz.6.5694': attribute type 1 has an invalid length. [ 1566.150263][T28159] netlink: 224 bytes leftover after parsing attributes in process `syz.6.5694'. [ 1566.195970][ T5918] usb 1-1: device descriptor read/64, error -71 [ 1566.293883][T10592] hub 5-1:0.0: hub_hub_status failed (err = -32) [ 1566.341745][T10592] hub 5-1:0.0: config failed, can't get hub status (err -32) [ 1566.446457][T10592] usbhid 5-1:0.0: can't add hid device: -32 [ 1566.499785][T10592] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 1566.507654][ T5918] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1566.569930][T28172] loop7: detected capacity change from 0 to 16384 [ 1566.698091][ T5918] usb 1-1: device descriptor read/64, error -71 [ 1566.740157][T28176] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5696'. [ 1566.832925][ T5918] usb usb1-port1: attempt power cycle [ 1567.044626][ T6105] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1567.079656][ T6105] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1567.087042][T28173] loop7: detected capacity change from 16384 to 0 [ 1567.098330][ C0] I/O error, dev loop7, sector 6912 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 2 [ 1567.112101][ C0] I/O error, dev loop7, sector 32 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1567.210581][ T6105] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1567.258840][ T6105] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1567.399209][ T5918] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 1567.452486][ T5918] usb 1-1: device descriptor read/8, error -71 [ 1567.568900][ T30] audit: type=1400 audit(1773738061.183:2080): avc: denied { write } for pid=28186 comm="syz.6.5698" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 1567.736378][ T5918] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 1567.822696][ T5918] usb 1-1: device descriptor read/8, error -71 [ 1568.022282][ T5918] usb usb1-port1: unable to enumerate USB device [ 1568.602324][ T5918] usb 5-1: USB disconnect, device number 88 [ 1569.183083][ T30] audit: type=1400 audit(1773738062.873:2081): avc: denied { lock } for pid=28200 comm="syz.6.5703" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1569.955178][T28223] usb usb7: usbfs: process 28223 (syz.0.5704) did not claim interface 0 before use [ 1570.365459][T28229] netlink: 4560 bytes leftover after parsing attributes in process `syz.0.5708'. [ 1570.405162][T28229] netlink: 4560 bytes leftover after parsing attributes in process `syz.0.5708'. [ 1570.938260][T19794] block nbd3: Possible stuck request ffff888028038000: control (read@0,1024B). Runtime 210 seconds [ 1570.949564][T19794] block nbd3: Possible stuck request ffff888028038200: control (read@1024,1024B). Runtime 210 seconds [ 1570.960695][T19794] block nbd3: Possible stuck request ffff888028038400: control (read@2048,1024B). Runtime 210 seconds [ 1570.971731][T19794] block nbd3: Possible stuck request ffff888028038600: control (read@3072,1024B). Runtime 210 seconds [ 1571.657108][ T24] libceph: connect (1)[c::]:6789 error -22 [ 1571.685605][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 1571.781936][ T30] audit: type=1326 audit(1773738065.624:2082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1571.828209][T28242] ceph: No mds server is up or the cluster is laggy [ 1571.936842][ T30] audit: type=1326 audit(1773738065.655:2083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.011822][ T30] audit: type=1326 audit(1773738065.686:2084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=116 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.088326][ T30] audit: type=1326 audit(1773738065.686:2085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.112409][ T5813] usb 1-1: new full-speed USB device number 58 using dummy_hcd [ 1572.153093][T28250] loop2: detected capacity change from 0 to 7 [ 1572.156460][ T30] audit: type=1326 audit(1773738065.686:2086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.220583][T25120] Dev loop2: unable to read RDB block 7 [ 1572.226392][T25120] loop2: AHDI p1 p2 p3 [ 1572.239188][ T30] audit: type=1326 audit(1773738065.686:2087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.261376][T25120] loop2: partition table partially beyond EOD, truncated [ 1572.270618][T25120] loop2: p1 start 1818582900 is beyond EOD, truncated [ 1572.294981][ T5813] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1572.307363][ T30] audit: type=1326 audit(1773738065.686:2088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.348967][ T5813] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 1572.360316][T25120] loop2: p3 start 335544320 is beyond EOD, truncated [ 1572.365847][ T5813] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1572.392321][ T30] audit: type=1326 audit(1773738065.686:2089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.420573][ T5813] usb 1-1: Product: syz [ 1572.424810][ T5813] usb 1-1: Manufacturer: syz [ 1572.430232][ T5813] usb 1-1: SerialNumber: syz [ 1572.439592][ T5813] usb 1-1: config 0 descriptor?? [ 1572.447329][ T30] audit: type=1326 audit(1773738065.686:2090): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=28247 comm="syz.0.5710" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f3ef1f9c799 code=0x7ffc0000 [ 1572.473706][T28250] Dev loop2: unable to read RDB block 7 [ 1572.479259][T28250] loop2: AHDI p1 p2 p3 [ 1572.482154][ T5813] pegasus_notetaker 1-1:0.0: Invalid number of endpoints [ 1572.490988][ T5813] pegasus_notetaker 1-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 1572.523412][T28250] loop2: partition table partially beyond EOD, truncated [ 1572.532050][T28250] loop2: p1 start 1818582900 is beyond EOD, truncated [ 1572.539818][T28250] loop2: p3 start 335544320 is beyond EOD, truncated [ 1572.704598][T26361] usb 1-1: USB disconnect, device number 58 [ 1573.823932][T28276] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=28276 comm=syz.0.5717 [ 1574.075186][T28262] bond1: Removing last ns target with arp_interval on [ 1574.598410][T28289] netlink: 'syz.0.5719': attribute type 4 has an invalid length. [ 1575.203670][T28284] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5716'. [ 1575.239703][T28273] fuse: Unknown parameter '!¦C [ 1575.239703][T28273] ²PxfÉgÆODàØ8ÑÇ~MügTdãDÏ‚‰í€å#k}–#›´š%d-­³3VžôT­‚'&gúdO'²™âFúWw ³'âÓñEp\æòHȾžW~•á–ßîÙ5' [ 1576.581117][T26361] IPVS: starting estimator thread 0... [ 1576.681101][T28310] IPVS: using max 36 ests per chain, 86400 per kthread [ 1577.014366][T26361] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 1577.084104][T28322] bond4: Removing last ns target with arp_interval on [ 1577.113885][T28329] x_tables: duplicate underflow at hook 1 [ 1577.627075][T26361] usb 1-1: Using ep0 maxpacket: 32 [ 1577.647698][T26361] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1577.758140][T26361] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1577.845284][T26361] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1577.854929][T26361] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1577.884813][T26361] usb 1-1: config 0 descriptor?? [ 1577.914120][T26361] hub 1-1:0.0: USB hub found [ 1577.934721][T28334] vlan2: entered allmulticast mode [ 1577.950672][T28334] macsec0: entered allmulticast mode [ 1577.955414][T28337] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5732'. [ 1577.964458][T28334] veth1_macvtap: entered allmulticast mode [ 1578.014576][T28329] ÿÿÿÿ: renamed from ip6tnl0 (while UP) [ 1578.099715][T26361] hub 1-1:0.0: 9 ports detected [ 1578.105908][T26361] hub 1-1:0.0: insufficient power available to use all downstream ports [ 1578.301771][T19490] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1578.481381][T19490] usb 5-1: Using ep0 maxpacket: 8 [ 1578.506033][T19490] usb 5-1: config 0 has an invalid interface number: 200 but max is 0 [ 1578.528387][T19490] usb 5-1: config 0 has no interface number 0 [ 1578.545362][T19490] usb 5-1: config 0 interface 200 altsetting 2 has an endpoint descriptor with address 0xB5, changing to 0x85 [ 1578.578193][T19490] usb 5-1: config 0 interface 200 altsetting 2 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1578.597587][T19490] usb 5-1: config 0 interface 200 has no altsetting 0 [ 1578.607906][T28345] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5733'. [ 1578.622235][T19490] usb 5-1: New USB device found, idVendor=0b57, idProduct=8528, bcdDevice=6d.39 [ 1578.658589][T19490] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1578.690822][T19490] usb 5-1: Product: syz [ 1578.700331][T19490] usb 5-1: Manufacturer: syz [ 1578.713608][T19490] usb 5-1: SerialNumber: syz [ 1578.775414][T19490] usb 5-1: config 0 descriptor?? [ 1579.205534][T26361] hub 1-1:0.0: hub_hub_status failed (err = -32) [ 1579.223597][T26361] hub 1-1:0.0: config failed, can't get hub status (err -32) [ 1579.259309][T26361] usbhid 1-1:0.0: can't add hid device: -32 [ 1579.393534][T26361] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1579.829733][T19490] input: Hanwang Art Master III 0906 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.200/input/input51 [ 1579.850684][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.858083][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.865524][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.873036][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.880294][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.887540][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.894810][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.902047][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.909279][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.916512][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.923752][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.931170][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.938444][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.945710][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.952973][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.960419][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.967743][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.974979][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.982220][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.989464][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1579.996701][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.003949][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.011222][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.018477][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.025796][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.033056][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.040356][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.047639][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.055377][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.062702][ C1] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.070963][ C1] usb 5-1: hanwang_irq - urb shutting down with status: -2 [ 1580.083420][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.090670][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.098076][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.105317][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.112550][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.120020][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.127255][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.134489][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.141724][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.149114][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.156450][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.163863][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.171129][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.178610][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.185849][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.193110][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.200367][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.207807][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.215058][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.222331][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.229602][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.237057][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.244341][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.251831][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.259118][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.266538][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.273766][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.281005][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.288283][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.295720][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.303386][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.310633][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.317859][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.325249][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.332488][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.339738][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.347740][T28347] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5735'. [ 1580.348213][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.364297][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.371588][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.378921][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.386200][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.393692][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.400986][ C0] usb 5-1: hanwang_irq - nonzero urb status received: -71 [ 1580.408108][ C0] usb 5-1: hanwang_irq - usb_submit_urb failed with result -1 [ 1580.430712][T19490] usb 5-1: USB disconnect, device number 89 [ 1581.236744][T19490] usb 1-1: USB disconnect, device number 59 [ 1582.082963][T28376] bond4: Removing last ns target with arp_interval on [ 1583.563383][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 1583.563399][ T30] audit: type=1400 audit(1773738077.990:2136): avc: denied { connect } for pid=28413 comm="syz.5.5753" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1584.301158][T28420] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5754'. [ 1584.834953][ T30] audit: type=1400 audit(1773738079.281:2137): avc: denied { mount } for pid=28427 comm="syz.5.5756" name="/" dev="bdev" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bdev_t tclass=filesystem permissive=1 [ 1584.906960][T28432] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5755'. [ 1584.983423][T28433] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5755'. [ 1586.349461][T19490] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1586.530168][T19490] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1586.707120][T19490] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1586.732703][T19490] usb 6-1: config 0 descriptor?? [ 1587.078254][T19490] usb 6-1: Cannot read MAC address [ 1587.083830][T19490] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -61 [ 1587.224495][ T30] audit: type=1400 audit(1773738081.832:2138): avc: denied { map } for pid=28450 comm="syz.0.5762" path=2F3534372F4002 dev="tmpfs" ino=2976 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1588.389391][T28468] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5764'. [ 1588.519048][T28469] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5764'. [ 1588.693241][T28472] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5758'. [ 1588.710098][T28472] netlink: 'syz.5.5758': attribute type 5 has an invalid length. [ 1588.723932][T28472] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5758'. [ 1588.733759][T28472] netlink: 'syz.5.5758': attribute type 5 has an invalid length. [ 1589.706793][T28486] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5768'. [ 1590.126641][T26361] usb 6-1: USB disconnect, device number 13 [ 1590.375147][T28502] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5771'. [ 1590.489207][T28493] bond5: Removing last ns target with arp_interval on [ 1590.499138][T28502] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5771'. [ 1590.597811][ T5813] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 1590.731242][ T5813] usb 1-1: device descriptor read/64, error -71 [ 1590.797514][T28512] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5775'. [ 1590.857026][T28512] netlink: 44 bytes leftover after parsing attributes in process `syz.6.5775'. [ 1591.026674][ T5813] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 1591.326410][ T30] audit: type=1400 audit(1773738086.137:2139): avc: denied { ioctl } for pid=28516 comm="syz.4.5776" path="socket:[115136]" dev="sockfs" ino=115136 ioctlcmd=0x89e4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1591.380244][ T5813] usb 1-1: device descriptor read/64, error -71 [ 1591.493774][ T5813] usb usb1-port1: attempt power cycle [ 1591.957528][T28524] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1591.976804][T28524] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1592.084259][T28524] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 1592.092491][T28524] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 1592.104980][T28524] overlayfs: d_ino too big (34, ino=9223372036854775993, xinobits=3) [ 1592.115831][T28524] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 1592.126630][T28524] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 1592.138159][T28524] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 1592.148354][T28524] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 1592.159736][T28524] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 1592.171062][T28524] overlayfs: d_ino too big (dev, ino=4611686018427387912, xinobits=3) [ 1592.183596][T28524] overlayfs: d_ino too big (kernel, ino=4611686018427389298, xinobits=3) [ 1592.836327][ T5813] usb 1-1: new full-speed USB device number 62 using dummy_hcd [ 1592.892631][ T5813] usb 1-1: device descriptor read/8, error -71 [ 1592.893964][T28527] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5780'. [ 1594.122211][ T30] audit: type=1400 audit(1773738088.688:2140): avc: denied { mounton } for pid=28534 comm="syz.0.5784" path="/554/file0" dev="tmpfs" ino=3013 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 1594.476245][T28548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5783'. [ 1596.461772][ T30] audit: type=1400 audit(1773738091.533:2141): avc: denied { compute_member } for pid=28566 comm="syz.2.5788" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1596.901650][T28586] netlink: 104 bytes leftover after parsing attributes in process `syz.6.5792'. [ 1598.397688][T28603] dlm: non-version read from control device 0 [ 1598.880169][T28611] overlayfs: missing 'lowerdir' [ 1598.991098][T28613] xt_hashlimit: size too large, truncated to 1048576 [ 1599.587761][ T30] audit: type=1400 audit(1773738094.052:2142): avc: denied { getopt } for pid=28605 comm="syz.5.5799" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1599.617337][T19794] block nbd3: Possible stuck request ffff888028038000: control (read@0,1024B). Runtime 240 seconds [ 1599.671467][T19794] block nbd3: Possible stuck request ffff888028038200: control (read@1024,1024B). Runtime 240 seconds [ 1599.682472][T19794] block nbd3: Possible stuck request ffff888028038400: control (read@2048,1024B). Runtime 240 seconds [ 1599.694876][T19794] block nbd3: Possible stuck request ffff888028038600: control (read@3072,1024B). Runtime 240 seconds [ 1599.721689][ T30] audit: type=1400 audit(1773738094.881:2143): avc: denied { map } for pid=28608 comm="syz.0.5798" path="socket:[115388]" dev="sockfs" ino=115388 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1599.751425][ T30] audit: type=1400 audit(1773738094.881:2144): avc: denied { read accept } for pid=28608 comm="syz.0.5798" path="socket:[115388]" dev="sockfs" ino=115388 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1599.933211][T22984] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1600.295663][T22984] usb 5-1: Using ep0 maxpacket: 8 [ 1600.436160][ T5877] libceph: connect (1)[c::]:6789 error -22 [ 1600.476000][ T5877] libceph: mon0 (1)[c::]:6789 connect error [ 1600.489891][T22984] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1600.501517][T22984] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1600.531446][T22984] usb 5-1: Product: syz [ 1600.531475][T28624] ceph: No mds server is up or the cluster is laggy [ 1600.542993][T22984] usb 5-1: Manufacturer: syz [ 1600.547585][T22984] usb 5-1: SerialNumber: syz [ 1600.582006][T22984] usb 5-1: config 0 descriptor?? [ 1601.066548][T10592] usb 3-1: new full-speed USB device number 104 using dummy_hcd [ 1601.403422][T10592] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1601.577097][T10592] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1601.909795][T22984] dvb_usb_rtl28xxu 5-1:0.0: chip type detection failed -110 [ 1601.958401][T22984] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1602.000160][T10592] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1602.023780][T10592] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1602.051591][T10592] usb 3-1: Product: syz [ 1602.065641][T10592] usb 3-1: Manufacturer: syz [ 1602.089746][T10592] usb 3-1: SerialNumber: syz [ 1602.107592][T10592] usb 3-1: config 0 descriptor?? [ 1602.170968][T10592] usb 3-1: selecting invalid altsetting 0 [ 1603.138710][T28644] netlink: 'syz.6.5805': attribute type 4 has an invalid length. [ 1603.799882][ T30] audit: type=1400 audit(1773738099.228:2145): avc: denied { write } for pid=28646 comm="syz.5.5807" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1604.288802][ T5877] usb 3-1: USB disconnect, device number 104 [ 1605.017069][T28661] netlink: 'syz.2.5811': attribute type 49 has an invalid length. [ 1605.035555][ T5877] usb 5-1: USB disconnect, device number 90 [ 1605.075276][T28661] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5811'. [ 1605.972892][T28671] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.5813'. [ 1606.267556][ T5918] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 1606.616645][ T5918] usb 1-1: config 0 has an invalid interface number: 6 but max is 0 [ 1606.684508][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1606.711017][ T30] audit: type=1400 audit(1773738102.293:2146): avc: denied { create } for pid=28686 comm="syz.2.5817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1606.793686][T28688] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 1606.895363][T28689] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1607.684941][ T5918] usb 1-1: config 0 has no interface number 0 [ 1607.691106][ T5918] usb 1-1: config 0 interface 6 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1607.706222][ T5918] usb 1-1: config 0 interface 6 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1607.720353][ T5918] usb 1-1: New USB device found, idVendor=10cf, idProduct=8061, bcdDevice=b7.12 [ 1608.043803][ T5918] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1608.050819][ T30] audit: type=1400 audit(1773738103.689:2147): avc: denied { ioctl } for pid=28686 comm="syz.2.5817" path="socket:[115523]" dev="sockfs" ino=115523 ioctlcmd=0x89ff scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1608.052433][ T5918] usb 1-1: Product: syz [ 1608.132095][T28687] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1608.158374][ T5918] usb 1-1: Manufacturer: syz [ 1608.162945][ T5918] usb 1-1: SerialNumber: syz [ 1608.169312][T28687] batadv1: entered allmulticast mode [ 1608.185912][T28687] team0: Port device batadv1 added [ 1608.194828][ T5918] usb 1-1: config 0 descriptor?? [ 1608.201939][T28671] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1608.251756][ T30] audit: type=1400 audit(1773738103.836:2148): avc: denied { getopt } for pid=28686 comm="syz.2.5817" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1608.401220][ T5918] vmk80xx 1-1:0.6: driver 'vmk80xx' failed to auto-configure device. [ 1608.432970][ T5918] vmk80xx 1-1:0.6: probe with driver vmk80xx failed with error -22 [ 1608.573952][T10592] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 1608.603636][ T5918] usb 1-1: USB disconnect, device number 64 [ 1608.725233][T10592] usb 7-1: Using ep0 maxpacket: 8 [ 1608.744075][T10592] usb 7-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1608.771341][T10592] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1608.799144][T10592] usb 7-1: Product: syz [ 1608.811134][T10592] usb 7-1: Manufacturer: syz [ 1608.832561][T10592] usb 7-1: SerialNumber: syz [ 1608.847550][T10592] usb 7-1: config 0 descriptor?? [ 1608.870431][T10592] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1609.329519][T28712] IPVS: Error connecting to the multicast addr [ 1609.918307][T10592] gspca_sonixj: reg_w1 err -110 [ 1609.923266][T10592] sonixj 7-1:0.0: probe with driver sonixj failed with error -110 [ 1610.072505][T10592] usb 7-1: USB disconnect, device number 9 [ 1610.136352][T28719] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5822'. [ 1610.471685][T28728] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5824'. [ 1612.250244][T28747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5831'. [ 1612.395070][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1612.701203][T28772] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 1612.701203][T28772] program syz.6.5833 not setting count and/or reply_len properly [ 1613.764899][ T1205] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1613.924900][ T1205] usb 7-1: Using ep0 maxpacket: 32 [ 1613.956347][ T1205] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1613.976239][ T1205] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1614.015605][ T1205] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1614.036582][T28792] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5840'. [ 1614.126621][ T24] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 1614.329548][ T24] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1614.662363][ T1205] gspca_nw80x: reg_w err -110 [ 1614.667112][ T1205] nw80x 7-1:3.0: probe with driver nw80x failed with error -110 [ 1614.703262][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1614.710880][ T1205] usb 7-1: USB disconnect, device number 10 [ 1614.735096][ T24] usb 1-1: config 0 descriptor?? [ 1614.941211][ T24] usb 1-1: Cannot read MAC address [ 1614.955134][ T24] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -32 [ 1615.097967][ T5918] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1615.223176][T28811] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1615.283840][ T5918] usb 3-1: Using ep0 maxpacket: 16 [ 1615.308791][ T5918] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1615.340803][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1615.371930][ T5918] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1615.400678][ T5918] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 1615.435648][ T5918] usb 3-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 1615.459116][ T5918] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.495754][ T5918] usb 3-1: config 0 descriptor?? [ 1615.551077][ T1205] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1615.721882][ T1205] usb 7-1: Using ep0 maxpacket: 16 [ 1615.734927][ T1205] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.763399][ T1205] usb 7-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 1615.802883][ T1205] usb 7-1: New USB device found, idVendor=0022, idProduct=f2ab, bcdDevice= 2.e6 [ 1615.828565][ T1205] usb 7-1: New USB device strings: Mfr=201, Product=53, SerialNumber=3 [ 1615.850133][ T1205] usb 7-1: Product: syz [ 1615.854312][ T1205] usb 7-1: Manufacturer: syz [ 1615.858907][ T1205] usb 7-1: SerialNumber: syz [ 1616.206188][T28805] [syz.2.] <== rxrpc_preparse_xdr_yfs_rxgk() = -EKEYREJECTED [d9c19884!=bc, 2c,d9c19820] [ 1616.240782][T28827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5839'. [ 1616.415311][ T5918] hid (null): report_id 42783 is invalid [ 1616.434736][ T5918] hid (null): invalid report_size 51180 [ 1616.447517][T28827] netlink: 'syz.0.5839': attribute type 5 has an invalid length. [ 1616.466680][ T5918] hid (null): unknown global tag 0xe [ 1616.747003][ T5918] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.003C/input/input52 [ 1616.771766][T28829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1616.786731][T28829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1616.958035][ T5918] input: HID 0458:5013 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5013.003C/input/input53 [ 1617.124116][ T1205] usb 7-1: USB disconnect, device number 11 [ 1617.148301][T28827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5839'. [ 1617.204191][ T5918] kye 0003:0458:5013.003C: input,hiddev0,hidraw0: USB HID vff.fa Device [HID 0458:5013] on usb-dummy_hcd.2-1/input0 [ 1617.224467][T28827] netlink: 'syz.0.5839': attribute type 5 has an invalid length. [ 1617.303122][T28843] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5853'. [ 1619.826738][ T1205] usb 3-1: reset high-speed USB device number 105 using dummy_hcd [ 1619.968973][T26361] usb 1-1: USB disconnect, device number 65 [ 1619.988465][ T1205] usb 3-1: device descriptor read/64, error -32 [ 1620.274886][ T1205] usb 3-1: reset high-speed USB device number 105 using dummy_hcd [ 1620.447261][ T1205] usb 3-1: device descriptor read/64, error -32 [ 1621.236243][ T1205] usb 3-1: reset high-speed USB device number 105 using dummy_hcd [ 1621.300567][ T1205] usb 3-1: device descriptor read/8, error -32 [ 1621.470619][T28875] random: crng reseeded on system resumption [ 1622.961305][T28887] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1623.235121][T22984] usb 3-1: USB disconnect, device number 105 [ 1623.263318][T28893] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5867'. [ 1624.247475][T28912] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 1624.317018][T28913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5868'. [ 1624.464325][ T30] audit: type=1400 audit(1773738119.866:2149): avc: denied { ioctl } for pid=28914 comm="syz.0.5872" path="socket:[116731]" dev="sockfs" ino=116731 ioctlcmd=0x89f0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1624.495147][T28852] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 1624.606747][ T5813] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1624.615215][T28926] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5873'. [ 1624.698516][T28852] usb 7-1: Using ep0 maxpacket: 16 [ 1624.709800][T28852] usb 7-1: config 128 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1624.747952][T28852] usb 7-1: config 128 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1624.769998][T28852] usb 7-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1624.782474][T28852] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.792416][T28934] comedi comedi3: comedi_config --init_data is deprecated [ 1624.816183][ T5813] usb 6-1: too many configurations: 132, using maximum allowed: 8 [ 1624.828415][ T5813] usb 6-1: config index 0 descriptor too short (expected 64543, got 45) [ 1624.862455][ T5813] usb 6-1: config index 1 descriptor too short (expected 64543, got 45) [ 1624.904229][ T5813] usb 6-1: config index 2 descriptor too short (expected 64543, got 45) [ 1624.924167][ T5813] usb 6-1: config index 3 descriptor too short (expected 64543, got 45) [ 1624.944523][ T5813] usb 6-1: config index 4 descriptor too short (expected 64543, got 45) [ 1624.956241][ T5813] usb 6-1: config index 5 descriptor too short (expected 64543, got 45) [ 1624.972149][ T5813] usb 6-1: config index 6 descriptor too short (expected 64543, got 45) [ 1624.986904][T22984] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1624.995027][ T5813] usb 6-1: config index 7 descriptor too short (expected 64543, got 45) [ 1625.018521][ T5813] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1625.030162][ T5813] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.048506][ T5813] usb 6-1: Product: syz [ 1625.058720][ T5813] usb 6-1: Manufacturer: syz [ 1625.071658][ T5813] usb 6-1: SerialNumber: syz [ 1625.147213][T22984] usb 5-1: Using ep0 maxpacket: 32 [ 1625.155684][T22984] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1625.182573][T22984] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1625.209442][T22984] usb 5-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1625.222312][T28888] Bluetooth: hci3: command 0x0406 tx timeout [ 1625.240676][T28852] mcp2221 0003:04D8:00DD.003D: unknown main item tag 0x6 [ 1625.260492][T22984] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.272660][T28852] mcp2221 0003:04D8:00DD.003D: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.6-1/input0 [ 1625.290094][T22984] usb 5-1: Product: syz [ 1625.296476][T22984] usb 5-1: Manufacturer: syz [ 1625.306064][T22984] usb 5-1: SerialNumber: syz [ 1625.328379][T22984] usb 5-1: config 0 descriptor?? [ 1625.352346][T22984] usb 5-1: no audio or video endpoints found [ 1625.392970][T24044] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1625.573234][T24044] usb 3-1: Using ep0 maxpacket: 32 [ 1625.601007][T24044] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD8, changing to 0x88 [ 1625.615935][T24044] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1625.641387][T24044] usb 3-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1625.651589][T24044] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.659637][T24044] usb 3-1: Product: syz [ 1625.671114][T24044] usb 3-1: Manufacturer: syz [ 1625.677142][T24044] usb 3-1: SerialNumber: syz [ 1625.685273][T24044] usb 3-1: config 0 descriptor?? [ 1625.696868][T28933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1625.706720][T24044] usb 3-1: no audio or video endpoints found [ 1625.718925][T28933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1625.737320][T28933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1625.751973][ T5813] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 1625.766147][T28933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1625.777480][ T5813] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1625.793086][ T5813] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1625.804744][ T5813] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 1625.819677][ T5813] usb 6-1: USB disconnect, device number 14 [ 1625.901528][T24044] usb 5-1: USB disconnect, device number 91 [ 1625.995767][T28945] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5882'. [ 1626.033222][T28937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1626.056791][T28937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1626.064626][T28947] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5883'. [ 1626.086630][T28937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1626.096009][T28937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1626.110461][T28950] loop2: detected capacity change from 0 to 7 [ 1626.123455][T25120] Dev loop2: unable to read RDB block 7 [ 1626.129003][T25120] loop2: unable to read partition table [ 1626.135222][T25120] loop2: partition table beyond EOD, truncated [ 1626.142523][T28950] Dev loop2: unable to read RDB block 7 [ 1626.148233][T28950] loop2: unable to read partition table [ 1626.154560][T28950] loop2: partition table beyond EOD, truncated [ 1626.160780][T28950] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1626.206247][T24044] usb 3-1: USB disconnect, device number 106 [ 1626.495373][ T30] audit: type=1400 audit(1773738121.766:2150): avc: denied { map } for pid=28960 comm="syz.4.5889" path="socket:[117950]" dev="sockfs" ino=117950 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 1626.519631][T19490] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 1626.695220][T19490] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1626.759126][T28965] ip6gretap0: entered promiscuous mode [ 1626.765267][T28965] vlan2: entered promiscuous mode [ 1626.808846][T28852] usb 7-1: reset high-speed USB device number 12 using dummy_hcd [ 1626.831829][ T30] audit: type=1400 audit(1773738121.990:2151): avc: denied { connect } for pid=28960 comm="syz.4.5889" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1626.853719][T19490] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1626.903639][T19490] usb 1-1: Product: syz [ 1627.120004][T19490] usb 1-1: Manufacturer: syz [ 1627.130469][T19490] usb 1-1: SerialNumber: syz [ 1627.194056][T24044] libceph: connect (1)[c::]:6789 error -22 [ 1627.204214][T24044] libceph: mon0 (1)[c::]:6789 connect error [ 1627.250175][ T5813] libceph: connect (1)[b::]:6789 error -22 [ 1627.258276][ T5813] libceph: mon0 (1)[b::]:6789 connect error [ 1627.268940][ T5813] libceph: connect (1)[b::]:6789 error -22 [ 1627.284427][ T5813] libceph: mon0 (1)[b::]:6789 connect error [ 1628.600920][ T5813] libceph: connect (1)[c::]:6789 error -22 [ 1628.606851][ T5813] libceph: mon0 (1)[c::]:6789 connect error [ 1628.618123][T24044] libceph: connect (1)[b::]:6789 error -22 [ 1628.647335][T24044] libceph: mon0 (1)[b::]:6789 connect error [ 1628.657907][T28970] ceph: No mds server is up or the cluster is laggy [ 1628.664601][T28973] ceph: No mds server is up or the cluster is laggy [ 1628.854581][T19490] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1628.859981][T28967] bond2: Removing last ns target with arp_interval on [ 1628.867313][T19490] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1628.897549][T19490] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1628.919203][T19490] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1628.928993][T19490] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1628.945113][T28985] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5894'. [ 1628.946895][T28987] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5895'. [ 1628.974496][T19490] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 1629.038647][T22984] usb 7-1: USB disconnect, device number 12 [ 1629.172832][T28992] mac80211_hwsim hwsim32 wlan1: entered promiscuous mode [ 1629.188979][T28992] macsec2: entered allmulticast mode [ 1629.204767][T28992] mac80211_hwsim hwsim32 wlan1: entered allmulticast mode [ 1630.296581][T19490] usb 1-1: USB disconnect, device number 66 [ 1630.379657][T29007] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 1630.437898][T29006] isofs_fill_super: bread failed, dev=nbd0, iso_blknum=16, block=32 [ 1630.522340][T19794] block nbd3: Possible stuck request ffff888028038000: control (read@0,1024B). Runtime 270 seconds [ 1630.533166][T19794] block nbd3: Possible stuck request ffff888028038200: control (read@1024,1024B). Runtime 270 seconds [ 1630.544497][T19794] block nbd3: Possible stuck request ffff888028038400: control (read@2048,1024B). Runtime 270 seconds [ 1630.555587][T19794] block nbd3: Possible stuck request ffff888028038600: control (read@3072,1024B). Runtime 270 seconds [ 1631.476813][T29020] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5904'. [ 1631.574180][T29017] netlink: 44 bytes leftover after parsing attributes in process `syz.6.5904'. [ 1632.093090][ T5877] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1632.391039][ T5877] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1632.424309][ T5877] usb 5-1: config 0 has no interface number 0 [ 1632.430405][ T5877] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1632.486067][ T5877] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1632.510074][ T5877] usb 5-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1632.540913][ T5877] usb 5-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1632.561147][ T5877] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1632.617764][ T5877] usb 5-1: config 0 descriptor?? [ 1632.638173][ T1205] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1632.820036][T22984] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1632.827773][ T1205] usb 7-1: Using ep0 maxpacket: 8 [ 1632.854851][ T1205] usb 7-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1632.858747][T29034] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5907'. [ 1632.864090][ T1205] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1632.882946][ T1205] usb 7-1: Product: syz [ 1632.888109][ T1205] usb 7-1: Manufacturer: syz [ 1632.892781][ T1205] usb 7-1: SerialNumber: syz [ 1632.908960][ T1205] usb 7-1: config 0 descriptor?? [ 1633.003904][T22984] usb 3-1: Using ep0 maxpacket: 32 [ 1633.011590][T22984] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1633.024069][T22984] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1633.033111][T22984] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1633.043661][T22984] usb 3-1: Product: syz [ 1633.048118][T22984] usb 3-1: Manufacturer: syz [ 1633.052702][T22984] usb 3-1: SerialNumber: syz [ 1633.059991][T22984] usb 3-1: config 0 descriptor?? [ 1633.065620][T29032] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1633.155776][ T1205] usb 7-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1633.379873][T22984] usb 3-1: USB disconnect, device number 107 [ 1633.390364][T29031] ALSA: mixer_oss: invalid OSS volume 'ûí°„èF¸èUî·+Ï™÷' [ 1633.478160][T29045] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1633.726530][T29045] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 1633.737772][T29045] overlayfs: failed to look up (tracing) for ino (-66) [ 1634.485345][ T1205] dvb_usb_rtl28xxu 7-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1635.147708][T29031] ALSA: mixer_oss: invalid OSS volume 'ô/}¬8;EeÄ…«V"e¯ù5¼„VVAì@' [ 1635.224020][ T5877] usbhid 5-1:0.1: can't add hid device: -71 [ 1635.240956][ T5877] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 1635.241438][T29031] ALSA: mixer_oss: invalid OSS volume '×OÑ‘,¢üúÀQ§äìÖ”º|Ú–Peò²äyŸ' [ 1635.265435][ T5877] usb 5-1: USB disconnect, device number 92 [ 1635.288303][T26361] usb 7-1: USB disconnect, device number 13 [ 1635.296404][T29031] ALSA: mixer_oss: invalid OSS volume 'ò÷y+HúZÑ™ÆV{†Á«q“&¹»Þï' [ 1635.327371][T29031] ALSA: mixer_oss: invalid OSS volume 'ÆVÞ°q_ù¡®Š±f' [ 1635.346153][T29031] ALSA: mixer_oss: invalid OSS volume '—6"¼ˆü+º%0ÙQ«£#¶L¥5èßSd¢ÆMÅc}' [ 1635.357279][T29031] ALSA: mixer_oss: invalid OSS volume 'ÅßÅqgK«|ï+' [ 1635.982386][T29059] netlink: 'syz.4.5916': attribute type 4 has an invalid length. [ 1636.550552][ T30] audit: type=1400 audit(1773738131.180:2152): avc: denied { read } for pid=29063 comm="syz.0.5919" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1636.591817][T29067] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5920'. [ 1636.604663][ T30] audit: type=1400 audit(1773738131.227:2153): avc: denied { ioctl } for pid=29063 comm="syz.0.5919" path="socket:[117514]" dev="sockfs" ino=117514 ioctlcmd=0x662a scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1637.265070][T26361] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 1637.282053][T29080] bond6: Removing last ns target with arp_interval on [ 1637.308362][T29091] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5926'. [ 1637.414982][T26361] usb 7-1: device descriptor read/64, error -71 [ 1637.650807][T29098] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5929'. [ 1637.681789][T26361] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1637.799463][ T1205] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1637.820803][T26361] usb 7-1: device descriptor read/64, error -71 [ 1637.964399][T26361] usb usb7-port1: attempt power cycle [ 1638.003036][ T1205] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1638.026691][ T1205] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1638.042898][ T1205] usb 6-1: Product: syz [ 1638.052012][ T1205] usb 6-1: Manufacturer: syz [ 1638.192148][ T1205] usb 6-1: SerialNumber: syz [ 1638.221699][ T1205] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1638.267488][T22984] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1638.499188][T26361] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1639.252136][T26361] usb 7-1: device descriptor read/8, error -71 [ 1639.415086][T22984] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 1639.422345][T22984] ath9k_htc: Failed to initialize the device [ 1639.509057][T26361] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 1640.285748][T22984] usb 6-1: ath9k_htc: USB layer deinitialized [ 1640.313384][T26361] usb 7-1: device descriptor read/8, error -71 [ 1640.353387][ T5877] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 1640.428225][T26361] usb usb7-port1: unable to enumerate USB device [ 1640.468881][T29116] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5934'. [ 1640.577655][ T5877] usb 1-1: Using ep0 maxpacket: 32 [ 1640.584209][ T5877] usb 1-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1640.593323][ T5877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1640.608783][ T5877] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1640.781120][ T5813] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1640.810926][T26361] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1640.820008][T28852] usb 6-1: USB disconnect, device number 15 [ 1640.981974][ T5877] gspca_nw80x: reg_w err -71 [ 1640.987803][ T5877] nw80x 1-1:3.0: probe with driver nw80x failed with error -71 [ 1640.994428][T26361] usb 7-1: Using ep0 maxpacket: 32 [ 1640.997897][ T5813] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1641.003026][T26361] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1641.010830][ T5877] usb 1-1: USB disconnect, device number 67 [ 1641.026982][ T5813] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1641.039357][T19490] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1641.055061][ T5813] usb 5-1: config 0 descriptor?? [ 1641.069064][ T5813] cp210x 5-1:0.0: cp210x converter detected [ 1641.545431][T26361] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1641.555504][T26361] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1641.568716][T26361] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1641.579190][T26361] usb 7-1: config 0 descriptor?? [ 1641.596208][T26361] hub 7-1:0.0: USB hub found [ 1641.604899][T19490] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1641.625169][T19490] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1641.646231][ T5823] Bluetooth: hci2: command 0x0406 tx timeout [ 1641.657861][T19490] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1641.666990][T19490] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.675407][T19490] usb 3-1: Product: syz [ 1641.679686][T19490] usb 3-1: Manufacturer: syz [ 1641.684479][T19490] usb 3-1: SerialNumber: syz [ 1641.694262][T19490] cdc_mbim 3-1:1.0: skipping garbage [ 1641.854138][T26361] hub 7-1:0.0: 9 ports detected [ 1641.875293][T26361] hub 7-1:0.0: insufficient power available to use all downstream ports [ 1641.901936][ T5813] usb 5-1: cp210x converter now attached to ttyUSB0 [ 1642.127455][T29122] netlink: 'syz.2.5937': attribute type 1 has an invalid length. [ 1642.172281][ T5813] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1642.198059][T29122] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1642.237259][T29133] bond7: (slave geneve2): making interface the new active one [ 1642.258639][T29133] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 1642.340846][ T5813] usb 6-1: device descriptor read/64, error -71 [ 1642.781157][T29145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1642.800650][T29145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1643.006514][T26361] hub 7-1:0.0: hub_hub_status failed (err = -32) [ 1643.012932][T26361] hub 7-1:0.0: config failed, can't get hub status (err -32) [ 1643.030774][T26361] usbhid 7-1:0.0: can't add hid device: -32 [ 1643.037036][T26361] usbhid 7-1:0.0: probe with driver usbhid failed with error -32 [ 1643.810194][T19490] cdc_mbim 3-1:1.0: bind() failure [ 1643.825010][T19490] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 1643.855179][T19490] usb 3-1: USB disconnect, device number 108 [ 1644.631844][ T5813] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1644.795193][ T5813] usb 6-1: device descriptor read/64, error -71 [ 1645.921765][T26361] usb 7-1: USB disconnect, device number 18 [ 1645.947329][ T5813] usb usb6-port1: attempt power cycle [ 1646.087930][T24044] usb 5-1: USB disconnect, device number 93 [ 1646.117756][T24044] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1646.147589][T24044] cp210x 5-1:0.0: device disconnected [ 1646.316067][T19490] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1646.434964][T29164] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5945'. [ 1646.462329][T29159] overlayfs: missing 'lowerdir' [ 1646.468266][T19490] usb 3-1: device descriptor read/64, error -71 [ 1646.775699][T19490] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1646.839821][T28852] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1646.925141][T19490] usb 3-1: device descriptor read/64, error -71 [ 1647.108892][T19490] usb usb3-port1: attempt power cycle [ 1647.252578][T28852] usb 7-1: config 0 has an invalid interface number: 64 but max is 0 [ 1647.272929][T28852] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1647.296690][T28852] usb 7-1: config 0 has no interface number 0 [ 1647.323986][T28852] usb 7-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice= 0.07 [ 1647.456836][T23530] syz_tun (unregistering): left allmulticast mode [ 1647.461767][T28852] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1647.489079][T28888] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1647.505586][T28888] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1647.516631][T28888] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1647.524542][T28888] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1647.532531][T28888] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1647.541490][T23530] syz_tun (unregistering): left promiscuous mode [ 1647.547954][T23530] bridge0: port 3(syz_tun) entered disabled state [ 1647.569750][T29184] netlink: 'syz.5.5953': attribute type 1 has an invalid length. [ 1647.577949][T28852] usb 7-1: Product: syz [ 1647.582083][T28852] usb 7-1: Manufacturer: syz [ 1647.586645][T28852] usb 7-1: SerialNumber: syz [ 1647.628595][T28852] usb 7-1: config 0 descriptor?? [ 1647.630434][T19490] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1647.673912][T19490] usb 3-1: device descriptor read/8, error -71 [ 1647.684485][ T30] audit: type=1400 audit(1773738141.605:2154): avc: denied { write } for pid=29181 comm="syz.5.5953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1647.755031][ T6519] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1647.778111][ T6519] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1647.841755][ T6519] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1647.940338][T29159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1647.950130][ T6519] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1647.960962][T29159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1647.970377][ T6519] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1647.982557][T19490] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1648.001640][ T6519] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1648.019549][T19490] usb 3-1: device descriptor read/8, error -71 [ 1648.076567][ T6519] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1648.114431][ T6519] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1648.140546][ T6519] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1648.150378][ T5813] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1648.161835][T19490] usb usb3-port1: unable to enumerate USB device [ 1648.188352][T29180] chnl_net:caif_netlink_parms(): no params data found [ 1648.246182][ T6519] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1648.266786][ T6519] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1648.288596][ T6519] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1648.336975][T29180] bridge0: port 1(bridge_slave_0) entered blocking state [ 1648.344310][T29180] bridge0: port 1(bridge_slave_0) entered disabled state [ 1648.351390][ T5813] usb 6-1: Using ep0 maxpacket: 32 [ 1648.352834][ T5813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1648.357417][T29180] bridge_slave_0: entered allmulticast mode [ 1648.377988][T29180] bridge_slave_0: entered promiscuous mode [ 1648.391730][T29180] bridge0: port 2(bridge_slave_1) entered blocking state [ 1648.402665][T29180] bridge0: port 2(bridge_slave_1) entered disabled state [ 1648.409741][ T5813] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1648.409890][T29180] bridge_slave_1: entered allmulticast mode [ 1648.436554][T29180] bridge_slave_1: entered promiscuous mode [ 1648.445331][ T5813] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1648.465958][ T5813] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1648.489607][T29180] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1648.505304][T29180] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1648.510481][ T5813] usb 6-1: config 0 descriptor?? [ 1648.542146][ T5813] hub 6-1:0.0: USB hub found [ 1648.617656][T29180] team0: Port device team_slave_0 added [ 1648.639628][T29180] team0: Port device team_slave_1 added [ 1648.748071][ T5813] hub 6-1:0.0: 9 ports detected [ 1648.762293][ T5813] hub 6-1:0.0: insufficient power available to use all downstream ports [ 1648.800778][ T6519] bridge_slave_1: left allmulticast mode [ 1648.808767][ T6519] bridge0: port 2(bridge_slave_1) entered disabled state [ 1648.821727][ T6519] bridge_slave_0: left allmulticast mode [ 1648.831523][ T6519] bridge_slave_0: left promiscuous mode [ 1648.843707][ T6519] bridge0: port 1(bridge_slave_0) entered disabled state [ 1649.228068][ T6519] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1649.253371][ T6519] bond0 (unregistering): Released all slaves [ 1649.298776][ T6519] bond1 (unregistering): Released all slaves [ 1649.362521][ T6519] bond2 (unregistering): (slave wireguard0): Releasing backup interface [ 1649.381736][ T6519] wireguard0: left promiscuous mode [ 1649.404370][ T6519] bond2 (unregistering): Released all slaves [ 1649.455279][ T30] audit: type=1400 audit(1773738143.252:2155): avc: denied { map } for pid=29214 comm="syz.2.5955" path="socket:[118937]" dev="sockfs" ino=118937 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1649.480733][ T6519] bond3 (unregistering): Released all slaves [ 1649.494195][ T6519] bond4 (unregistering): Released all slaves [ 1649.551341][T29180] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1649.577133][T29180] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1649.612349][T29180] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1649.626496][T29180] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1649.654986][T29180] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1649.687181][T29180] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1649.754342][ T30] audit: type=1400 audit(1773738143.533:2156): avc: denied { map } for pid=29216 comm="syz.2.5956" path="/dev/null" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:null_device_t tclass=chr_file permissive=1 [ 1649.788388][ T5823] Bluetooth: hci6: command tx timeout [ 1649.799448][ T30] audit: type=1400 audit(1773738143.533:2157): avc: denied { execute } for pid=29216 comm="syz.2.5956" path="/dev/null" dev="devtmpfs" ino=5 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:null_device_t tclass=chr_file permissive=1 [ 1649.932522][ T5813] hub 6-1:0.0: hub_hub_status failed (err = -32) [ 1649.951803][ T5813] hub 6-1:0.0: config failed, can't get hub status (err -32) [ 1649.976391][T29180] hsr_slave_0: entered promiscuous mode [ 1649.988409][ T5813] usbhid 6-1:0.0: can't add hid device: -32 [ 1650.003578][T29180] hsr_slave_1: entered promiscuous mode [ 1650.011585][ T5813] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 1650.027252][T29180] debugfs: 'hsr0' already exists in 'hsr' [ 1650.052745][T29180] Cannot create hsr debugfs directory [ 1650.945392][T22984] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1651.036515][ T6519] hsr_slave_0: left promiscuous mode [ 1651.042467][ T6519] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1651.049914][ T6519] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1651.059454][ T6519] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1651.067579][ T6519] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1651.078153][ T6519] veth1_macvtap: left promiscuous mode [ 1651.084033][ T6519] veth0_macvtap: left allmulticast mode [ 1651.089579][ T6519] veth0_macvtap: left promiscuous mode [ 1651.095530][ T6519] ÿÿÿÿ: left promiscuous mode [ 1651.100251][ T6519] veth0_vlan: left promiscuous mode [ 1651.107920][T28852] uvcvideo 7-1:0.64: Found UVC 0.08 device syz (046d:0823) [ 1651.115768][T28852] uvcvideo 7-1:0.64: No valid video chain found. [ 1651.141178][T28852] usb 7-1: USB disconnect, device number 19 [ 1651.171296][T22984] usb 3-1: Using ep0 maxpacket: 32 [ 1651.184405][T22984] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1651.213416][T22984] usb 3-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice= 0.40 [ 1651.233361][T22984] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1651.241378][T22984] usb 3-1: Product: syz [ 1651.252505][T22984] usb 3-1: Manufacturer: syz [ 1651.264040][T22984] usb 3-1: SerialNumber: syz [ 1651.399596][ T6519] team_slave_1 (unregistering): left allmulticast mode [ 1651.442669][ T6519] team0 (unregistering): Port device team_slave_1 removed [ 1651.499113][ T5813] usb 6-1: USB disconnect, device number 19 [ 1652.056208][T29262] netlink: 'syz.5.5959': attribute type 4 has an invalid length. [ 1652.361636][T28888] Bluetooth: hci6: command tx timeout [ 1652.363969][T22984] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1652.579389][T28888] Bluetooth: hci4: command 0x0406 tx timeout [ 1652.867701][T22984] usb 3-1: USB disconnect, device number 113 [ 1653.219990][T29253] syz_tun: entered allmulticast mode [ 1653.336222][T29253] syz_tun: left allmulticast mode [ 1653.466628][T29180] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1653.534316][T29180] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1653.576525][T29180] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1653.954243][T29180] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1653.978142][ T30] audit: type=1400 audit(1773738147.463:2158): avc: denied { bind } for pid=29277 comm="syz.6.5965" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1654.157215][T29303] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5967'. [ 1654.319558][T29180] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1654.361781][T29180] 8021q: adding VLAN 0 to HW filter on device team0 [ 1654.390397][T26011] bridge0: port 1(bridge_slave_0) entered blocking state [ 1654.397473][T26011] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1654.416431][T22984] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1654.463702][T26011] bridge0: port 2(bridge_slave_1) entered blocking state [ 1654.470832][T26011] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1654.492958][T29308] random: crng reseeded on system resumption [ 1654.616687][ T5823] Bluetooth: hci6: command tx timeout [ 1654.641436][T22984] usb 6-1: Using ep0 maxpacket: 16 [ 1654.673730][T22984] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=f4.9b [ 1654.714647][T22984] usb 6-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1654.743637][T29180] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1654.763049][T22984] usb 6-1: Product: syz [ 1654.772780][T22984] usb 6-1: SerialNumber: syz [ 1654.813408][T22984] usb 6-1: config 0 descriptor?? [ 1654.839761][T22984] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1654.879345][T22984] dvb_usb_af9015 6-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1654.933071][T22984] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1654.964979][T22984] dvb_usb_af9035 6-1:0.0: probe with driver dvb_usb_af9035 failed with error -22 [ 1655.174728][ T30] audit: type=1400 audit(1773738148.605:2159): avc: denied { read write } for pid=29301 comm="syz.5.5962" name="rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1655.233280][T29180] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1655.268139][ T30] audit: type=1400 audit(1773738148.651:2160): avc: denied { open } for pid=29301 comm="syz.5.5962" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=1271 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 1655.325667][ T5813] usb 6-1: USB disconnect, device number 20 [ 1655.333882][T29180] veth0_vlan: entered promiscuous mode [ 1655.402561][ T30] audit: type=1400 audit(1773738148.708:2161): avc: denied { read write } for pid=29331 comm="syz.6.5969" name="raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1655.429166][T29180] veth1_vlan: entered promiscuous mode [ 1655.451528][T29180] veth0_macvtap: entered promiscuous mode [ 1655.483031][T29180] veth1_macvtap: entered promiscuous mode [ 1655.490910][ T30] audit: type=1400 audit(1773738148.708:2162): avc: denied { open } for pid=29331 comm="syz.6.5969" path="/dev/raw-gadget" dev="devtmpfs" ino=820 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1655.570427][T29180] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1655.579478][ T30] audit: type=1400 audit(1773738148.708:2163): avc: denied { ioctl } for pid=29331 comm="syz.6.5969" path="/dev/raw-gadget" dev="devtmpfs" ino=820 ioctlcmd=0x5500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1655.611728][T29180] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1655.635370][T22984] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1655.646301][T26011] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1655.661799][T26011] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1655.674814][ T30] audit: type=1400 audit(1773738148.904:2164): avc: denied { search } for pid=29330 comm="cmp" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1655.716575][T29339] binder: 29334:29339 ioctl 4018620d 0 returned -22 [ 1655.726749][ T30] audit: type=1400 audit(1773738148.904:2165): avc: denied { read } for pid=29330 comm="cmp" name="resolv.conf" dev="tmpfs" ino=4 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1655.754707][ T30] audit: type=1400 audit(1773738148.904:2166): avc: denied { open } for pid=29330 comm="cmp" path="/tmp/resolv.conf" dev="tmpfs" ino=4 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1655.760362][T26011] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1655.779481][ T30] audit: type=1400 audit(1773738148.904:2167): avc: denied { getattr } for pid=29330 comm="cmp" path="/tmp/resolv.conf" dev="tmpfs" ino=4 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 1655.824139][T26011] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1655.840407][T22984] usb 7-1: Using ep0 maxpacket: 32 [ 1655.847308][T22984] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1655.858437][T22984] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1655.870941][T22984] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1655.891384][T22984] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1655.907953][T22984] usb 7-1: config 0 descriptor?? [ 1655.917902][T22984] hub 7-1:0.0: USB hub found [ 1656.090174][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1656.124858][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1656.139611][T22984] hub 7-1:0.0: 9 ports detected [ 1656.144816][T22984] hub 7-1:0.0: insufficient power available to use all downstream ports [ 1656.186218][ T235] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1656.194425][ T235] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1656.779592][T29362] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1656.890962][T29363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5950'. [ 1656.901199][ T5823] Bluetooth: hci6: command tx timeout [ 1657.285154][T22984] hub 7-1:0.0: hub_hub_status failed (err = -32) [ 1657.313870][T22984] hub 7-1:0.0: config failed, can't get hub status (err -32) [ 1657.343201][T22984] usbhid 7-1:0.0: can't add hid device: -32 [ 1657.374077][T22984] usbhid 7-1:0.0: probe with driver usbhid failed with error -32 [ 1657.610743][T29375] usb usb7: usbfs: process 29375 (syz.4.5971) did not claim interface 0 before use [ 1658.026295][T29383] netlink: 212324 bytes leftover after parsing attributes in process `syz.5.5973'. [ 1658.662981][T29389] x_tables: ip6_tables: dccp match: only valid for protocol 33 [ 1659.595250][ T30] kauditd_printk_skb: 76 callbacks suppressed [ 1659.595267][ T30] audit: type=1400 audit(1773738152.189:2244): avc: denied { read } for pid=29392 comm="syz.2.5977" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1659.663786][ T30] audit: type=1400 audit(1773738152.189:2245): avc: denied { open } for pid=29392 comm="syz.2.5977" path="/dev/ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1659.785777][ T30] audit: type=1400 audit(1773738152.919:2246): avc: denied { create } for pid=29396 comm="syz.4.5978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1660.190491][ T30] audit: type=1400 audit(1773738152.947:2247): avc: denied { setopt } for pid=29396 comm="syz.4.5978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1660.318315][ T30] audit: type=1400 audit(1773738152.947:2248): avc: denied { bind } for pid=29396 comm="syz.4.5978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1660.550305][T24044] usb 7-1: USB disconnect, device number 20 [ 1660.732627][ T30] audit: type=1400 audit(1773738153.518:2249): avc: denied { setopt } for pid=29400 comm="syz.0.5979" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1660.869158][T29407] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5981'. [ 1661.021608][T29410] usb usb7: usbfs: process 29410 (syz.6.5983) did not claim interface 0 before use [ 1661.301414][T29412] netlink: 'syz.5.5985': attribute type 10 has an invalid length. [ 1661.314015][T29412] bridge0: port 2(bridge_slave_1) entered disabled state [ 1661.321463][T29412] bridge0: port 1(bridge_slave_0) entered disabled state [ 1661.329552][T29414] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5984'. [ 1661.355237][ T30] audit: type=1400 audit(1773738154.388:2250): avc: denied { setopt } for pid=29415 comm="syz.6.5986" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1661.395947][ T30] audit: type=1400 audit(1773738154.407:2251): avc: denied { write } for pid=29415 comm="syz.6.5986" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1661.419435][T29412] bridge0: port 2(bridge_slave_1) entered blocking state [ 1661.426561][T29412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1661.433985][T29412] bridge0: port 1(bridge_slave_0) entered blocking state [ 1661.441127][T29412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1661.442468][T29417] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5985'. [ 1661.452187][T29412] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1661.514089][T29417] bridge_slave_1: left allmulticast mode [ 1661.519784][T29417] bridge_slave_1: left promiscuous mode [ 1661.525531][T29417] bridge0: port 2(bridge_slave_1) entered disabled state [ 1661.617937][ T30] audit: type=1400 audit(1773738154.631:2252): avc: denied { create } for pid=29420 comm="syz.6.5988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1661.778874][T29418] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=29418 comm=syz.5.5985 [ 1661.843581][T29417] bridge_slave_0: left allmulticast mode [ 1661.849338][T29417] bridge_slave_0: left promiscuous mode [ 1661.857151][T29417] bridge0: port 1(bridge_slave_0) entered disabled state [ 1662.348736][ T30] audit: type=1400 audit(1773738154.772:2253): avc: denied { name_bind } for pid=29411 comm="syz.5.5985" src=24097 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket permissive=1 [ 1662.398554][T22984] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1662.442893][T29417] bond0: (slave bridge0): Releasing backup interface [ 1662.566446][T22984] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 1662.607586][T22984] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1662.683392][T19794] block nbd3: Possible stuck request ffff888028038000: control (read@0,1024B). Runtime 300 seconds [ 1662.730990][T19794] block nbd3: Possible stuck request ffff888028038200: control (read@1024,1024B). Runtime 300 seconds [ 1662.742852][T19794] block nbd3: Possible stuck request ffff888028038400: control (read@2048,1024B). Runtime 300 seconds [ 1662.762011][T24044] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1662.762246][T19794] block nbd3: Possible stuck request ffff888028038600: control (read@3072,1024B). Runtime 300 seconds [ 1662.849771][T22984] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1662.860850][T22984] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1662.871529][T22984] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1662.896572][T22984] usb 5-1: Product: syz [ 1662.900790][T22984] usb 5-1: Manufacturer: syz [ 1662.905834][T22984] usb 5-1: SerialNumber: syz [ 1662.992715][T22984] usb 5-1: config 0 descriptor?? [ 1663.021761][T22984] hub 5-1:0.0: bad descriptor, ignoring hub [ 1663.046340][T22984] hub 5-1:0.0: probe with driver hub failed with error -5 [ 1663.061532][T24044] usb 7-1: Using ep0 maxpacket: 32 [ 1664.113052][T29447] smc: net device bond0 applied user defined pnetid SYZ2 [ 1664.123675][T29447] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5989'. [ 1664.124220][T24044] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1664.193986][ T31] INFO: task syz.3.5521:27177 blocked for more than 143 seconds. [ 1664.203012][T24044] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1664.215875][T22984] usb 5-1: selecting invalid altsetting 0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1664.408086][ T31] Tainted: G L syzkaller #0 [ 1664.429401][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1664.440220][T24044] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1664.490905][T29449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.503642][ T31] task:syz.3.5521 state:D stack:27448 pid:27177 tgid:27171 ppid:16814 task_flags:0x400040 flags:0x00080002 [ 1664.591188][T29449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1664.615601][ T31] Call Trace: [ 1664.618894][ T31] [ 1664.641673][ T31] __schedule+0xfee/0x6120 [ 1664.674649][ T31] ? __lock_acquire+0x4a5/0x2630 [ 1664.680342][ T31] ? __pfx___schedule+0x10/0x10 [ 1664.695747][ T31] ? find_held_lock+0x2b/0x80 [ 1664.708344][ T31] ? schedule+0x2bf/0x390 [ 1664.716998][ T31] schedule+0xdd/0x390 [ 1664.750166][ T31] schedule_preempt_disabled+0x13/0x30 [ 1664.755659][ T31] __mutex_lock+0xc9a/0x1b90 [ 1664.848392][ T31] ? bdev_open+0x41a/0xe40 [ 1664.853468][ T31] ? find_held_lock+0x2b/0x80 [ 1664.920397][ T31] ? find_inode_fast+0x5e3/0x910 [ 1664.925392][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1664.963222][ T31] ? find_inode_fast+0x1fa/0x910 [ 1664.978802][ T31] ? bdev_open+0x41a/0xe40 [ 1664.983235][ T31] bdev_open+0x41a/0xe40 [ 1665.061687][T24044] gspca_nw80x: reg_w err -110 [ 1665.066823][T24044] nw80x 7-1:3.0: probe with driver nw80x failed with error -110 [ 1665.097040][ T31] ? iput+0x3a/0x40 [ 1665.100859][ T31] blkdev_open+0x34e/0x4f0 [ 1665.134331][ T31] do_dentry_open+0x6d8/0x1660 [ 1665.139090][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 1665.144004][ T31] vfs_open+0x82/0x3f0 [ 1665.177044][ T31] path_openat+0x208c/0x31a0 [ 1665.182018][ T31] ? __pfx_path_openat+0x10/0x10 [ 1665.186956][ T31] do_file_open+0x20e/0x430 [ 1665.219647][ T31] ? __pfx_do_file_open+0x10/0x10 [ 1665.224689][ T31] ? alloc_fd+0x476/0x790 [ 1665.228992][ T31] ? do_getname+0x191/0x390 [ 1665.260636][ T31] do_sys_openat2+0x10d/0x1e0 [ 1665.273241][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1665.278442][ T31] ? __do_sys_capset+0xfb/0x460 [ 1665.283277][ T31] __x64_sys_openat+0x12d/0x210 [ 1665.305095][ T31] ? __pfx___x64_sys_openat+0x10/0x10 [ 1665.310478][ T31] do_syscall_64+0x106/0xf80 [ 1665.315042][ T31] ? clear_bhb_loop+0x40/0x90 [ 1665.337162][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.343053][ T31] RIP: 0033:0x7f866cb5cfce [ 1665.347445][ T31] RSP: 002b:00007f866db04b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1665.369215][ T31] RAX: ffffffffffffffda RBX: 00007f866db056c0 RCX: 00007f866cb5cfce [ 1665.377181][ T31] RDX: 0000000000080200 RSI: 00007f866db04c00 RDI: ffffffffffffff9c [ 1665.401318][ T31] RBP: 00007f866db04c00 R08: 0000000000000000 R09: 0000000000000000 [ 1665.409286][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 1665.433338][ T31] R13: 00007f866ce16128 R14: 00007f866ce16090 R15: 00007ffeb0effdc8 [ 1665.441315][ T31] [ 1665.451382][ T31] [ 1665.451382][ T31] Showing all locks held in the system: [ 1665.452558][T29447] smc: removing net device bond0 with user defined pnetid SYZ2 [ 1665.459362][ T31] 1 lock held by khungtaskd/31: [ 1665.472089][ T31] #0: ffffffff8e7e76a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 1665.482041][ T31] 2 locks held by getty/5565: [ 1665.486697][ T31] #0: ffff8880344de0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1665.496996][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 1665.507713][ T31] 1 lock held by udevd/22077: [ 1665.512417][ T31] #0: ffff888027f44358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1665.521937][ T31] 1 lock held by syz.3.5521/27177: [ 1665.527019][ T31] #0: ffff888027f44358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 1665.536343][ T31] 1 lock held by syz.6.5988/29427: [ 1665.541443][ T31] #0: ffffffff8e7f32b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 1665.551772][ T31] 2 locks held by syz.4.5989/29447: [ 1665.556950][ T31] #0: ffffffff906114a8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dellink+0x307/0xb40 [ 1665.565913][ T31] #1: ffffffff8e7f32b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 [ 1665.575958][ T31] [ 1665.619021][ T31] ============================================= [ 1665.619021][ T31] [ 1665.659110][ T31] NMI backtrace for cpu 0 [ 1665.659121][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1665.659137][ T31] Tainted: [L]=SOFTLOCKUP [ 1665.659141][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1665.659148][ T31] Call Trace: [ 1665.659152][ T31] [ 1665.659156][ T31] dump_stack_lvl+0x100/0x190 [ 1665.659178][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 1665.659190][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1665.659209][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 1665.659230][ T31] sys_info+0x141/0x190 [ 1665.659247][ T31] watchdog+0xd25/0x1050 [ 1665.659266][ T31] ? __pfx_watchdog+0x10/0x10 [ 1665.659283][ T31] ? __kthread_parkme+0x18c/0x230 [ 1665.659300][ T31] ? kthread+0x13a/0x450 [ 1665.659309][ T31] ? __pfx_watchdog+0x10/0x10 [ 1665.659324][ T31] kthread+0x370/0x450 [ 1665.659333][ T31] ? __pfx_kthread+0x10/0x10 [ 1665.659345][ T31] ret_from_fork+0x754/0xd80 [ 1665.659357][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1665.659369][ T31] ? __switch_to+0x7b4/0x1120 [ 1665.659382][ T31] ? __pfx_kthread+0x10/0x10 [ 1665.659394][ T31] ret_from_fork_asm+0x1a/0x30 [ 1665.659412][ T31] [ 1665.659417][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1665.785757][ C1] NMI backtrace for cpu 1 [ 1665.785775][ C1] CPU: 1 UID: 0 PID: 29180 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT(full) [ 1665.785794][ C1] Tainted: [L]=SOFTLOCKUP [ 1665.785799][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1665.785807][ C1] RIP: 0010:__lock_acquire+0x4a5/0x2630 [ 1665.785824][ C1] Code: 8d 38 0b 00 00 ba 07 00 00 00 85 c9 8b 4c 24 08 0f 85 7f 03 00 00 ba 08 00 00 00 48 89 de 48 89 ef 89 4c 24 08 e8 eb ee ff ff <8b> 4c 24 08 85 c0 0f 84 d8 fe ff ff 8b 05 c9 90 38 19 85 c0 75 11 [ 1665.785837][ C1] RSP: 0018:ffffc90006247520 EFLAGS: 00000046 [ 1665.785850][ C1] RAX: 0000000000000001 RBX: ffff8880282b54d8 RCX: 0000000000000200 [ 1665.785859][ C1] RDX: 0000000000000000 RSI: ffff8880282b54d8 RDI: ffff8880282b4980 [ 1665.785868][ C1] RBP: ffff8880282b4980 R08: 0000000000000000 R09: 0000000000000000 [ 1665.785876][ C1] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 1665.785884][ C1] R13: 0000000000000007 R14: 0000000000020000 R15: 0000000000000005 [ 1665.785894][ C1] FS: 0000000000000000(0000) GS:ffff888124442000(0000) knlGS:0000000000000000 [ 1665.785908][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1665.785917][ C1] CR2: 0000200000016000 CR3: 000000000e598000 CR4: 00000000003526f0 [ 1665.785926][ C1] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 1665.785935][ C1] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1665.785945][ C1] Call Trace: [ 1665.785949][ C1] [ 1665.785955][ C1] ? __lock_acquire+0x4a5/0x2630 [ 1665.785973][ C1] lock_acquire+0x1cf/0x380 [ 1665.785985][ C1] ? unwind_next_frame+0xbd/0x1ea0 [ 1665.786001][ C1] ? unwind_next_frame+0x3be/0x1ea0 [ 1665.786021][ C1] ? unwind_next_frame+0x3be/0x1ea0 [ 1665.786037][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1665.786054][ C1] unwind_next_frame+0xd1/0x1ea0 [ 1665.786069][ C1] ? unwind_next_frame+0xbd/0x1ea0 [ 1665.786083][ C1] ? __free_frozen_pages+0x7e1/0x10d0 [ 1665.786100][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1665.786117][ C1] arch_stack_walk+0x94/0xf0 [ 1665.786133][ C1] ? __free_frozen_pages+0x7e1/0x10d0 [ 1665.786149][ C1] stack_trace_save+0x8e/0xc0 [ 1665.786164][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1665.786181][ C1] ? __lock_acquire+0x4a5/0x2630 [ 1665.786193][ C1] save_stack+0x162/0x1e0 [ 1665.786211][ C1] ? __pfx_save_stack+0x10/0x10 [ 1665.786229][ C1] ? __free_frozen_pages+0x7e1/0x10d0 [ 1665.786245][ C1] ? page_ext_put+0x3e/0xd0 [ 1665.786265][ C1] __reset_page_owner+0x84/0x190 [ 1665.786284][ C1] __free_frozen_pages+0x7e1/0x10d0 [ 1665.786301][ C1] vfree.part.0+0x12b/0x9d0 [ 1665.786315][ C1] ? __pfx___might_resched+0x10/0x10 [ 1665.786331][ C1] ? __pfx_kcov_close+0x10/0x10 [ 1665.786347][ C1] ? rcu_is_watching+0x12/0xc0 [ 1665.786363][ C1] ? __pfx_kcov_close+0x10/0x10 [ 1665.786379][ C1] vfree+0x55/0x80 [ 1665.786392][ C1] kcov_close+0x34/0x60 [ 1665.786407][ C1] __fput+0x3ff/0xb40 [ 1665.786423][ C1] task_work_run+0x150/0x240 [ 1665.786438][ C1] ? __pfx_task_work_run+0x10/0x10 [ 1665.786455][ C1] do_exit+0x8b8/0x2b60 [ 1665.786472][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1665.786490][ C1] ? __pfx_do_exit+0x10/0x10 [ 1665.786508][ C1] ? do_raw_spin_lock+0x128/0x260 [ 1665.786522][ C1] ? find_held_lock+0x2b/0x80 [ 1665.786538][ C1] ? get_signal+0x7e0/0x21e0 [ 1665.786554][ C1] do_group_exit+0xd5/0x2a0 [ 1665.786573][ C1] get_signal+0x1ec7/0x21e0 [ 1665.786591][ C1] ? __pfx_get_signal+0x10/0x10 [ 1665.786609][ C1] arch_do_signal_or_restart+0x91/0x7a0 [ 1665.786627][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1665.786646][ C1] ? putname+0xb1/0x110 [ 1665.786662][ C1] exit_to_user_mode_loop+0x86/0x4a0 [ 1665.786675][ C1] do_syscall_64+0x67c/0xf80 [ 1665.786690][ C1] ? clear_bhb_loop+0x40/0x90 [ 1665.786706][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.786719][ C1] RIP: 0033:0x7f1481d9b887 [ 1665.786729][ C1] Code: Unable to access opcode bytes at 0x7f1481d9b85d. [ 1665.786735][ C1] RSP: 002b:00007ffd3c27fcc8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 1665.786747][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f1481d9b887 [ 1665.786755][ C1] RDX: 00007ffd3c27fcf0 RSI: 00007ffd3c27fd80 RDI: 00007ffd3c27fd80 [ 1665.786763][ C1] RBP: 00007ffd3c27fd80 R08: 00007ffd3c280d80 R09: 00000000ffffffff [ 1665.786772][ C1] R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffd3c280e10 [ 1665.786780][ C1] R13: 00007f1481e32050 R14: 00000000001a1b20 R15: 00007ffd3c280e50 [ 1665.786794][ C1] [ 1666.349320][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1666.356162][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1666.366804][ T31] Tainted: [L]=SOFTLOCKUP [ 1666.371095][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1666.381118][ T31] Call Trace: [ 1666.384377][ T31] [ 1666.387291][ T31] dump_stack_lvl+0x100/0x190 [ 1666.391961][ T31] vpanic+0x552/0x970 [ 1666.395922][ T31] ? __pfx_vpanic+0x10/0x10 [ 1666.400397][ T31] ? rcu_is_watching+0x12/0xc0 [ 1666.405133][ T31] panic+0xd1/0xe0 [ 1666.408833][ T31] ? __pfx_panic+0x10/0x10 [ 1666.413220][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 1666.419349][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 1666.425477][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 1666.431605][ T31] ? watchdog.cold+0x198/0x1ca [ 1666.436339][ T31] ? watchdog+0xd35/0x1050 [ 1666.440728][ T31] watchdog.cold+0x1a9/0x1ca [ 1666.445293][ T31] ? __pfx_watchdog+0x10/0x10 [ 1666.449945][ T31] ? __kthread_parkme+0x18c/0x230 [ 1666.454944][ T31] ? kthread+0x13a/0x450 [ 1666.459166][ T31] ? __pfx_watchdog+0x10/0x10 [ 1666.463831][ T31] kthread+0x370/0x450 [ 1666.467867][ T31] ? __pfx_kthread+0x10/0x10 [ 1666.472426][ T31] ret_from_fork+0x754/0xd80 [ 1666.476986][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1666.482067][ T31] ? __switch_to+0x7b4/0x1120 [ 1666.486727][ T31] ? __pfx_kthread+0x10/0x10 [ 1666.491286][ T31] ret_from_fork_asm+0x1a/0x30 [ 1666.496028][ T31] [ 1666.499218][ T31] Kernel Offset: disabled [ 1666.503517][ T31] Rebooting in 86400 seconds..