last executing test programs: 11m11.452385366s ago: executing program 3 (id=2395): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 11m9.476881511s ago: executing program 3 (id=2397): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000380)={0x28, 0x7, r4, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, 0x0) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLL', 0x3, 0x2}) 11m6.896055659s ago: executing program 3 (id=2400): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f0000000180)=0x1, 0x86, 0x2, 0x0, 0x0, 0xfffffffc) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x248) close(r1) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r2, 0x40043d0d, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX=r1, @ANYBLOB]) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x40, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x40}}, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x80, &(0x7f00000010c0)=""/4111, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x4010000) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000100)='asymmetric\x00', &(0x7f0000000040)) 11m2.596632457s ago: executing program 3 (id=2405): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) 11m1.156539268s ago: executing program 3 (id=2408): bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x6, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6(0xa, 0x2, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) r3 = getpgrp(r2) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf5c5d000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$FS_IOC_SETFLAGS(r1, 0x40186f40, &(0x7f0000000440)=0x1f) setsockopt$inet6_int(r0, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 10m59.88013843s ago: executing program 3 (id=2409): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[], 0x58) openat$urandom(0xffffffffffffff9c, 0x0, 0x482, 0x0) eventfd2(0x80000000, 0x80000) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000280)}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x1000, 0x80000100008a}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x400000bce) socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x1e, 0x4, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080), 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 10m43.691288554s ago: executing program 32 (id=2409): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000600)=ANY=[], 0x58) openat$urandom(0xffffffffffffff9c, 0x0, 0x482, 0x0) eventfd2(0x80000000, 0x80000) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000280)}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x1000, 0x80000100008a}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x400000bce) socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x1e, 0x4, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080), 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 19.695335534s ago: executing program 0 (id=3624): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(r2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) unshare(0x8000400) eventfd2(0x0, 0x0) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRESDEC=r4, @ANYBLOB='\x00'/18, @ANYRESOCT=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x50) fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) socket$kcm(0xa, 0x3, 0x3a) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000140)={0xffff2369, 0x1, 0x2}) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x2b, 0x13, 0x0, 0x2, 0xb, 0xa9, 0x5, 0x2, 0x1}) 15.841883802s ago: executing program 0 (id=3637): socket(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = semget$private(0x0, 0x6, 0x0) semtimedop(r4, &(0x7f0000000080)=[{0x4, 0xff, 0x1800}, {0x4, 0x2, 0x800}, {0x1, 0x0, 0x1000}], 0x3, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0x9, 0x0, 0x0, @fd=r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/16], 0x0}, 0x94) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) 14.096720379s ago: executing program 1 (id=3638): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x416d) 12.591172649s ago: executing program 0 (id=3642): socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x101) epoll_create(0xff9) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x20080, 0x0) dup3(r3, r0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x300, 0x300, 0x0, 0x0, 0x0, 0x37a0}, 0x0, 0x0, 0x0, 0x0) 11.644594439s ago: executing program 0 (id=3646): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r5 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, 0x0) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, &(0x7f0000000440)={0x28, 0x7, r4, 0x0, &(0x7f0000000480)='LLL', 0x3, 0x2}) 9.780370415s ago: executing program 0 (id=3649): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, 0x0, 0x0) 9.53105707s ago: executing program 1 (id=3650): syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000153000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f00005fd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x303e, &(0x7f0000000040)={0x0, 0xc8a2, 0xc000, 0x80008, 0xc0}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600100004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 6.060421867s ago: executing program 1 (id=3658): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0xdc, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff, 0x6}) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r5 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000380)={0x28, 0x7, r4, 0x0, &(0x7f0000ffc000/0x1000)=nil, 0x1000}) ioctl$IOMMU_IOAS_MAP(r3, 0x3b85, 0x0) 6.000285116s ago: executing program 4 (id=3659): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x89}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) write$UHID_INPUT(r0, &(0x7f0000001040)={0xc, {"a2e3ad2107c752f91b25470987f70e06d038e7ff7fc6e5539b3264078b089b3b083468060890e0878f0e1ac6e70a9b3365959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31350d095d0636cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7dafbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f5f71d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810930500ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab974c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc660db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d154d8a5ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21e5ec68cb068ea88067d905ea917bb03eefdaebdeabf2c0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) 4.489667455s ago: executing program 1 (id=3660): socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x101) epoll_create(0xff9) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000010000', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x20080, 0x0) dup3(r3, r0, 0x0) close(0x3) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x300, 0x300, 0x0, 0x0, 0x0, 0x37a0}, 0x0, 0x0, 0x0, 0x0) r4 = syz_io_uring_setup(0x4ed, &(0x7f0000000140)={0x0, 0xfec9, 0x0, 0xfffffffc, 0x274}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r4, 0xdb4, 0xd070, 0x0, 0x0, 0x0) 4.188574891s ago: executing program 2 (id=3661): socket(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = semget$private(0x0, 0x6, 0x0) semtimedop(r4, &(0x7f0000000080)=[{0x4, 0xff, 0x1800}, {0x4, 0x2, 0x800}, {0x1, 0x0, 0x1000}], 0x3, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0x9, 0x0, 0x0, @fd=r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/16], 0x0}, 0x94) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x3, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00', 'r\x0e\x81|\x0f\xa3\x8a\xb9\x8c\x94\x04\x17\v\rh\x10'], 0xc15c}) 3.979017193s ago: executing program 0 (id=3662): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) syz_usb_connect$cdc_ecm(0x0, 0x56, 0x0, 0x0) ioctl$TCFLSH(r1, 0x400455c8, 0x400000009) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 3.941928837s ago: executing program 4 (id=3663): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000900)={'syztnl2\x00', 0x0, 0x4, 0x7b, 0x9b, 0x9, 0x41, @remote, @loopback, 0x7, 0x40, 0x8, 0xffffffff}}) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$netlink(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={0x0, 0x9c}, 0x1, 0x0, 0x0, 0x400c004}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000005c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f0000000c00)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x1000400000de, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000380), 0x3, r4, 0xcccccccc}) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, &(0x7f0000000180)) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x10) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) 2.613017958s ago: executing program 2 (id=3664): socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000001400), 0x101) epoll_create(0xff9) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002480)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x1030002}}, 0x50) read$FUSE(r0, &(0x7f00000065c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x20080, 0x0) dup3(r3, r0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x300, 0x300, 0x0, 0x0, 0x0, 0x37a0}, 0x0, 0x0, 0x0, 0x0) 1.804568323s ago: executing program 2 (id=3665): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffa, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000002, 0x12, 0xffffffffffffffff, 0x0) setresuid(0xee01, 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r1, 0xc0303e03, &(0x7f00000000c0)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r4, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r5}], 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r7}, 0x2c, {[{@dfltgid}]}}) close_range(r0, r5, 0x0) 1.517699872s ago: executing program 4 (id=3666): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='devices.list\x00', 0x275a, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000740)={0x30, 0x5, 0x0, {0x0, 0x2, 0x0, 0x1}}, 0x30) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') fchdir(r1) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x416d) 1.224024519s ago: executing program 4 (id=3667): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) timer_create(0x0, 0x0, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900000800b7"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 1.00669906s ago: executing program 4 (id=3668): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB="080000000000000000000000000000000000000094bee2e7e598fea2ad21014d1c3a2af3851e6a191fcbc10774798544f8927886f343cbbb8d43a9ce382b5df710fda8273783e73234acde82345313477d2b5a965787117a628281fc1738d741fc88b5e6cc366e59105d935a4ca14ab2e70ff518db3e2d60383b6853c58ac3b0171514829fe3e7de9fc1fc54ad653f18d04ce79043e4935d2992", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0400"/28], 0x50) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x10bb41) ioctl$USBDEVFS_RESET(r0, 0x8008550e) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000680)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x248, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x330, 0x330, 0x330, 0xffffffff, 0x4, &(0x7f0000000080), {[{{@ipv6={@loopback, @private2={0xfc, 0x2, '\x00', 0x1}, [0xff000000, 0xff000000, 0x0, 0xff], [0xff000000, 0x0, 0xffffffff, 0xff], 'lo\x00', 'dvmrp0\x00', {0xff}, {}, 0x84, 0x9, 0x4, 0x58}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0xe2, 0x28, "6c8c61c7cb55d04abaae4658fdaad4b05e818e14980e5fb6af19c6c71daf"}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast1, [0xff000000, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0xffffff00, 0xff, 0xff000000], 'team_slave_1\x00', 'bond0\x00', {}, {}, 0x4, 0x40, 0x9, 0x28}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x2, 0x7f, {0xc}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) syz_init_net_socket$ax25(0x3, 0x5, 0xca) r3 = io_uring_setup(0x669, &(0x7f00000002c0)) close_range(r3, 0xffffffffffffffff, 0x0) fcntl$setsig(r3, 0xa, 0x35) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) 1.00583468s ago: executing program 1 (id=3669): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000000000014000000000000002900000034000000fdffffff"], 0x188}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) pwritev(0xffffffffffffffff, &(0x7f0000000d80)=[{&(0x7f0000000780)="42ebe7f5d8dde5f3e9c5c7e7bc09d8d80f373ae4dc85e6cb597bd322663b986ff272399bec41d811a763bcd2cdc221d2ac6cdeeca815ce250ce959444e7f296cb11433", 0x43}, {0x0}, {&(0x7f0000000540)}, {&(0x7f0000000580)="1ab9a1fec95331b4b1bb5f840b0a198cb5add980a1e5cd402aaabeb7a27d1418376394238ae0a1ca9cc4187957fdca8dfa1151a311e577e1461a24", 0x3b}, {&(0x7f0000000700)}, {&(0x7f0000000d00)="7cedc13b1cbf2308b2000d3d", 0xc}], 0x6, 0x4d9e, 0x8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000090000000480080002400000000008000140000000000900010000008000000000004c000000060a0104000000000000000001000000240004802000018007000100727400001400028008000240ce31b6cf080001400000000308000b40000000000900010073797a3000e9ffff130000000100010000000000000aeeb9c7da275615ac46ea6889d53c4ae599307c3ebec1699a88c01503d6fa07347deedf1ea28f6f72f6f980cf56d609aa0aa2aba830c53cbb6f3d7823e6d132c066dd4c9ee3ec9c0b34dbefe6"], 0xd4}}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_COPY(r4, 0x3b83, &(0x7f0000000080)={0x28, 0x6, 0x0, 0x0, 0x0, 0x3, 0xa61}) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b", 0x44}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 325.371088ms ago: executing program 2 (id=3670): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000440)={r2, 0x0, 0x0, 0x0, 0x0, [], [0x0, 0x3, 0x2], [0x0, 0x0, 0x3], [0x4000000, 0xc, 0x0, 0x4]}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000280)={r2, 0x0, 0x0, 0x0, 0x0, [], [0x0, 0x9], [0x0, 0x2, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) 157.184087ms ago: executing program 2 (id=3671): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x20) connect$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0xb}, 0x20) syz_emit_ethernet(0x8e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa1acd1f78800d86dd608a37f200587300fe8097000000000000000000000000bbfe8000000000000000000000000000aa00000000", @ANYRES8], 0x0) 50.670638ms ago: executing program 4 (id=3672): socket(0xa, 0x3, 0x3a) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = semget$private(0x0, 0x6, 0x0) semtimedop(r4, &(0x7f0000000080)=[{0x4, 0xff, 0x1800}, {0x4, 0x2, 0x800}, {0x1, 0x0, 0x1000}], 0x3, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0x9, 0x0, 0x0, @fd=r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200"/16], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r5, 0xc1105517, 0x0) 686.85µs ago: executing program 2 (id=3673): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) openat$kvm(0xffffffffffffff9c, 0x0, 0x40182, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x5, 0x8, 0x8005, 0x0, 0x9, 0x1000000000, 0x7, 0xfa11, 0x6}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000300), 0x6000) socket$inet6_sctp(0xa, 0x1, 0x84) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, 0xffffffffffffffff, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x16ba82, 0x10) write$cgroup_int(r2, &(0x7f0000000180)=0xfe5f, 0x12) 0s ago: executing program 1 (id=3674): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0xdc, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(r2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) unshare(0x8000400) eventfd2(0x0, 0x0) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYRESDEC=r4, @ANYBLOB='\x00'/18, @ANYRESOCT=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x50) fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) socket$kcm(0xa, 0x3, 0x3a) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000140)={0xffff2369, 0x1, 0x2}) ioctl$RTC_UIE_ON(r0, 0x7003) ioctl$RTC_AIE_ON(r0, 0x7001) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000040)={0x2b, 0x13, 0x0, 0x2, 0xb, 0xa9, 0x5, 0x2, 0x1}) kernel console output (not intermixed with test programs): batadv0): Releasing backup interface [ 1250.856182][ T1135] bond0 (unregistering): Released all slaves [ 1253.648079][T14065] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2404'. [ 1255.130958][ T1135] IPVS: stop unused estimator thread 0... [ 1255.360343][T13901] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1255.417749][T13901] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1255.443879][T13901] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1255.454496][ T6269] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1255.467595][T13901] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1255.672992][T14077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1255.684750][T14077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1255.723855][ T28] audit: type=1804 audit(1772865442.704:27): pid=14084 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2403" name="/newroot/608/file1" dev="fuse" ino=1 res=1 errno=0 [ 1255.756319][ T6269] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1255.782218][ T6269] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1255.797748][T13901] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1255.811396][ T6269] usb 1-1: can't read configurations, error -71 [ 1256.274389][T14088] ubi: mtd0 is already attached to ubi31 [ 1256.825554][T13901] 8021q: adding VLAN 0 to HW filter on device team0 [ 1256.862219][ T1076] bridge0: port 1(bridge_slave_0) entered blocking state [ 1256.870056][ T1076] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1256.933298][ T1076] bridge0: port 2(bridge_slave_1) entered blocking state [ 1256.940544][ T1076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1257.485201][T14102] ntfs3: nbd1: try to read out of volume at offset 0x0 [ 1258.237938][T13901] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1258.595739][T14117] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2413'. [ 1259.079183][T13901] veth0_vlan: entered promiscuous mode [ 1259.093978][T13901] veth1_vlan: entered promiscuous mode [ 1259.149891][T13901] veth0_macvtap: entered promiscuous mode [ 1259.170572][T13901] veth1_macvtap: entered promiscuous mode [ 1259.261219][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1259.285983][T14125] overlayfs: missing 'lowerdir' [ 1259.291961][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.309925][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1259.324286][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.347679][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1259.586399][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.681060][T13901] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1259.808156][T14130] netlink: 'syz.0.2414': attribute type 4 has an invalid length. [ 1259.818098][T14130] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2414'. [ 1259.846849][T14130] wlan1: mtu less than device minimum [ 1260.303182][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1260.408497][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.656332][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1260.754777][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.764821][T13901] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1260.794479][T13901] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1260.836491][T13901] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1260.889119][T13901] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1260.914452][T13901] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1260.955093][T13901] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1260.963818][T13901] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.414331][T14138] ubi: mtd0 is already attached to ubi31 [ 1262.262652][ T4534] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1262.278503][ T4534] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1262.368119][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1262.418968][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1266.261213][T14178] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2421'. [ 1267.266718][T14179] ntfs3: nbd2: try to read out of volume at offset 0x0 [ 1267.631904][T13903] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1267.648951][T13903] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1267.660772][T13903] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1267.669583][T13903] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1267.678395][T13903] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1267.686034][T13903] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1267.770730][ T1135] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.141362][T14187] wg2 speed is unknown, defaulting to 1000 [ 1269.268717][ T1135] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.813996][ T5781] Bluetooth: hci0: command tx timeout [ 1270.061810][ T1135] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1270.176848][T14202] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2426'. [ 1270.900357][T14197] bridge0: entered promiscuous mode [ 1270.915994][T14197] macsec1: entered promiscuous mode [ 1270.929790][T14202] wg2 speed is unknown, defaulting to 1000 [ 1271.140615][T14205] overlayfs: missing 'lowerdir' [ 1271.185822][ T1135] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.862391][ T5781] Bluetooth: hci0: command tx timeout [ 1272.901189][T14212] overlayfs: empty lowerdir [ 1273.424630][T14208] netlink: 'syz.0.2427': attribute type 4 has an invalid length. [ 1273.504156][T14208] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2427'. [ 1273.566254][T14208] wlan1: mtu less than device minimum [ 1273.955826][T14187] chnl_net:caif_netlink_parms(): no params data found [ 1274.948021][ T5781] Bluetooth: hci0: command tx timeout [ 1275.570133][T13903] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1275.584929][T13903] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1275.596947][T13903] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1275.622910][T13903] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1275.633769][T13903] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1275.644317][T13903] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1275.995554][T14187] bridge0: port 1(bridge_slave_0) entered blocking state [ 1276.003175][T14187] bridge0: port 1(bridge_slave_0) entered disabled state [ 1276.013755][T14187] bridge_slave_0: entered allmulticast mode [ 1276.021903][T14187] bridge_slave_0: entered promiscuous mode [ 1276.098136][T14187] bridge0: port 2(bridge_slave_1) entered blocking state [ 1276.115091][T14187] bridge0: port 2(bridge_slave_1) entered disabled state [ 1276.132895][T14187] bridge_slave_1: entered allmulticast mode [ 1276.147333][T14187] bridge_slave_1: entered promiscuous mode [ 1276.308715][T14252] ntfs3: nbd2: try to read out of volume at offset 0x0 [ 1276.974722][T14187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1277.080073][T14259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2434'. [ 1277.089623][ T5781] Bluetooth: hci0: command tx timeout [ 1277.310584][T14187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1277.559296][T14259] wg2 speed is unknown, defaulting to 1000 [ 1277.744226][ T5781] Bluetooth: hci2: command tx timeout [ 1277.755832][T14238] wg2 speed is unknown, defaulting to 1000 [ 1277.835190][T14187] team0: Port device team_slave_0 added [ 1277.928217][T14187] team0: Port device team_slave_1 added [ 1278.078093][T14187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1278.085193][T14187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1278.111688][T14187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1279.218663][T14187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1279.249366][T14187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1279.276684][T14187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1279.343682][T14274] overlayfs: failed to resolve './file1': -2 [ 1279.422898][T14277] overlayfs: missing 'lowerdir' [ 1279.763152][T14283] overlayfs: empty lowerdir [ 1279.834319][ T5781] Bluetooth: hci2: command tx timeout [ 1280.353658][T14280] netlink: 'syz.0.2438': attribute type 4 has an invalid length. [ 1280.416143][T14280] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2438'. [ 1280.466593][T14280] wlan1: mtu less than device minimum [ 1280.506181][T14187] hsr_slave_0: entered promiscuous mode [ 1281.963600][ T5781] Bluetooth: hci2: command tx timeout [ 1281.983664][T14187] hsr_slave_1: entered promiscuous mode [ 1282.014560][T14187] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1282.022183][T14187] Cannot create hsr debugfs directory [ 1282.137722][T14300] ntfs3: nbd0: try to read out of volume at offset 0x0 [ 1282.687003][ T1135] bond0: (slave wlan1): Releasing backup interface [ 1284.177696][ T5781] Bluetooth: hci2: command tx timeout [ 1284.609150][ T1135] hsr_slave_0: left promiscuous mode [ 1284.661771][ T1135] hsr_slave_1: left promiscuous mode [ 1284.703955][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1284.712048][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1284.725668][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1284.733140][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1284.766127][ T1135] bridge_slave_1: left allmulticast mode [ 1284.771833][ T1135] bridge_slave_1: left promiscuous mode [ 1284.791689][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 1284.816446][ T1135] bridge_slave_0: left allmulticast mode [ 1284.822313][ T1135] bridge_slave_0: left promiscuous mode [ 1284.844544][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 1285.464638][T14317] overlayfs: NFS export requires "redirect_dir=nofollow" on non-upper mount, falling back to nfs_export=off. [ 1285.489125][T14317] overlayfs: missing 'lowerdir' [ 1285.578726][T14320] overlayfs: failed to resolve './file0': -2 [ 1285.599539][T14321] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2443'. [ 1285.714786][ T1135] bridge0: left promiscuous mode [ 1285.728633][ T1135] veth1_macvtap: left promiscuous mode [ 1285.737067][ T1135] veth0_macvtap: left promiscuous mode [ 1285.742877][ T1135] veth1_vlan: left promiscuous mode [ 1285.753368][ T1135] veth0_vlan: left promiscuous mode [ 1289.100689][T14335] kvm: pic: non byte write [ 1289.486062][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 1289.543693][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 1289.601816][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1289.660083][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1290.107377][ T1135] bond0 (unregistering): Released all slaves [ 1290.149018][ T1135] vcan0 (unregistering): left allmulticast mode [ 1290.385384][T14321] wg2 speed is unknown, defaulting to 1000 [ 1290.503665][ T967] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1290.532730][T14238] chnl_net:caif_netlink_parms(): no params data found [ 1290.572305][T14346] overlayfs: missing 'lowerdir' [ 1290.639904][T14346] netlink: 'syz.2.2453': attribute type 4 has an invalid length. [ 1290.648420][T14346] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2453'. [ 1290.662495][T14346] .`: renamed from bond0 (while UP) [ 1290.680777][T14347] overlayfs: empty lowerdir [ 1290.709846][ T967] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1290.766617][ T967] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1290.795633][ T967] usb 1-1: can't read configurations, error -71 [ 1291.367790][T14238] bridge0: port 1(bridge_slave_0) entered blocking state [ 1291.446050][T14238] bridge0: port 1(bridge_slave_0) entered disabled state [ 1291.447224][T14364] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1291.457200][T14238] bridge_slave_0: entered allmulticast mode [ 1291.631628][T14238] bridge_slave_0: entered promiscuous mode [ 1291.777451][T14238] bridge0: port 2(bridge_slave_1) entered blocking state [ 1291.896611][T14238] bridge0: port 2(bridge_slave_1) entered disabled state [ 1291.996640][T14238] bridge_slave_1: entered allmulticast mode [ 1293.506064][T14238] bridge_slave_1: entered promiscuous mode [ 1293.572234][ T1135] IPVS: stop unused estimator thread 0... [ 1293.681148][T14238] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1293.722671][T14238] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1294.079764][T14377] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2459'. [ 1294.089003][T14377] wg2 speed is unknown, defaulting to 1000 [ 1294.179197][T14238] team0: Port device team_slave_0 added [ 1294.302600][T14238] team0: Port device team_slave_1 added [ 1294.695035][T14238] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1294.702050][T14238] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1294.820321][T14238] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1294.940395][ T1135] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.002695][T14238] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1295.029134][T14238] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1295.095577][T14238] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1295.168940][ T1135] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.250217][T14187] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1295.290622][T14238] hsr_slave_0: entered promiscuous mode [ 1295.311594][T14238] hsr_slave_1: entered promiscuous mode [ 1295.352542][T14238] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1295.387891][T14238] Cannot create hsr debugfs directory [ 1295.445055][ T1135] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.472497][T14187] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1295.503466][T14187] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1295.562837][ T1135] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1295.577321][T14187] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1295.814490][ T5872] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 1295.826725][ T1135] tipc: Left network mode [ 1296.028326][ T5872] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1296.049731][ T5872] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1296.068435][ T5872] usb 3-1: config 220 has no interface number 2 [ 1296.078564][ T5872] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1296.102342][ T5872] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1296.110925][ T5872] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1296.124400][ T5872] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1296.142987][ T5872] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1296.152821][ T5872] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1296.168558][ T5872] usb 3-1: Product: syz [ 1296.172932][ T5872] usb 3-1: Manufacturer: syz [ 1296.180501][ T5872] usb 3-1: SerialNumber: syz [ 1296.270481][T14238] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1296.297259][T14238] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1296.376932][T14238] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1296.396046][T14238] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1296.430198][ T5872] usb 3-1: selecting invalid altsetting 0 [ 1296.445109][ T5872] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1296.466559][ T5872] usb 3-1: No valid video chain found. [ 1296.499215][ T5872] usb 3-1: selecting invalid altsetting 0 [ 1296.510631][ T5872] usbtest: probe of 3-1:220.1 failed with error -22 [ 1296.520397][T14187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1296.525121][ T5872] usb 3-1: USB disconnect, device number 14 [ 1296.702832][T14187] 8021q: adding VLAN 0 to HW filter on device team0 [ 1296.715584][ T5817] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1296.760508][ T4534] bridge0: port 1(bridge_slave_0) entered blocking state [ 1296.767793][ T4534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1296.861772][ T1076] bridge0: port 2(bridge_slave_1) entered blocking state [ 1296.869052][ T1076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1296.937205][ T5817] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1296.969047][ T5817] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1296.992130][ T5817] usb 1-1: can't read configurations, error -71 [ 1297.035632][T14238] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1297.490949][ T1135] bond0: (slave wlan1): Releasing backup interface [ 1299.382919][T14238] 8021q: adding VLAN 0 to HW filter on device team0 [ 1299.529952][ T4534] bridge0: port 1(bridge_slave_0) entered blocking state [ 1299.537151][ T4534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1299.642806][ T4534] bridge0: port 2(bridge_slave_1) entered blocking state [ 1299.650078][ T4534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1299.654244][ T27] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1299.800418][ T1135] hsr_slave_0: left promiscuous mode [ 1299.818559][ T1135] hsr_slave_1: left promiscuous mode [ 1299.832552][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1299.840585][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1299.856716][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1299.874184][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1299.885525][ T1135] bridge_slave_1: left allmulticast mode [ 1299.886526][ T27] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1299.891193][ T1135] bridge_slave_1: left promiscuous mode [ 1299.917158][ T27] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1299.933519][ T1135] bridge0: port 2(bridge_slave_1) entered disabled state [ 1299.949964][ T27] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1299.961180][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1299.977858][ T1135] bridge_slave_0: left allmulticast mode [ 1299.983596][ T1135] bridge_slave_0: left promiscuous mode [ 1299.995082][ T1135] bridge0: port 1(bridge_slave_0) entered disabled state [ 1299.995110][ T27] usb 3-1: Product: syz [ 1300.011157][ T27] usb 3-1: Manufacturer: syz [ 1300.020644][ T27] usb 3-1: SerialNumber: syz [ 1300.036607][ T27] usb 3-1: config 0 descriptor?? [ 1300.357487][ T5819] usb 3-1: USB disconnect, device number 15 [ 1300.547966][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.559376][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.587801][ T1135] bridge0: left promiscuous mode [ 1300.599374][ T1135] veth1_macvtap: left promiscuous mode [ 1300.605085][ T1135] veth0_macvtap: left promiscuous mode [ 1300.611951][ T1135] veth1_vlan: left promiscuous mode [ 1300.619000][ T1135] veth0_vlan: left promiscuous mode [ 1301.614300][ T5819] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1301.818211][ T5819] usb 1-1: Using ep0 maxpacket: 16 [ 1301.833945][ T5819] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 1301.843162][ T5819] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1301.853135][ T5819] usb 1-1: Product: syz [ 1301.857688][ T5819] usb 1-1: Manufacturer: syz [ 1301.862327][ T5819] usb 1-1: SerialNumber: syz [ 1301.888350][ T5819] usb 1-1: config 0 descriptor?? [ 1301.911430][ T5819] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 1301.932689][ T5819] usb 1-1: Detected FT-X [ 1301.947345][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 1302.006116][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 1302.066534][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1302.120423][ T5819] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 1302.131753][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1302.339767][ T5819] ftdi_sio 1-1:0.0: GPIO initialisation failed: -71 [ 1302.373024][ T5819] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1302.402333][ T5819] usb 1-1: USB disconnect, device number 22 [ 1302.433790][ T5819] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1302.456274][ T5819] ftdi_sio 1-1:0.0: device disconnected [ 1302.698729][ T1135] bond0 (unregistering): Released all slaves [ 1302.729943][ T1135] vcan0 (unregistering): left allmulticast mode [ 1302.936098][ T27] wg2 speed is unknown, defaulting to 1000 [ 1302.983427][T14187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1303.342409][T14443] kvm: pic: non byte write [ 1303.376095][T14187] veth0_vlan: entered promiscuous mode [ 1303.449693][T14187] veth1_vlan: entered promiscuous mode [ 1303.786129][T14187] veth0_macvtap: entered promiscuous mode [ 1303.830386][T14187] veth1_macvtap: entered promiscuous mode [ 1304.387972][T14187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1304.422535][T14187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1304.432744][T14187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1304.443524][T14187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1304.456075][T14187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1304.482301][T14187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1304.516910][T14187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1304.564273][T14187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1304.585257][T14187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1304.597442][T14187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1304.643479][T14187] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1304.663586][T14187] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1304.675093][T14187] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1304.694246][T14187] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1304.730961][T14238] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1304.824354][ T6269] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1305.050125][ T6269] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1305.062246][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1305.069046][ T6269] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1305.102018][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1305.109123][ T6269] usb 1-1: can't read configurations, error -71 [ 1305.198717][ T1093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1305.207773][ T1093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1306.477882][T14238] veth0_vlan: entered promiscuous mode [ 1306.520339][T14238] veth1_vlan: entered promiscuous mode [ 1306.603014][T14238] veth0_macvtap: entered promiscuous mode [ 1306.642938][T14238] veth1_macvtap: entered promiscuous mode [ 1306.686428][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1306.724426][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1306.744533][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1306.765493][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1306.804244][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1306.834183][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1306.868140][T14238] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1306.901518][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1306.942762][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1306.964322][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1306.985974][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1307.014125][T14238] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1307.030187][T14238] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1307.052508][T14238] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1308.056889][T14238] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1308.080817][T14238] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1308.100560][T14238] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1308.112168][T14238] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1308.925869][T13978] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1308.938593][T14515] kvm: pic: non byte write [ 1308.961605][T13978] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1309.417759][T14468] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1309.586042][ T1093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1309.628049][ T1093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1309.746642][T14468] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1309.784229][T14468] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1309.834128][T14468] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1309.875848][T14468] usb 2-1: config 220 has no interface number 2 [ 1309.898555][T14468] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1309.950575][T14468] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1310.029610][T14468] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1310.554146][T14468] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1310.602369][T14532] netlink: 676 bytes leftover after parsing attributes in process `syz.4.2429'. [ 1310.623546][T14468] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1310.642325][T14468] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1310.653819][T14468] usb 2-1: Product: syz [ 1310.663783][T14468] usb 2-1: Manufacturer: syz [ 1310.691152][T14468] usb 2-1: SerialNumber: syz [ 1310.962587][T14468] usb 2-1: selecting invalid altsetting 0 [ 1312.434787][T14468] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1312.494183][T14468] usb 2-1: No valid video chain found. [ 1312.555543][T14468] usb 2-1: selecting invalid altsetting 0 [ 1312.571707][T14468] usbtest: probe of 2-1:220.1 failed with error -22 [ 1312.597965][T14468] usb 2-1: USB disconnect, device number 22 [ 1317.115247][T13903] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1317.127262][T13903] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1317.136196][T13903] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1317.144532][T13903] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1317.152406][T13903] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1317.160596][T13903] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1317.548874][ T1135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1317.849190][ T1135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1318.061062][ T1135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1318.343136][ T1135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1318.665909][T14590] netlink: 676 bytes leftover after parsing attributes in process `syz.2.2490'. [ 1319.124227][T14569] chnl_net:caif_netlink_parms(): no params data found [ 1320.611229][T13903] Bluetooth: hci1: command tx timeout [ 1321.069542][T14610] kvm: pic: non byte write [ 1321.265190][T14569] bridge0: port 1(bridge_slave_0) entered blocking state [ 1321.288038][T14569] bridge0: port 1(bridge_slave_0) entered disabled state [ 1321.319750][T14569] bridge_slave_0: entered allmulticast mode [ 1321.345948][T14569] bridge_slave_0: entered promiscuous mode [ 1321.399108][T14569] bridge0: port 2(bridge_slave_1) entered blocking state [ 1321.418803][T14569] bridge0: port 2(bridge_slave_1) entered disabled state [ 1321.436466][T14569] bridge_slave_1: entered allmulticast mode [ 1321.457828][T14569] bridge_slave_1: entered promiscuous mode [ 1321.753727][T14569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1321.817980][T14569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1323.612823][T13903] Bluetooth: hci1: command tx timeout [ 1323.837542][T14569] team0: Port device team_slave_0 added [ 1324.022578][T14569] team0: Port device team_slave_1 added [ 1324.759642][T14569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1324.772958][T14642] netlink: 676 bytes leftover after parsing attributes in process `syz.1.2500'. [ 1324.791547][T14569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1324.830691][T14569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1324.902239][T14569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1324.920173][T14569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1324.984162][T14569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1325.160238][T14648] ntfs3: nbd1: try to read out of volume at offset 0x0 [ 1325.367598][ T1135] bond0: (slave wlan1): Releasing backup interface [ 1325.665348][T13903] Bluetooth: hci1: command tx timeout [ 1325.906786][T14569] hsr_slave_0: entered promiscuous mode [ 1326.212782][T14569] hsr_slave_1: entered promiscuous mode [ 1326.736681][ T1135] hsr_slave_0: left promiscuous mode [ 1327.716426][ T1135] hsr_slave_1: left promiscuous mode [ 1327.744458][T13903] Bluetooth: hci1: command tx timeout [ 1327.786167][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1327.801185][T14659] kvm: pic: non byte write [ 1327.808296][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1327.830116][ T1135] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1327.838117][ T1135] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1327.885031][ T1135] veth1_macvtap: left promiscuous mode [ 1327.891208][ T1135] veth0_macvtap: left promiscuous mode [ 1327.902351][ T1135] veth1_vlan: left promiscuous mode [ 1327.909936][ T1135] veth0_vlan: left promiscuous mode [ 1332.220492][ T27] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1332.388927][ T27] usb 2-1: device descriptor read/64, error -71 [ 1332.472278][ T1135] team0 (unregistering): Port device team_slave_1 removed [ 1332.563273][ T1135] team0 (unregistering): Port device team_slave_0 removed [ 1332.659660][ T1135] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1332.694241][ T27] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1332.874566][ T27] usb 2-1: device descriptor read/64, error -71 [ 1332.893305][ T1135] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1333.005666][ T27] usb usb2-port1: attempt power cycle [ 1333.424733][ T27] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1333.590912][ T27] usb 2-1: device descriptor read/8, error -71 [ 1333.887654][ T27] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1333.999366][ T27] usb 2-1: device descriptor read/8, error -71 [ 1334.133408][ T27] usb usb2-port1: unable to enumerate USB device [ 1335.755825][ T1135] bond0 (unregistering): Released all slaves [ 1335.854715][ T1135] vcan0 (unregistering): left allmulticast mode [ 1336.061134][T14720] kvm: pic: non byte write [ 1337.325589][ T1135] IPVS: stop unused estimator thread 0... [ 1338.163742][T14569] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1338.212365][T14569] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1338.245796][T14569] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1338.291015][T14569] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1338.649125][T14569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1338.732489][T14569] 8021q: adding VLAN 0 to HW filter on device team0 [ 1338.773943][ T1076] bridge0: port 1(bridge_slave_0) entered blocking state [ 1338.781251][ T1076] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1338.856099][ T1076] bridge0: port 2(bridge_slave_1) entered blocking state [ 1338.863363][ T1076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1338.898541][T14569] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1338.916716][T14569] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1342.129932][T14569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1342.308509][T14569] veth0_vlan: entered promiscuous mode [ 1342.329923][T14569] veth1_vlan: entered promiscuous mode [ 1342.484772][T14569] veth0_macvtap: entered promiscuous mode [ 1342.517638][T14569] veth1_macvtap: entered promiscuous mode [ 1342.609504][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1342.644454][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1342.690307][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1342.714506][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1342.741993][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1342.769066][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1342.802242][T14569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1342.874760][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1342.904401][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1342.927544][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1342.951959][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1342.984227][T14569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1343.016169][T14569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1343.048170][T14569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1343.136676][T14569] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.164295][T14569] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.215956][T14569] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.244079][T14569] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.005949][ T1093] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1344.024201][ T6269] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1344.044271][ T1093] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1344.175320][ T1093] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1344.204950][ T1093] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1344.227713][T14786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1344.264912][T14786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1344.310085][ T6269] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1344.326677][ T6269] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1344.354713][ T6269] usb 2-1: can't read configurations, error -71 [ 1346.408464][T14811] ubi: mtd0 is already attached to ubi31 [ 1347.212666][T14813] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2531'. [ 1349.205923][T14824] kvm: pic: non byte write [ 1352.073020][T14857] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1352.614650][ T6269] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1353.302594][T14855] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1353.400429][T14855] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1353.600707][T14867] bridge0: entered promiscuous mode [ 1353.607285][T14867] macsec1: entered promiscuous mode [ 1353.824413][ T5781] Bluetooth: hci4: command 0x0406 tx timeout [ 1354.017150][ T6269] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1354.026918][ T6269] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1354.036020][ T6269] usb 5-1: can't read configurations, error -71 [ 1354.484139][T14874] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2542'. [ 1356.402670][T14882] ntfs3: nbd2: try to read out of volume at offset 0x0 [ 1360.131495][T14917] bridge0: entered promiscuous mode [ 1360.137386][T14917] macsec1: entered promiscuous mode [ 1361.996408][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.002833][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.934213][T10736] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1363.164282][T11693] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1363.243232][T14926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1363.309371][T14926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1363.376571][T10736] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1363.401254][T10736] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1363.404118][T11693] usb 2-1: Using ep0 maxpacket: 32 [ 1363.424401][T10736] usb 5-1: can't read configurations, error -71 [ 1363.465955][T11693] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 1363.494233][T11693] usb 2-1: config 0 has no interface number 0 [ 1363.502742][T11693] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1363.544138][T11693] usb 2-1: config 0 interface 85 has no altsetting 0 [ 1363.554227][T11693] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1363.568698][T11693] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1363.597696][T11693] usb 2-1: Product: syz [ 1363.601929][T11693] usb 2-1: Manufacturer: syz [ 1363.624890][T11693] usb 2-1: SerialNumber: syz [ 1363.697239][T11693] usb 2-1: config 0 descriptor?? [ 1364.026787][T14939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2553'. [ 1364.386400][T11693] appletouch 2-1:0.85: Geyser mode initialized. [ 1364.433335][T11693] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input10 [ 1364.649198][T11693] usb 2-1: USB disconnect, device number 29 [ 1364.649320][ C1] appletouch 2-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 1364.876008][T11693] appletouch 2-1:0.85: input: appletouch disconnected [ 1367.607905][ T5872] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1367.829103][T14970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1367.878909][T14970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1367.925604][ T5872] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1367.954189][ T5872] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1367.967163][ T5872] usb 2-1: can't read configurations, error -71 [ 1368.174278][T14988] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2567'. [ 1370.805762][T15022] binder_alloc: 15021: binder_alloc_buf, no vma [ 1371.304294][ T27] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1371.404552][ T5872] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1371.536768][T15026] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1371.563865][T15026] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1371.608961][ T27] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1371.643762][ T27] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1371.652483][ T5872] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1371.669142][ T27] usb 3-1: can't read configurations, error -71 [ 1371.675828][ T5872] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1371.688968][ T5872] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1371.698429][ T5872] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1371.743237][ T5872] usb 1-1: config 0 descriptor?? [ 1372.266248][ T5872] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 1372.306254][ T5872] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 1372.435405][ T5872] cp2112 0003:10C4:EA90.0002: Part Number: 0x82 Device Version: 0xFE [ 1373.228260][ T5872] cp2112 0003:10C4:EA90.0002: error reading lock byte: -71 [ 1373.413912][ T5872] usb 1-1: USB disconnect, device number 25 [ 1375.574298][T10736] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1375.791118][T10736] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1375.803901][T10736] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1375.854302][T10736] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1375.883156][T10736] usb 1-1: config 220 has no interface number 2 [ 1375.885941][T15099] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1375.889755][T10736] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1376.320777][T10736] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1376.328827][T10736] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1376.367911][T10736] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1376.416261][T10736] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1376.449630][T10736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1376.501415][T10736] usb 1-1: Product: syz [ 1376.521740][T10736] usb 1-1: Manufacturer: syz [ 1376.532992][T10736] usb 1-1: SerialNumber: syz [ 1376.674103][ T787] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1376.800592][T10736] usb 1-1: selecting invalid altsetting 0 [ 1376.844189][T10736] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1376.868293][T10736] usb 1-1: No valid video chain found. [ 1376.906477][T10736] usb 1-1: selecting invalid altsetting 0 [ 1376.945822][T15098] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1376.954709][T10736] usbtest: probe of 1-1:220.1 failed with error -22 [ 1376.994693][T15098] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1377.017563][T10736] usb 1-1: USB disconnect, device number 26 [ 1377.041172][ T787] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1377.077324][ T787] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1377.100708][ T787] usb 5-1: can't read configurations, error -71 [ 1382.124149][ T787] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1382.265016][T15149] kvm: pic: non byte write [ 1382.518345][ T787] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1382.545496][ T787] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1382.573230][ T787] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1382.649185][ T787] usb 2-1: config 220 has no interface number 2 [ 1382.713068][ T787] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1382.783538][ T787] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1382.794090][ T787] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1382.824072][ T787] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1382.886901][ T787] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1382.924364][ T787] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.960018][ T787] usb 2-1: Product: syz [ 1382.984125][ T787] usb 2-1: Manufacturer: syz [ 1382.988826][ T787] usb 2-1: SerialNumber: syz [ 1383.443324][ T787] usb 2-1: selecting invalid altsetting 0 [ 1383.488084][ T787] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1383.524281][ T787] usb 2-1: No valid video chain found. [ 1383.574870][ T787] usb 2-1: selecting invalid altsetting 0 [ 1383.580677][ T787] usbtest: probe of 2-1:220.1 failed with error -22 [ 1383.655402][ T787] usb 2-1: USB disconnect, device number 32 [ 1383.934208][ T6269] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 1384.856561][T15162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1385.039325][T15162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1385.290526][ T6269] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1385.325383][ T6269] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1385.337860][ T6269] usb 1-1: can't read configurations, error -71 [ 1388.178625][T15221] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2614'. [ 1394.784322][ T5781] Bluetooth: hci0: command 0x0406 tx timeout [ 1395.102668][T15275] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2626'. [ 1399.904112][ T5781] Bluetooth: hci2: command 0x0406 tx timeout [ 1411.208182][T15361] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2635'. [ 1414.431650][T15379] GUP no longer grows the stack in syz.4.2648 (15379): 200000006000-200000008000 (200000004000) [ 1414.442923][T15379] CPU: 1 PID: 15379 Comm: syz.4.2648 Not tainted syzkaller #0 [ 1414.450562][T15379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1414.460623][T15379] Call Trace: [ 1414.463905][T15379] [ 1414.466846][T15379] dump_stack_lvl+0x18c/0x250 [ 1414.471692][T15379] ? show_regs_print_info+0x20/0x20 [ 1414.476910][T15379] ? load_image+0x400/0x400 [ 1414.481438][T15379] ? find_vma+0x134/0x1b0 [ 1414.485808][T15379] fixup_user_fault+0x642/0x700 [ 1414.490672][T15379] fault_in_user_writeable+0x71/0xd0 [ 1414.495985][T15379] futex_lock_pi+0x274/0x9a0 [ 1414.500986][T15379] ? fixup_pi_state_owner+0x5e0/0x5e0 [ 1414.506492][T15379] do_futex+0x23d/0x3e0 [ 1414.510650][T15379] ? lock_chain_count+0x20/0x20 [ 1414.515539][T15379] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1414.521550][T15379] ? blkcg_maybe_throttle_current+0x19f/0xa90 [ 1414.527681][T15379] ? _raw_spin_unlock_irq+0x23/0x50 [ 1414.532987][T15379] __se_sys_futex+0x3a9/0x440 [ 1414.537679][T15379] ? __x64_sys_futex+0xf0/0xf0 [ 1414.542468][T15379] ? __x64_sys_futex+0x21/0xf0 [ 1414.547239][T15379] do_syscall_64+0x55/0xa0 [ 1414.551705][T15379] ? clear_bhb_loop+0x40/0x90 [ 1414.556461][T15379] ? clear_bhb_loop+0x40/0x90 [ 1414.561139][T15379] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1414.567035][T15379] RIP: 0033:0x7f944879c799 [ 1414.571455][T15379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1414.591155][T15379] RSP: 002b:00007f94495e4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1414.599593][T15379] RAX: ffffffffffffffda RBX: 00007f9448a15fa0 RCX: 00007f944879c799 [ 1414.607623][T15379] RDX: 00000000fffff7fc RSI: 000000000000008d RDI: 0000200000004000 [ 1414.615904][T15379] RBP: 00007f9448832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1414.624064][T15379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1414.632065][T15379] R13: 00007f9448a16038 R14: 00007f9448a15fa0 R15: 00007ffc97d2c8c8 [ 1414.640047][T15379] [ 1414.890898][T15389] binder: BINDER_SET_CONTEXT_MGR already set [ 1414.902844][T15389] binder: 15386:15389 ioctl 4018620d 200000004a80 returned -16 [ 1415.255652][T15396] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2653'. [ 1416.449393][T15402] fuse: Bad value for 'fd' [ 1418.203716][T15421] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2659'. [ 1419.446488][T15433] ubi: mtd0 is already attached to ubi31 [ 1422.339112][T15444] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2666'. [ 1422.845360][T15447] overlayfs: failed to resolve './file1': -2 [ 1423.432922][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.439408][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1424.414351][ T27] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1425.381195][ T27] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1425.396762][ T27] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1425.619835][T15468] ubi: mtd0 is already attached to ubi31 [ 1426.879064][ T27] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1426.909263][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1426.933786][ T27] usb 3-1: Product: syz [ 1426.949359][ T27] usb 3-1: Manufacturer: syz [ 1426.994060][ T27] usb 3-1: SerialNumber: syz [ 1427.010785][ T27] usb 3-1: config 0 descriptor?? [ 1427.091961][ T27] usb 3-1: USB disconnect, device number 18 [ 1429.937855][T15495] ubi: mtd0 is already attached to ubi31 [ 1431.655784][T15507] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2679'. [ 1431.664079][ T787] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1431.905637][ T787] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1431.928866][ T787] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1431.977609][ T787] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1432.004668][ T787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1432.040890][ T787] usb 3-1: Product: syz [ 1432.061539][ T787] usb 3-1: Manufacturer: syz [ 1432.080674][ T787] usb 3-1: SerialNumber: syz [ 1432.132949][ T787] usb 3-1: config 0 descriptor?? [ 1432.449553][T14468] usb 3-1: USB disconnect, device number 19 [ 1434.637029][T15526] ubi: mtd0 is already attached to ubi31 [ 1437.828409][T14468] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1438.217688][T14468] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1438.314083][T14468] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1438.337226][T14468] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1438.354279][T14468] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.490220][T14468] usb 2-1: Product: syz [ 1438.550356][T14468] usb 2-1: Manufacturer: syz [ 1438.621771][T14468] usb 2-1: SerialNumber: syz [ 1438.641759][T14468] usb 2-1: config 0 descriptor?? [ 1438.928157][T10736] usb 2-1: USB disconnect, device number 33 [ 1439.281845][T15560] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1440.638817][T15572] ubi: mtd0 is already attached to ubi31 [ 1441.424456][ T5781] Bluetooth: hci1: command 0x0406 tx timeout [ 1443.494300][T10736] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1443.737644][T15594] ubi: mtd0 is already attached to ubi31 [ 1444.688062][T10736] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1444.717926][T10736] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1444.751032][T10736] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1444.780188][T10736] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.803547][T10736] usb 2-1: Product: syz [ 1444.818400][T10736] usb 2-1: Manufacturer: syz [ 1444.829081][T10736] usb 2-1: SerialNumber: syz [ 1444.847899][T10736] usb 2-1: config 0 descriptor?? [ 1445.111602][T10736] usb 2-1: USB disconnect, device number 34 [ 1451.150867][T14468] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1452.038971][T14468] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1452.059452][T14468] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1452.076999][T14468] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1452.086406][T14468] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1452.095274][T14468] usb 3-1: Product: syz [ 1452.104561][T14468] usb 3-1: Manufacturer: syz [ 1452.119900][T14468] usb 3-1: SerialNumber: syz [ 1452.149901][T14468] usb 3-1: config 0 descriptor?? [ 1452.481333][T14468] usb 3-1: USB disconnect, device number 20 [ 1459.884187][T14468] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1460.135142][T14468] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.190660][T14468] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1460.216688][T14468] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1461.592287][T14468] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.635214][T14468] usb 2-1: Product: syz [ 1461.755319][T15704] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2749'. [ 1462.081641][T14468] usb 2-1: Manufacturer: syz [ 1462.095060][T14468] usb 2-1: SerialNumber: syz [ 1462.241589][T14468] usb 2-1: config 0 descriptor?? [ 1462.748831][ T27] usb 2-1: USB disconnect, device number 35 [ 1467.504265][T14468] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1467.784067][T14468] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1467.826981][T14468] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1467.855963][T14468] usb 2-1: can't read configurations, error -71 [ 1468.674062][ T6269] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1469.012821][T15741] 9pnet_fd: Insufficient options for proto=fd [ 1469.212412][ T6269] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1469.455983][ T6269] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1469.528511][ T6269] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1469.573170][ T6269] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1469.586890][ T6269] usb 5-1: Product: syz [ 1469.600487][ T6269] usb 5-1: Manufacturer: syz [ 1469.645132][ T6269] usb 5-1: SerialNumber: syz [ 1469.673891][ T6269] usb 5-1: config 0 descriptor?? [ 1470.564240][T11693] usb 5-1: USB disconnect, device number 8 [ 1473.420341][T15763] binder: BINDER_SET_CONTEXT_MGR already set [ 1473.486917][T15763] binder: 15762:15763 ioctl 4018620d 200000004a80 returned -16 [ 1475.834221][ T27] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1476.109621][ T27] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1476.146869][ T27] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1476.245516][ T27] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1476.284232][ T27] usb 3-1: config 220 has no interface number 2 [ 1476.300642][ T27] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1476.392140][ T27] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1477.914064][ T27] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1477.921093][ T27] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1478.017225][ T27] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1478.067828][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1478.132941][ T27] usb 3-1: Product: syz [ 1478.169044][ T27] usb 3-1: Manufacturer: syz [ 1478.173725][ T27] usb 3-1: SerialNumber: syz [ 1478.616727][ T27] usb 3-1: selecting invalid altsetting 0 [ 1478.714511][ T27] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1478.721038][ T27] usb 3-1: No valid video chain found. [ 1478.808575][ T27] usb 3-1: selecting invalid altsetting 0 [ 1478.838365][ T27] usbtest: probe of 3-1:220.1 failed with error -22 [ 1478.910841][ T27] usb 3-1: USB disconnect, device number 21 [ 1479.334267][ T27] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1479.586667][ T27] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1479.614035][ T27] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1479.657372][ T27] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1479.685076][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1479.735007][ T27] usb 3-1: Product: syz [ 1479.739733][ T27] usb 3-1: Manufacturer: syz [ 1479.824164][ T27] usb 3-1: SerialNumber: syz [ 1479.845219][ T27] usb 3-1: config 0 descriptor?? [ 1480.312283][ T787] usb 3-1: USB disconnect, device number 22 [ 1480.944224][ T787] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1481.129715][ T787] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1481.158363][ T787] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1481.210439][ T787] usb 5-1: can't read configurations, error -71 [ 1483.425220][T15811] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1485.180407][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1485.188336][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.512728][T15822] fuse: Bad value for 'fd' [ 1488.078527][T15852] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1491.864533][T15885] block device autoloading is deprecated and will be removed. [ 1492.702638][T15894] kvm: emulating exchange as write [ 1503.928563][T15949] 9pnet_fd: Insufficient options for proto=fd [ 1509.160693][T15985] 9pnet_fd: Insufficient options for proto=fd [ 1509.620198][T15990] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2837'. [ 1514.066022][T16012] vivid-001: disconnect [ 1516.671501][T16008] vivid-001: reconnect [ 1520.653349][T16051] netlink: 676 bytes leftover after parsing attributes in process `syz.1.2855'. [ 1522.139550][T16061] 9pnet_fd: Insufficient options for proto=fd [ 1523.258092][T16069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2856'. [ 1525.512261][T16089] netlink: 676 bytes leftover after parsing attributes in process `syz.2.2865'. [ 1529.411413][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1529.420962][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1529.488529][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1529.503479][T16118] ceph: No mds server is up or the cluster is laggy [ 1529.512508][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1529.730377][T16108] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2872'. [ 1530.425654][T16133] netlink: 676 bytes leftover after parsing attributes in process `syz.2.2877'. [ 1531.064108][ T27] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1531.281296][ T27] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1531.299659][ T27] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1531.320174][ T27] usb 1-1: config 220 has no interface number 2 [ 1531.341908][ T27] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1531.391603][ T27] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1531.402178][ T27] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1531.430783][ T27] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1531.455479][ T27] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1531.472707][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.480962][ T27] usb 1-1: Product: syz [ 1531.489629][ T27] usb 1-1: Manufacturer: syz [ 1531.494711][ T27] usb 1-1: SerialNumber: syz [ 1531.751347][ T27] usb 1-1: selecting invalid altsetting 0 [ 1531.783237][ T27] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1531.818079][ T27] usb 1-1: No valid video chain found. [ 1531.888483][ T27] usb 1-1: selecting invalid altsetting 0 [ 1531.903524][ T27] usbtest: probe of 1-1:220.1 failed with error -22 [ 1531.937591][ T27] usb 1-1: USB disconnect, device number 29 [ 1532.869577][T16165] netlink: 676 bytes leftover after parsing attributes in process `syz.1.2890'. [ 1534.517720][T16188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2893'. [ 1534.545761][T16190] binder: 16189:16190 ioctl 4018620d 0 returned -22 [ 1537.553804][T16211] netlink: 676 bytes leftover after parsing attributes in process `syz.4.2903'. [ 1538.984040][T11693] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1539.186355][T11693] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1539.194881][T11693] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1539.248951][T11693] usb 1-1: config 220 has no interface number 2 [ 1539.255773][T11693] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1539.271026][T11693] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1539.278274][T11693] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1539.294214][T11693] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1539.313068][T11693] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1539.334649][T11693] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.371825][T11693] usb 1-1: Product: syz [ 1539.388661][T11693] usb 1-1: Manufacturer: syz [ 1539.420239][T11693] usb 1-1: SerialNumber: syz [ 1539.989404][T11693] usb 1-1: selecting invalid altsetting 0 [ 1540.002942][T11693] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1540.035405][T11693] usb 1-1: No valid video chain found. [ 1540.060524][T11693] usb 1-1: selecting invalid altsetting 0 [ 1540.094982][T11693] usbtest: probe of 1-1:220.1 failed with error -22 [ 1540.138555][T11693] usb 1-1: USB disconnect, device number 30 [ 1540.257621][T16238] binder: BINDER_SET_CONTEXT_MGR already set [ 1540.273939][T16238] binder: 16237:16238 ioctl 4018620d 200000004a80 returned -16 [ 1542.320978][T16257] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2915'. [ 1546.308162][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.316038][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.524099][T14468] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1547.002629][T14468] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1547.049718][T14468] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1547.399153][T14468] usb 3-1: config 220 has no interface number 2 [ 1547.417626][T14468] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1547.502333][T14468] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1547.526100][T14468] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1547.545755][T14468] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1547.610591][T14468] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1547.640186][T14468] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.675286][T14468] usb 3-1: Product: syz [ 1547.689243][T14468] usb 3-1: Manufacturer: syz [ 1547.708445][T14468] usb 3-1: SerialNumber: syz [ 1548.004840][T14468] usb 3-1: selecting invalid altsetting 0 [ 1548.045438][T14468] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1548.070373][T14468] usb 3-1: No valid video chain found. [ 1548.099239][T14468] usb 3-1: selecting invalid altsetting 0 [ 1548.112604][T14468] usbtest: probe of 3-1:220.1 failed with error -22 [ 1548.134435][T14468] usb 3-1: USB disconnect, device number 23 [ 1548.713150][T13903] Bluetooth: hci0: unexpected event for opcode 0x0c1b [ 1548.866810][T16287] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2926'. [ 1551.414511][ T6269] libceph: connect (1)[c::]:6789 error -101 [ 1551.434148][ T6269] libceph: mon0 (1)[c::]:6789 connect error [ 1552.149040][ T6269] libceph: connect (1)[c::]:6789 error -101 [ 1552.174833][ T6269] libceph: mon0 (1)[c::]:6789 connect error [ 1552.265479][T16309] ceph: No mds server is up or the cluster is laggy [ 1552.684117][ T6269] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1552.888104][ T6269] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1552.905836][ T6269] usb 1-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 1552.944111][ T6269] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1553.003157][ T6269] usb 1-1: config 0 descriptor?? [ 1554.154088][T16321] ubi: mtd0 is already attached to ubi31 [ 1554.514346][ T6269] (null): keene_cmd_main failed (-110) [ 1556.275090][ T6269] video4linux radio48: keene_cmd_main failed (-32) [ 1556.319117][ T6269] radio-keene 1-1:0.0: V4L2 device registered as radio48 [ 1557.100129][ T6269] usb 1-1: USB disconnect, device number 31 [ 1557.639775][T16327] netlink: 676 bytes leftover after parsing attributes in process `syz.2.2937'. [ 1557.843384][T16339] binder: 16338:16339 ioctl c0306201 0 returned -14 [ 1562.015964][T16367] netlink: 676 bytes leftover after parsing attributes in process `syz.0.2949'. [ 1562.499579][ T787] libceph: connect (1)[c::]:6789 error -101 [ 1562.507833][ T787] libceph: mon0 (1)[c::]:6789 connect error [ 1562.774684][ T787] libceph: connect (1)[c::]:6789 error -101 [ 1562.798985][ T787] libceph: mon0 (1)[c::]:6789 connect error [ 1563.006242][T16377] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1563.389032][T16369] ceph: No mds server is up or the cluster is laggy [ 1563.400835][ T27] libceph: connect (1)[c::]:6789 error -101 [ 1563.411943][ T27] libceph: mon0 (1)[c::]:6789 connect error [ 1563.812909][T16383] binder: 16381:16383 ioctl c0306201 0 returned -14 [ 1564.118306][T16389] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1565.257702][T16393] fuse: Bad value for 'fd' [ 1566.819619][T16417] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1568.615457][T16430] binder: 16429:16430 ioctl c0306201 0 returned -14 [ 1570.124114][ T5872] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1570.416759][ T5872] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1570.465323][ T5872] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1570.498730][ T5872] usb 3-1: config 220 has no interface number 2 [ 1570.525728][ T5872] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1570.592033][ T5872] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1570.617882][ T5872] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1572.073641][ T5872] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1572.780004][ T5872] usb 3-1: string descriptor 0 read error: -71 [ 1572.795217][ T5872] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1572.818488][ T5872] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1572.866699][ T5872] usb 3-1: can't set config #220, error -71 [ 1572.973259][ T5872] usb 3-1: USB disconnect, device number 24 [ 1581.284946][ T5817] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1581.785886][T16526] ubi: mtd0 is already attached to ubi31 [ 1582.799502][ T5817] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1582.816269][ T5817] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1582.832029][ T5817] usb 2-1: config 220 has no interface number 2 [ 1582.838838][ T5817] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1582.852561][ T5817] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1582.859614][ T5817] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1582.866927][ T5817] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1582.876990][ T5817] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1582.889741][ T5817] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1582.908283][ T5817] usb 2-1: Product: syz [ 1582.914339][ T5817] usb 2-1: Manufacturer: syz [ 1582.919001][ T5817] usb 2-1: SerialNumber: syz [ 1583.231968][ T5817] usb 2-1: selecting invalid altsetting 0 [ 1583.245649][T16534] Driver unsupported XDP return value 0 on prog (id 144) dev N/A, expect packet loss! [ 1583.260942][ T5817] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1583.287719][ T5817] usb 2-1: No valid video chain found. [ 1583.335219][ T5817] usb 2-1: selecting invalid altsetting 0 [ 1583.356006][ T5817] usbtest: probe of 2-1:220.1 failed with error -22 [ 1583.382133][ T5817] usb 2-1: USB disconnect, device number 38 [ 1584.116738][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1584.156056][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1584.424684][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1584.432032][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1584.901408][T16541] ceph: No mds server is up or the cluster is laggy [ 1584.979872][ T6269] libceph: connect (1)[c::]:6789 error -101 [ 1585.028524][ T6269] libceph: mon0 (1)[c::]:6789 connect error [ 1588.148213][T16571] ubi: mtd0 is already attached to ubi31 [ 1588.889334][T16575] overlayfs: missing 'lowerdir' [ 1589.045087][T16579] netlink: 'syz.2.3007': attribute type 4 has an invalid length. [ 1589.053224][T16579] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3007'. [ 1589.142703][T16579] overlayfs: empty lowerdir [ 1592.015794][T16598] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1592.492623][ T5817] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1592.735777][ T5817] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 1592.744634][ T5817] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1593.236058][T16605] ubi: mtd0 is already attached to ubi31 [ 1594.138554][ T5817] usb 5-1: config 220 has no interface number 2 [ 1594.144979][ T5817] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1594.159528][ T5817] usb 5-1: config 220 interface 0 has no altsetting 0 [ 1594.173977][ T5817] usb 5-1: config 220 interface 76 has no altsetting 0 [ 1594.234828][ T5817] usb 5-1: config 220 interface 1 has no altsetting 0 [ 1594.247120][ T5817] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1594.274069][ T5817] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1594.300737][ T5817] usb 5-1: Product: syz [ 1594.332471][ T5817] usb 5-1: Manufacturer: syz [ 1594.346579][ T5817] usb 5-1: SerialNumber: syz [ 1594.598750][ T5817] usb 5-1: selecting invalid altsetting 0 [ 1594.626815][ T5817] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 1594.655021][ T5817] usb 5-1: No valid video chain found. [ 1594.761674][ T5817] usb 5-1: selecting invalid altsetting 0 [ 1594.776533][ T5817] usbtest: probe of 5-1:220.1 failed with error -22 [ 1594.789237][ T5817] usb 5-1: USB disconnect, device number 11 [ 1596.355332][T16627] syz.2.3020 uses obsolete (PF_INET,SOCK_PACKET) [ 1598.372686][T16640] ubi: mtd0 is already attached to ubi31 [ 1601.474606][ T28] audit: type=1804 audit(1772865788.454:28): pid=16668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.3032" name="/newroot/130/file1" dev="fuse" ino=1 res=1 errno=0 [ 1601.495060][ C1] vkms_vblank_simulate: vblank timer overrun [ 1601.514130][T16670] overlayfs: missing 'lowerdir' [ 1601.672568][T16672] netlink: 'syz.4.3033': attribute type 4 has an invalid length. [ 1601.680885][T16672] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3033'. [ 1601.704886][T16672] .`: renamed from bond0 (while UP) [ 1601.990343][T16674] overlay: Unknown parameter '/dev/v4l-subdev#' [ 1606.060257][T16691] ubi: mtd0 is already attached to ubi31 [ 1607.770656][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.783998][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1609.235252][T16725] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3040'. [ 1615.877717][T16751] ubi: mtd0 is already attached to ubi31 [ 1617.634067][ T6269] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1617.883509][ T6269] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1618.128907][T16764] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 1618.380704][ T6269] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1618.523441][ T6269] usb 3-1: config 220 has no interface number 2 [ 1618.563026][ T6269] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1618.810057][ T6269] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1619.086685][ T6269] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1619.225385][ T6269] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1619.511680][ T6269] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1619.606849][T16774] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3057'. [ 1620.434046][ T6269] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.464300][ T6269] usb 3-1: Product: syz [ 1620.471224][ T6269] usb 3-1: Manufacturer: syz [ 1620.483976][ T6269] usb 3-1: SerialNumber: syz [ 1620.824482][ T6269] usb 3-1: can't set config #220, error -71 [ 1620.864281][ T6269] usb 3-1: USB disconnect, device number 25 [ 1621.875847][T16788] fuse: Unknown parameter 'group_i00000000000000000000' [ 1623.649794][T16802] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1624.428990][T10736] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1624.669170][T10736] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1624.681167][T10736] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1624.686199][T16807] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3065'. [ 1624.692749][T10736] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1624.708458][T10736] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1624.830179][T10736] usb 5-1: Product: syz [ 1624.934387][T10736] usb 5-1: Manufacturer: syz [ 1624.977969][T10736] usb 5-1: SerialNumber: syz [ 1624.986660][T10736] usb 5-1: config 0 descriptor?? [ 1625.740319][ T6269] usb 5-1: USB disconnect, device number 12 [ 1626.154075][ T27] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1626.484339][ T27] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1626.533947][ T27] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1626.554484][ T27] usb 1-1: config 220 has no interface number 2 [ 1626.564068][ T27] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1626.594033][ T27] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1626.613790][ T27] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1626.634013][ T27] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1626.703520][ T27] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1626.712771][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1626.724927][ T27] usb 1-1: Product: syz [ 1626.729228][ T27] usb 1-1: Manufacturer: syz [ 1626.746876][ T27] usb 1-1: SerialNumber: syz [ 1627.180493][ T27] usb 1-1: selecting invalid altsetting 0 [ 1627.285392][ T27] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1627.293984][ T27] usb 1-1: No valid video chain found. [ 1627.355311][ T27] usb 1-1: selecting invalid altsetting 0 [ 1627.366544][ T27] usbtest: probe of 1-1:220.1 failed with error -22 [ 1627.408011][ T27] usb 1-1: USB disconnect, device number 32 [ 1627.784349][T16824] fuse: Unknown parameter 'group_i00000000000000000000' [ 1628.483566][T16833] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3074'. [ 1629.784271][T16842] random: crng reseeded on system resumption [ 1632.414938][T16820] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1632.663634][T16820] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1632.703934][T16820] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1632.740525][T16820] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1632.774035][T16820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1632.842906][T16820] usb 2-1: Product: syz [ 1632.847292][T16820] usb 2-1: Manufacturer: syz [ 1632.851963][T16820] usb 2-1: SerialNumber: syz [ 1632.864905][T16820] usb 2-1: config 0 descriptor?? [ 1633.667628][T14468] usb 2-1: USB disconnect, device number 39 [ 1633.984057][T11693] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1634.179358][T11693] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1634.208560][T11693] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1634.270074][T11693] usb 3-1: config 220 has no interface number 2 [ 1634.287234][T11693] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1634.332074][T11693] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1634.379380][T11693] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1634.393085][T11693] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1634.437110][T11693] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1634.456525][T11693] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1634.483925][T11693] usb 3-1: Product: syz [ 1634.494197][T11693] usb 3-1: Manufacturer: syz [ 1634.513976][T11693] usb 3-1: SerialNumber: syz [ 1635.221181][T11693] usb 3-1: selecting invalid altsetting 0 [ 1635.264303][T11693] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1635.294029][T11693] usb 3-1: No valid video chain found. [ 1635.362069][T11693] usb 3-1: selecting invalid altsetting 0 [ 1635.373917][T11693] usbtest: probe of 3-1:220.1 failed with error -22 [ 1636.885524][T11693] usb 3-1: USB disconnect, device number 26 [ 1637.255051][T16881] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3084'. [ 1637.603002][T16883] binder: 16882:16883 ioctl 4018620d 0 returned -22 [ 1640.877377][T16897] netlink: 'syz.2.3091': attribute type 4 has an invalid length. [ 1640.885381][T16897] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3091'. [ 1640.911618][T16897] overlayfs: empty lowerdir [ 1642.149670][ T6269] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1642.344786][ T6269] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1642.369346][ T6269] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1642.397103][ T6269] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1642.408867][ T6269] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.424932][ T6269] usb 3-1: Product: syz [ 1642.429152][ T6269] usb 3-1: Manufacturer: syz [ 1642.445056][ T6269] usb 3-1: SerialNumber: syz [ 1642.807053][ T6269] usb 3-1: config 0 descriptor?? [ 1643.806843][T11693] usb 3-1: USB disconnect, device number 27 [ 1645.465636][T16922] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1646.848421][T16932] overlayfs: missing 'lowerdir' [ 1646.918080][T16933] netlink: 'syz.1.3101': attribute type 4 has an invalid length. [ 1646.926441][T16933] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3101'. [ 1646.986062][T16934] overlayfs: empty lowerdir [ 1647.000659][T16933] .`: renamed from bond0 (while UP) [ 1650.243996][ T27] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1650.459126][ T27] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1650.469492][ T27] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1650.504526][ T27] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1650.513774][ T27] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.554088][ T27] usb 3-1: Product: syz [ 1650.558359][ T27] usb 3-1: Manufacturer: syz [ 1650.562978][ T27] usb 3-1: SerialNumber: syz [ 1650.667997][ T27] usb 3-1: config 0 descriptor?? [ 1651.797479][T11693] usb 3-1: USB disconnect, device number 28 [ 1652.125495][T16968] netlink: 'syz.4.3110': attribute type 10 has an invalid length. [ 1652.291238][T16974] Bluetooth: MGMT ver 1.22 [ 1652.632157][T16968] 8021q: adding VLAN 0 to HW filter on device team0 [ 1652.667689][T16968] .`: (slave team0): Enslaving as an active interface with an up link [ 1653.155779][T16978] ubi: mtd0 is already attached to ubi31 [ 1654.207055][T16968] syz.4.3110 (16968) used greatest stack depth: 19824 bytes left [ 1658.656763][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1658.755931][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1658.786583][T17003] ceph: No mds server is up or the cluster is laggy [ 1659.145854][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1659.236935][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1660.224188][T14468] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1660.443019][T14468] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1660.483831][T14468] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1660.521348][T17018] fuse: Bad value for 'user_id' [ 1660.536980][T14468] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1660.546980][T14468] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1660.568622][T14468] usb 3-1: Product: syz [ 1660.574290][T14468] usb 3-1: Manufacturer: syz [ 1660.588928][T14468] usb 3-1: SerialNumber: syz [ 1660.778150][T14468] usb 3-1: config 0 descriptor?? [ 1661.205373][T14468] usb 3-1: USB disconnect, device number 29 [ 1662.655964][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1662.794037][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1663.022235][T17039] ceph: No mds server is up or the cluster is laggy [ 1663.074250][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1663.080261][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1665.944004][T16820] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1666.227751][T16820] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1666.291105][T16820] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1666.405893][T16820] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1666.444094][T16820] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1666.510290][T16820] usb 3-1: Product: syz [ 1666.530550][T16820] usb 3-1: Manufacturer: syz [ 1666.553933][T16820] usb 3-1: SerialNumber: syz [ 1666.575129][T16820] usb 3-1: config 0 descriptor?? [ 1666.644092][ T6269] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1666.876274][ T6269] usb 1-1: config 0 has an invalid interface number: 69 but max is 0 [ 1666.924168][ T6269] usb 1-1: config 0 has no interface number 0 [ 1666.932022][ T6269] usb 1-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 1666.976365][ T6269] usb 1-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1667.045370][ T6269] usb 1-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 1667.064026][ T6269] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1667.112880][ T6269] usb 1-1: Product: syz [ 1667.127428][ T6269] usb 1-1: Manufacturer: syz [ 1667.132055][ T6269] usb 1-1: SerialNumber: syz [ 1667.168814][ T6269] usb 1-1: config 0 descriptor?? [ 1667.190041][T17072] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1667.199053][ T6269] cyberjack 1-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 1667.227372][ T6269] usb 1-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1667.269755][ T6269] usb 3-1: USB disconnect, device number 30 [ 1667.474041][ T28] audit: type=1804 audit(1772865854.444:29): pid=17075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.3140" name="/newroot/159/file1" dev="fuse" ino=1 res=1 errno=0 [ 1667.494475][ C0] vkms_vblank_simulate: vblank timer overrun [ 1667.875695][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 1669.097284][T13903] Bluetooth: hci2: unexpected event for opcode 0x001b [ 1669.188176][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.194833][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.592743][ T5817] usb 1-1: USB disconnect, device number 33 [ 1669.614626][ T5817] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1669.692787][ T5817] cyberjack 1-1:0.69: device disconnected [ 1671.802831][T16820] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1672.033790][T16820] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1672.082614][T16820] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1672.125949][T16820] usb 2-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1672.144401][T16820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1672.166317][T16820] usb 2-1: Product: syz [ 1672.192664][T16820] usb 2-1: Manufacturer: syz [ 1672.198116][T16820] usb 2-1: SerialNumber: syz [ 1672.345852][T16820] usb 2-1: config 0 descriptor?? [ 1673.997950][T14468] usb 2-1: USB disconnect, device number 40 [ 1674.176466][T17109] lo: entered allmulticast mode [ 1674.431105][T17116] vcan0: entered allmulticast mode [ 1674.438008][T17116] vcan0: left allmulticast mode [ 1674.951606][T17108] lo: left allmulticast mode [ 1675.479080][ T5817] libceph: connect (1)[c::]:6789 error -101 [ 1675.572530][T17115] ceph: No mds server is up or the cluster is laggy [ 1675.718219][ T5817] libceph: mon0 (1)[c::]:6789 connect error [ 1676.086824][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1676.125771][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1681.409187][ T28] audit: type=1804 audit(1772865868.384:30): pid=17158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.3166" name="/newroot/195/file1" dev="fuse" ino=1 res=1 errno=0 [ 1683.721073][T17179] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1689.490638][ T27] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1690.792849][ T27] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1690.801612][ T27] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1690.842278][ T27] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.916881][ T27] usb 1-1: config 220 has no interface number 2 [ 1690.923767][ T27] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1690.958259][ T27] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1690.966897][ T27] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1690.978029][ T27] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1690.989369][ T27] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1691.003370][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1691.023263][ T27] usb 1-1: Product: syz [ 1691.031046][ T27] usb 1-1: Manufacturer: syz [ 1691.047533][ T27] usb 1-1: SerialNumber: syz [ 1691.274622][ T27] usb 1-1: selecting invalid altsetting 0 [ 1691.304026][T11693] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1691.304515][ T27] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1691.357452][ T27] usb 1-1: No valid video chain found. [ 1691.408528][ T27] usb 1-1: selecting invalid altsetting 0 [ 1691.434531][ T27] usbtest: probe of 1-1:220.1 failed with error -22 [ 1691.494426][ T27] usb 1-1: USB disconnect, device number 34 [ 1691.676424][T11693] usb 5-1: Using ep0 maxpacket: 32 [ 1691.837070][T11693] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1691.971126][T11693] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1692.003542][T11693] usb 5-1: config 0 descriptor?? [ 1692.248010][T11693] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1692.278225][T11693] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1692.537628][T11693] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1692.849432][T17250] netlink: 'syz.0.3191': attribute type 4 has an invalid length. [ 1692.857786][T17250] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3191'. [ 1692.876598][T11693] usb 5-1: media controller created [ 1692.937631][T11693] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1693.013245][T17253] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1693.114165][T17250] .`: renamed from bond0 (while UP) [ 1693.222962][T17255] overlay: Unknown parameter '/dev/v4l-subdev#' [ 1693.336157][T11693] DVB: Unable to find symbol dib7000p_attach() [ 1693.342557][T11693] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1693.414037][T17234] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3190'. [ 1693.492620][T17234] netlink: 'syz.4.3190': attribute type 30 has an invalid length. [ 1694.425832][T17234] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1694.435244][T17234] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1694.443985][T17234] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1694.452659][T17234] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1694.513936][T11693] rc_core: IR keymap rc-dib0700-rc5 not found [ 1694.529311][T11693] Registered IR keymap rc-empty [ 1694.547234][T11693] dvb-usb: could not initialize remote control. [ 1694.553672][T11693] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1694.573626][T17235] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3190'. [ 1694.586175][T17235] netlink: 'syz.4.3190': attribute type 30 has an invalid length. [ 1694.763644][T11693] usb 5-1: USB disconnect, device number 13 [ 1696.288542][T11693] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1696.474007][ T27] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 1697.496307][ T27] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1697.568521][ T27] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1697.596280][T17284] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1697.633950][ T27] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1697.670909][ T27] usb 1-1: config 220 has no interface number 2 [ 1697.694028][ T27] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1697.755379][ T27] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1697.762390][ T27] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1697.781475][ T27] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1697.799690][ T27] usb 1-1: string descriptor 0 read error: -71 [ 1697.885036][ T27] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1698.010798][ T27] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1698.205178][ T27] usb 1-1: can't set config #220, error -71 [ 1698.401048][ T27] usb 1-1: USB disconnect, device number 35 [ 1698.807477][T17292] netlink: 'syz.0.3206': attribute type 4 has an invalid length. [ 1698.815662][T17292] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3206'. [ 1698.976934][T17292] overlayfs: empty lowerdir [ 1699.773009][T17299] team0: Port device team_slave_0 removed [ 1699.959566][T17304] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3202'. [ 1702.813506][T17319] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1703.313964][ T5817] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1703.506087][ T5817] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 1703.537648][ T5817] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1704.418960][ T5817] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1704.429835][ T5817] usb 5-1: config 220 has no interface number 2 [ 1704.437693][ T5817] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1704.519000][ T5817] usb 5-1: config 220 interface 0 has no altsetting 0 [ 1704.526148][ T5817] usb 5-1: config 220 interface 76 has no altsetting 0 [ 1704.533967][ T5817] usb 5-1: config 220 interface 1 has no altsetting 0 [ 1704.548376][ T5817] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1704.557653][ T5817] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1704.565808][ T5817] usb 5-1: Product: syz [ 1704.576221][ T5817] usb 5-1: Manufacturer: syz [ 1704.581137][ T5817] usb 5-1: SerialNumber: syz [ 1704.817457][ T5817] usb 5-1: selecting invalid altsetting 0 [ 1704.843726][ T5817] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 1704.861062][ T5817] usb 5-1: No valid video chain found. [ 1704.890618][ T5817] usb 5-1: selecting invalid altsetting 0 [ 1704.917608][ T5817] usbtest: probe of 5-1:220.1 failed with error -22 [ 1704.954814][ T5817] usb 5-1: USB disconnect, device number 14 [ 1705.320916][T17340] bridge0: entered promiscuous mode [ 1705.327416][T17340] macsec1: entered promiscuous mode [ 1706.915223][T17349] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1707.062667][T17353] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3212'. [ 1709.833462][T17391] binder: 17390:17391 ioctl c0306201 0 returned -14 [ 1710.625911][T17400] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3239'. [ 1711.558670][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1711.564873][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1711.580402][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1711.585256][T17412] overlayfs: missing 'lowerdir' [ 1711.605343][T17407] ceph: No mds server is up or the cluster is laggy [ 1711.681712][T17414] netlink: 'syz.0.3243': attribute type 4 has an invalid length. [ 1711.690282][T17414] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3243'. [ 1711.715759][T17414] overlayfs: empty lowerdir [ 1711.865870][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1712.195072][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1712.206687][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1713.560021][T17427] binder: 17426:17427 ioctl c0306201 0 returned -14 [ 1715.838695][T17445] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1715.921156][T17449] overlayfs: missing 'lowerdir' [ 1716.781388][T17458] netlink: 'syz.0.3253': attribute type 4 has an invalid length. [ 1716.794113][T17458] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3253'. [ 1716.845972][T17458] overlayfs: empty lowerdir [ 1717.367947][T17464] vivid-003: disconnect [ 1717.388348][T17463] vivid-003: reconnect [ 1717.425220][T17466] fuse: Bad value for 'rootmode' [ 1720.087715][T17483] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1727.491642][ T5817] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1727.686316][ T5817] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 1727.717847][ T5817] usb 3-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1728.034463][ T5817] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1728.236308][ T5817] usb 3-1: config 220 has no interface number 2 [ 1728.242637][ T5817] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1728.324031][ T5817] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1728.339107][ T5817] usb 3-1: config 220 interface 76 has no altsetting 0 [ 1728.374154][ T5817] usb 3-1: config 220 interface 1 has no altsetting 0 [ 1728.398569][ T5817] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1728.407932][ T5817] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1728.423951][ T5817] usb 3-1: Product: syz [ 1728.447231][ T5817] usb 3-1: Manufacturer: syz [ 1728.467493][ T5817] usb 3-1: SerialNumber: syz [ 1728.479966][T17538] netlink: 'syz.1.3281': attribute type 10 has an invalid length. [ 1728.515793][T17538] veth0_vlan: entered allmulticast mode [ 1728.690686][T17538] veth0_vlan: left promiscuous mode [ 1728.776009][ T5817] usb 3-1: selecting invalid altsetting 0 [ 1728.792134][ T5817] usb 3-1: Found UVC 7.01 device syz (8086:0b07) [ 1728.813429][T17538] veth0_vlan: entered promiscuous mode [ 1728.813929][ T5817] usb 3-1: No valid video chain found. [ 1728.870944][T17538] team0: Device veth0_vlan failed to register rx_handler [ 1728.882978][ T5817] usb 3-1: selecting invalid altsetting 0 [ 1728.914798][ T5817] usbtest: probe of 3-1:220.1 failed with error -22 [ 1728.982901][ T5817] usb 3-1: USB disconnect, device number 31 [ 1730.762631][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1733.224444][T14468] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 1734.115550][T14468] usb 1-1: config 220 has an invalid interface number: 76 but max is 2 [ 1734.124085][T14468] usb 1-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1734.147526][T14468] usb 1-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1734.166075][T14468] usb 1-1: config 220 has no interface number 2 [ 1734.174089][T14468] usb 1-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1734.188859][T14468] usb 1-1: config 220 interface 0 has no altsetting 0 [ 1734.203984][T14468] usb 1-1: config 220 interface 76 has no altsetting 0 [ 1734.226999][T14468] usb 1-1: config 220 interface 1 has no altsetting 0 [ 1734.258208][T14468] usb 1-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1734.282329][T14468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1734.303092][T14468] usb 1-1: Product: syz [ 1734.313577][T14468] usb 1-1: Manufacturer: syz [ 1734.320404][T14468] usb 1-1: SerialNumber: syz [ 1734.565478][T14468] usb 1-1: selecting invalid altsetting 0 [ 1734.571857][T14468] usb 1-1: Found UVC 7.01 device syz (8086:0b07) [ 1734.596550][T14468] usb 1-1: No valid video chain found. [ 1734.649757][T14468] usb 1-1: selecting invalid altsetting 0 [ 1734.693381][T14468] usbtest: probe of 1-1:220.1 failed with error -22 [ 1734.789385][T14468] usb 1-1: USB disconnect, device number 36 [ 1735.388425][T17596] fuse: Unknown parameter 'grou00000000000000000000' [ 1737.978655][T17616] fuse: Unknown parameter 'use00000000000000000000' [ 1738.339073][ T28] audit: type=1400 audit(1772865925.324:31): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=17618 comm="syz.4.3309" [ 1738.606818][T17620] binder: 17618:17620 ioctl 4018620d 0 returned -22 [ 1750.793291][T17716] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1751.634000][T16820] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1751.894758][T16820] usb 2-1: Using ep0 maxpacket: 16 [ 1752.005366][T16820] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1752.017196][T16820] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1752.027687][T16820] usb 2-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 1752.041074][T16820] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1752.078975][T16820] usb 2-1: config 0 descriptor?? [ 1752.464332][T17729] 9pnet_fd: Insufficient options for proto=fd [ 1752.903846][T16820] hid (null): bogus close delimiter [ 1754.542888][T16820] wacom 0003:056A:0084.0003: bogus close delimiter [ 1754.956512][T16820] wacom 0003:056A:0084.0003: item 0 4 2 10 parsing failed [ 1754.964769][T16820] wacom 0003:056A:0084.0003: parse failed [ 1754.970710][T16820] wacom: probe of 0003:056A:0084.0003 failed with error -22 [ 1755.238167][T16820] usb 2-1: USB disconnect, device number 41 [ 1756.987722][T17756] input: syz1 as /devices/virtual/input/input12 [ 1759.167655][T13903] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 1759.174329][T17754] Bluetooth: hci3: command 0xfc11 tx timeout [ 1764.154748][ T27] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1764.384307][ T27] usb 3-1: device descriptor read/64, error -71 [ 1764.777461][ T27] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1765.109926][ T27] usb 3-1: device descriptor read/64, error -71 [ 1765.495170][ T27] usb usb3-port1: attempt power cycle [ 1766.474492][ T27] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1766.514851][ T27] usb 3-1: device descriptor read/8, error -71 [ 1766.824060][ T27] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1767.259929][ T27] usb 3-1: device descriptor read/8, error -71 [ 1767.388941][ T27] usb usb3-port1: unable to enumerate USB device [ 1768.308331][T17845] overlayfs: missing 'lowerdir' [ 1768.480928][T17850] netlink: 'syz.1.3376': attribute type 4 has an invalid length. [ 1768.489288][T17850] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3376'. [ 1768.510463][T17850] overlayfs: empty lowerdir [ 1771.124851][T12063] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1772.490361][T12063] usb 3-1: device descriptor read/64, error -71 [ 1772.763901][T12063] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1772.954298][T12063] usb 3-1: device descriptor read/64, error -71 [ 1773.185020][T12063] usb usb3-port1: attempt power cycle [ 1784.359483][T17948] fuse: Unknown parameter 'group_id00000000000000000000' [ 1789.829576][T17978] overlayfs: missing 'lowerdir' [ 1789.864288][T17978] netlink: 'syz.1.3413': attribute type 4 has an invalid length. [ 1789.872142][T17978] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3413'. [ 1789.884627][T17978] overlayfs: empty lowerdir [ 1791.109142][T17987] fuse: Bad value for 'user_id' [ 1792.882792][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1797.832118][T18017] fuse: Bad value for 'user_id' [ 1800.411580][T18032] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1802.928308][T18043] overlayfs: missing 'lowerdir' [ 1803.081253][T18043] netlink: 'syz.2.3422': attribute type 4 has an invalid length. [ 1803.089237][T18043] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3422'. [ 1803.104990][T18043] overlayfs: empty lowerdir [ 1808.300092][T18065] fuse: Unknown parameter 'grou00000000000000000000' [ 1814.818695][T18093] overlayfs: missing 'lowerdir' [ 1814.879070][T18094] netlink: 'syz.2.3440': attribute type 4 has an invalid length. [ 1814.886944][T18094] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3440'. [ 1814.896844][T18094] overlayfs: empty lowerdir [ 1815.554164][T18108] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1816.035692][T18110] vivid-004: disconnect [ 1816.058139][T18106] vivid-004: reconnect [ 1816.341655][T18117] fuse: Unknown parameter 'grou00000000000000000000' [ 1816.524466][T17652] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1816.732080][T17652] usb 3-1: config 220 has an invalid descriptor of length 1, skipping remainder of the config [ 1816.742883][T17652] usb 3-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 1816.797594][T17652] usb 3-1: config 220 interface 0 has no altsetting 0 [ 1816.842605][T17652] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1816.854016][T17652] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1816.883901][T17652] usb 3-1: Product: syz [ 1816.898803][T17652] usb 3-1: Manufacturer: syz [ 1816.903654][T17652] usb 3-1: SerialNumber: syz [ 1817.172852][T17652] usb 3-1: Found UVC 0.00 device syz (8086:0b07) [ 1817.197629][T17652] usb 3-1: No valid video chain found. [ 1817.447734][T17652] usb 3-1: USB disconnect, device number 39 [ 1818.614759][T18131] overlayfs: missing 'lowerdir' [ 1818.688103][T18133] netlink: 'syz.2.3452': attribute type 4 has an invalid length. [ 1818.695910][T18133] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3452'. [ 1818.706385][T18133] overlayfs: empty lowerdir [ 1819.923907][T12063] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1820.189246][T12063] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1820.199685][T12063] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1820.429163][T12063] usb 5-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1820.438657][T12063] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1820.446932][T12063] usb 5-1: Product: syz [ 1820.451196][T12063] usb 5-1: Manufacturer: syz [ 1820.456910][T12063] usb 5-1: SerialNumber: syz [ 1820.541028][T12063] usb 5-1: config 0 descriptor?? [ 1821.245545][T17652] libceph: connect (1)[c::]:6789 error -101 [ 1821.314148][T17652] libceph: mon0 (1)[c::]:6789 connect error [ 1821.325200][T17652] libceph: connect (1)[c::]:6789 error -101 [ 1821.331468][T17652] libceph: mon0 (1)[c::]:6789 connect error [ 1821.338532][T18156] ceph: No mds server is up or the cluster is laggy [ 1822.148568][T18165] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1822.733707][T12063] usb 5-1: USB disconnect, device number 15 [ 1823.421730][T18174] overlayfs: missing 'lowerdir' [ 1823.553646][T18174] netlink: 'syz.1.3465': attribute type 4 has an invalid length. [ 1823.561458][T18174] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3465'. [ 1823.571565][T18174] overlayfs: empty lowerdir [ 1823.945322][T18179] fuse: Unknown parameter 'group_i00000000000000000000' [ 1829.671371][T13903] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 1829.681743][T13903] CPU: 1 PID: 13903 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 1829.689378][T13903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1829.699453][T13903] Workqueue: hci4 hci_rx_work [ 1829.704342][T13903] Call Trace: [ 1829.707619][T13903] [ 1829.710544][T13903] dump_stack_lvl+0x18c/0x250 [ 1829.715317][T13903] ? show_regs_print_info+0x20/0x20 [ 1829.720547][T13903] ? load_image+0x400/0x400 [ 1829.725060][T13903] sysfs_create_dir_ns+0x26e/0x2a0 [ 1829.730219][T13903] ? sysfs_warn_dup+0xa0/0xa0 [ 1829.734953][T13903] ? do_raw_spin_unlock+0x121/0x230 [ 1829.740203][T13903] kobject_add_internal+0x61c/0xcc0 [ 1829.745618][T13903] kobject_add+0x164/0x240 [ 1829.750055][T13903] ? __rwlock_init+0x150/0x150 [ 1829.754878][T13903] ? kobject_init+0x1e0/0x1e0 [ 1829.759573][T13903] ? _raw_spin_unlock+0x28/0x40 [ 1829.764441][T13903] ? get_device_parent+0x366/0x390 [ 1829.769623][T13903] device_add+0x408/0xc20 [ 1829.773979][T13903] hci_conn_add_sysfs+0xd5/0x1e0 [ 1829.779137][T13903] le_conn_complete_evt+0xf5d/0x1540 [ 1829.784518][T13903] ? hci_event_packet+0x4cb/0x1270 [ 1829.789641][T13903] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1829.795886][T13903] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1829.801521][T13903] ? skb_pull_data+0xfb/0x200 [ 1829.806276][T13903] hci_le_conn_complete_evt+0x187/0x440 [ 1829.811829][T13903] ? hci_remote_host_features_evt+0x150/0x150 [ 1829.817893][T13903] hci_event_packet+0x7ba/0x1270 [ 1829.822835][T13903] ? bis_list+0x290/0x290 [ 1829.827190][T13903] ? lockdep_hardirqs_on+0x98/0x150 [ 1829.832452][T13903] ? hci_send_to_monitor+0xd7/0x4f0 [ 1829.837755][T13903] hci_rx_work+0x43a/0xd60 [ 1829.842217][T13903] ? process_scheduled_works+0x96f/0x15d0 [ 1829.847995][T13903] process_scheduled_works+0xa5d/0x15d0 [ 1829.853744][T13903] ? worker_attach_to_pool+0x380/0x380 [ 1829.859239][T13903] ? assign_work+0x3d2/0x5d0 [ 1829.863841][T13903] worker_thread+0xa55/0xfc0 [ 1829.868432][T13903] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1829.874335][T13903] ? _raw_spin_unlock+0x40/0x40 [ 1829.879271][T13903] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1829.885179][T13903] kthread+0x2fa/0x390 [ 1829.889247][T13903] ? pr_cont_work+0x560/0x560 [ 1829.893924][T13903] ? kthread_blkcg+0xd0/0xd0 [ 1829.898509][T13903] ret_from_fork+0x48/0x80 [ 1829.902940][T13903] ? kthread_blkcg+0xd0/0xd0 [ 1829.907537][T13903] ret_from_fork_asm+0x11/0x20 [ 1829.912333][T13903] [ 1829.992427][T18225] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3479'. [ 1831.714870][T13903] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1831.729914][T13903] Bluetooth: hci4: failed to register connection device [ 1832.013890][T11693] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1833.118337][T18225] nbd: socks must be embedded in a SOCK_ITEM attr [ 1833.155563][T18230] block nbd64: NBD_DISCONNECT [ 1834.210684][T18245] fuse: Unknown parameter 'group_i00000000000000000000' [ 1834.254836][T18235] udevd[18235]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1834.882256][T18252] 9pnet_fd: Insufficient options for proto=fd [ 1836.752336][T18266] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1837.603971][T16820] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1837.662169][T18272] fuse: Unknown parameter 'group_id00000000000000000000' [ 1837.834048][T16820] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1837.860953][T16820] usb 2-1: config 220 has 1 interface, different from the descriptor's value: 3 [ 1837.880448][T16820] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1837.894652][T16820] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1837.911758][T16820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1837.922493][T16820] usb 2-1: Product: syz [ 1837.930254][T16820] usb 2-1: Manufacturer: syz [ 1837.935286][T16820] usb 2-1: SerialNumber: syz [ 1838.231825][T16820] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1838.322385][T16820] usb 2-1: No valid video chain found. [ 1838.361678][T16820] usb 2-1: USB disconnect, device number 42 [ 1840.308454][T13903] Bluetooth: hci4: command 0x0406 tx timeout [ 1841.367143][T18301] fuse: Invalid rootmode [ 1843.145168][T18310] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1843.762580][T18315] vxfs: WRONG superblock magic 00000000 at 1 [ 1843.790141][T18315] vxfs: WRONG superblock magic 00000000 at 8 [ 1843.803114][T18315] vxfs: can't find superblock. [ 1843.841151][T18316] fuse: Unknown parameter 'group_id00000000000000000000' [ 1846.034001][T14468] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1846.235530][T14468] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1846.264699][T14468] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1846.299682][T14468] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1846.322407][T14468] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1846.380165][T14468] usb 3-1: Product: syz [ 1846.390398][T14468] usb 3-1: Manufacturer: syz [ 1846.422088][T14468] usb 3-1: SerialNumber: syz [ 1846.462536][T14468] usb 3-1: config 0 descriptor?? [ 1846.728136][T14468] usb 3-1: USB disconnect, device number 40 [ 1847.104059][ T787] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1847.354706][ T787] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1847.394137][ T787] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1847.459174][ T787] usb 2-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 1847.508352][ T787] usb 2-1: config 220 has no interface number 1 [ 1847.526185][ T787] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1847.532988][ T787] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1847.598921][ T787] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1847.620436][ T787] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1847.642403][ T787] usb 2-1: Product: syz [ 1847.651459][ T787] usb 2-1: Manufacturer: syz [ 1847.653958][T18344] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1847.659243][ T787] usb 2-1: SerialNumber: syz [ 1847.989465][ T787] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1847.996113][ T787] usb 2-1: No valid video chain found. [ 1848.165246][ T787] usb 2-1: USB disconnect, device number 43 [ 1853.517742][T18384] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1853.548226][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.590833][T14468] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1854.084501][T14468] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1854.124960][T14468] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1854.195859][T14468] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1854.224644][T14468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1854.263962][T14468] usb 1-1: Product: syz [ 1854.268162][T14468] usb 1-1: Manufacturer: syz [ 1854.301908][T14468] usb 1-1: SerialNumber: syz [ 1854.318845][T14468] usb 1-1: config 0 descriptor?? [ 1854.368988][T18393] vivid-000: disconnect [ 1855.364716][T18390] vivid-000: reconnect [ 1855.436481][T14468] usb 1-1: USB disconnect, device number 38 [ 1856.655319][T16820] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 1856.891570][T16820] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1857.024031][T16820] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1857.040017][T16820] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1857.051081][T16820] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1857.463114][T16820] usb 2-1: usb_control_msg returned -71 [ 1857.473994][T16820] usbtmc 2-1:16.0: can't read capabilities [ 1857.504353][T16820] usb 2-1: USB disconnect, device number 44 [ 1858.323962][T18424] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1861.174077][T14468] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1861.356524][T14468] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1861.402646][T14468] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1861.457237][T14468] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1861.494559][T14468] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1861.515705][T14468] usb 1-1: Product: syz [ 1861.533190][T14468] usb 1-1: Manufacturer: syz [ 1861.546483][T14468] usb 1-1: SerialNumber: syz [ 1861.613917][T14468] usb 1-1: config 0 descriptor?? [ 1862.239123][T10736] usb 1-1: USB disconnect, device number 39 [ 1863.051199][ T6269] libceph: connect (1)[c::]:6789 error -101 [ 1863.058735][ T6269] libceph: mon0 (1)[c::]:6789 connect error [ 1863.068241][T18456] ceph: No mds server is up or the cluster is laggy [ 1863.528273][T18465] tc_dump_action: action bad kind [ 1864.680545][T18479] overlayfs: missing 'lowerdir' [ 1865.210954][T18483] netlink: 'syz.1.3551': attribute type 4 has an invalid length. [ 1865.219112][T18483] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3551'. [ 1865.246754][T18483] overlayfs: empty lowerdir [ 1871.416894][ T6269] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1871.948324][ T6269] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1871.992528][ T6269] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1872.194306][ T6269] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1872.255772][T18526] vcan0: entered allmulticast mode [ 1873.032094][ T6269] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1873.043826][ T6269] usb 3-1: Product: syz [ 1873.048555][ T6269] usb 3-1: Manufacturer: syz [ 1873.053697][ T6269] usb 3-1: SerialNumber: syz [ 1873.065053][ T6269] usb 3-1: config 0 descriptor?? [ 1873.074381][T18529] overlayfs: missing 'lowerdir' [ 1873.154473][T18530] netlink: 'syz.1.3565': attribute type 4 has an invalid length. [ 1873.167161][T18530] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3565'. [ 1873.186793][T18530] overlayfs: empty lowerdir [ 1873.407153][T16820] usb 3-1: USB disconnect, device number 41 [ 1874.195347][ T787] libceph: connect (1)[c::]:6789 error -101 [ 1875.665230][ T787] libceph: mon0 (1)[c::]:6789 connect error [ 1875.756390][T18541] ceph: No mds server is up or the cluster is laggy [ 1875.757984][ T787] libceph: connect (1)[c::]:6789 error -101 [ 1875.820493][ T787] libceph: mon0 (1)[c::]:6789 connect error [ 1876.403871][ T787] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 1876.626195][ T787] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1876.647013][ T787] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1876.679740][ T787] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1876.699700][ T787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1876.719866][ T787] usb 3-1: Product: syz [ 1876.730117][ T787] usb 3-1: Manufacturer: syz [ 1876.734889][ T787] usb 3-1: SerialNumber: syz [ 1876.782992][ T787] usb 3-1: config 0 descriptor?? [ 1877.065111][ T787] usb 3-1: USB disconnect, device number 42 [ 1881.493936][ T5817] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1881.745348][ T5817] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 1881.754012][ T5817] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1881.763371][ T5817] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1881.775525][ T5817] usb 5-1: config 220 has no interface number 2 [ 1881.783078][ T5817] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1881.799466][ T5817] usb 5-1: config 220 interface 0 has no altsetting 0 [ 1881.812226][ T5817] usb 5-1: config 220 interface 76 has no altsetting 0 [ 1881.819469][T11693] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 1881.827292][ T5817] usb 5-1: config 220 interface 1 has no altsetting 0 [ 1881.838368][ T5817] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1881.848145][ T5817] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1881.873909][ T5817] usb 5-1: Product: syz [ 1881.878242][ T5817] usb 5-1: Manufacturer: syz [ 1881.883025][ T5817] usb 5-1: SerialNumber: syz [ 1882.013974][T11693] usb 3-1: Using ep0 maxpacket: 32 [ 1882.140303][ T5817] usb 5-1: Found UVC 7.01 device syz (8086:0b07) [ 1882.153137][T11693] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 1882.163543][ T5817] usb 5-1: No valid video chain found. [ 1882.170455][T11693] usb 3-1: config 0 has no interface number 0 [ 1882.184050][T11693] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1882.214391][ T5817] usb 5-1: USB disconnect, device number 16 [ 1883.065196][T11693] usb 3-1: config 0 interface 85 has no altsetting 0 [ 1883.079097][T11693] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1883.091207][T11693] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1883.100781][T11693] usb 3-1: Product: syz [ 1883.105326][T11693] usb 3-1: Manufacturer: syz [ 1883.109974][T11693] usb 3-1: SerialNumber: syz [ 1883.126177][T11693] usb 3-1: config 0 descriptor?? [ 1885.078808][T11693] appletouch 3-1:0.85: Failed to read mode from device. [ 1885.094112][T11693] appletouch: probe of 3-1:0.85 failed with error -5 [ 1885.346273][T11693] usb 3-1: USB disconnect, device number 43 [ 1886.696705][T18645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3600'. [ 1886.787457][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1886.795808][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1886.812237][T18642] ceph: No mds server is up or the cluster is laggy [ 1886.819737][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1886.832424][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1888.302299][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1888.308632][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1896.777114][T18720] ceph: No mds server is up or the cluster is laggy [ 1896.791300][T14468] libceph: connect (1)[c::]:6789 error -101 [ 1896.816999][T14468] libceph: mon0 (1)[c::]:6789 connect error [ 1898.546981][T18747] netlink: 'syz.2.3626': attribute type 21 has an invalid length. [ 1898.605931][T18747] ucma_write: process 1025 (syz.2.3626) changed security contexts after opening file descriptor, this is not allowed. [ 1899.454672][ T28] audit: type=1400 audit(1772866086.444:32): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=18754 comm="syz.2.3630" [ 1899.915238][T18760] fuse: Unknown parameter 'user_id00000000000000000000' [ 1904.297236][T18795] fuse: Bad value for 'fd' [ 1904.554462][ T28] audit: type=1400 audit(1772866091.404:33): apparmor="DENIED" operation="setprocattr" info="fscreate" error=-22 profile="unconfined" pid=18792 comm="syz.4.3643" [ 1905.400346][T18809] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1907.813865][T11693] usb 2-1: new low-speed USB device number 45 using dummy_hcd [ 1908.856413][T11693] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1908.893872][T11693] usb 2-1: config 0 has no interface number 0 [ 1908.920475][T11693] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1908.961434][T11693] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1909.028834][T11693] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1909.053810][T11693] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1909.126065][T11693] usb 2-1: config 0 descriptor?? [ 1909.132018][T18819] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1909.199996][T11693] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1909.438819][T16820] usb 2-1: USB disconnect, device number 45 [ 1909.438972][ C0] iowarrior 2-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 1909.680448][T18835] fuse: Bad value for 'fd' [ 1914.675720][T18862] fuse: Bad value for 'fd' [ 1914.920760][T14416] Bluetooth: hci3: Frame reassembly failed (-84) [ 1914.948104][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1915.373626][T18873] fuse: Bad value for 'rootmode' [ 1916.325680][T11693] libceph: connect (1)[c::]:6789 error -101 [ 1916.340001][T11693] libceph: mon0 (1)[c::]:6789 connect error [ 1916.353065][T18879] ceph: No mds server is up or the cluster is laggy [ 1916.945051][T13903] Bluetooth: hci3: command 0xfc11 tx timeout [ 1916.961689][T17754] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 1917.632853][ C0] ------------[ cut here ]------------ [ 1917.639000][ C0] WARNING: CPU: 0 PID: 18893 at net/mac80211/tx.c:5031 __ieee80211_beacon_get+0x1233/0x1600 [ 1917.649477][ C0] Modules linked in: [ 1917.653415][ C0] CPU: 0 PID: 18893 Comm: syz.4.3672 Not tainted syzkaller #0 [ 1917.660939][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1917.671041][ C0] RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 [ 1917.677505][ C0] Code: 24 4c 89 e7 e8 2e a7 c1 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 09 ee 83 f7 0f 0b e9 f6 f7 ff ff e8 fd ed 83 f7 <0f> 0b e9 48 fb ff ff e8 f1 ed 83 f7 48 c7 c7 00 61 64 8e 4c 89 e6 [ 1917.697201][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 1917.703295][ C0] RAX: ffffffff8a032e63 RBX: ffffffff8a031c66 RCX: ffff88802d67da00 [ 1917.711696][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1917.719704][ C0] RBP: 0000000000000000 R08: ffff88802d67da00 R09: 0000000000000003 [ 1917.727790][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805f8fe3c0 [ 1917.735791][ C0] R13: dffffc0000000000 R14: ffff88805f8fe8b0 R15: ffff88805eff4824 [ 1917.743916][ C0] FS: 00007f94495c36c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1917.752953][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1917.759556][ C0] CR2: 00007f94487e9e80 CR3: 000000002e901000 CR4: 00000000003506f0 [ 1917.767556][ C0] Call Trace: [ 1917.770869][ C0] [ 1917.773716][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 1917.779339][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 1917.784834][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 1917.792221][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 1917.797864][ C0] __iterate_interfaces+0x243/0x500 [ 1917.803114][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1917.809394][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1917.816707][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1917.822944][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 1917.830011][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 1917.835230][ C0] __hrtimer_run_queues+0x520/0xc40 [ 1917.840442][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 1917.846471][ C0] ? hw_scan_work+0xf60/0xf60 [ 1917.851148][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 1917.856289][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 1917.862359][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 1917.867583][ C0] handle_softirqs+0x280/0x820 [ 1917.872565][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 1917.877452][ C0] ? do_softirq+0x1a0/0x1a0 [ 1917.882038][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 1917.887311][ C0] __irq_exit_rcu+0xd3/0x190 [ 1917.892010][ C0] ? irq_exit_rcu+0x20/0x20 [ 1917.896539][ C0] irq_exit_rcu+0x9/0x20 [ 1917.900877][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1917.906567][ C0] [ 1917.909496][ C0] [ 1917.912433][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1917.918461][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 1917.925005][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 0b c9 cd f6 65 8b 05 2c f8 74 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 1917.944681][ C0] RSP: 0018:ffffc900032875a0 EFLAGS: 00000206 [ 1917.950770][ C0] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: f0b233e247b35700 [ 1917.958792][ C0] RDX: dffffc0000000000 RSI: ffffffff8acac960 RDI: 0000000000000001 [ 1917.966790][ C0] RBP: ffffc90003287638 R08: ffffffff911c15af R09: 1ffffffff22382b5 [ 1917.974788][ C0] R10: dffffc0000000000 R11: fffffbfff22382b6 R12: dffffc0000000000 [ 1917.982766][ C0] R13: 1ffff1100fa4f246 R14: ffff88807d2791d0 R15: 1ffff92000650eb4 [ 1917.990769][ C0] ? _raw_spin_unlock+0x40/0x40 [ 1917.995681][ C0] __skb_try_recv_datagram+0x17d/0x4d0 [ 1918.001162][ C0] ? sock_load_diag_module+0x140/0x140 [ 1918.006704][ C0] __unix_dgram_recvmsg+0x2f8/0xd80 [ 1918.012017][ C0] ? unix_unhash+0x10/0x10 [ 1918.016492][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1918.022754][ C0] ? mark_lock+0x94/0x320 [ 1918.027106][ C0] ? unix_dgram_recvmsg+0xad/0xd0 [ 1918.032212][ C0] ? unix_dgram_sendmsg+0x16d0/0x16d0 [ 1918.037690][ C0] sock_recvmsg_nosec+0x82/0xd0 [ 1918.042602][ C0] ____sys_recvmsg+0x4e8/0x5e0 [ 1918.047399][ C0] ? __sys_recvmsg_sock+0x50/0x50 [ 1918.052429][ C0] ? import_iovec+0x73/0xa0 [ 1918.056966][ C0] ___sys_recvmsg+0x216/0x590 [ 1918.061644][ C0] ? __sys_recvmsg+0x2a0/0x2a0 [ 1918.066442][ C0] ? __lock_acquire+0x7d40/0x7d40 [ 1918.071514][ C0] ? __might_fault+0xc6/0x120 [ 1918.076221][ C0] ? __might_fault+0xaa/0x120 [ 1918.080901][ C0] do_recvmmsg+0x39a/0x870 [ 1918.085350][ C0] ? __sys_recvmmsg+0x290/0x290 [ 1918.090315][ C0] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1918.096268][ C0] ? rcu_read_lock_sched_held+0x8a/0x110 [ 1918.101922][ C0] __x64_sys_recvmmsg+0x199/0x250 [ 1918.106984][ C0] ? do_recvmmsg+0x870/0x870 [ 1918.111587][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 1918.116829][ C0] do_syscall_64+0x55/0xa0 [ 1918.121254][ C0] ? clear_bhb_loop+0x40/0x90 [ 1918.125966][ C0] ? clear_bhb_loop+0x40/0x90 [ 1918.130690][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1918.136660][ C0] RIP: 0033:0x7f944879c799 [ 1918.141702][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1918.161446][ C0] RSP: 002b:00007f94495c3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1918.169902][ C0] RAX: ffffffffffffffda RBX: 00007f9448a16090 RCX: 00007f944879c799 [ 1918.177914][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 1918.186003][ C0] RBP: 00007f9448832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1918.194002][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1918.202056][ C0] R13: 00007f9448a16128 R14: 00007f9448a16090 R15: 00007ffc97d2c8c8 [ 1918.210144][ C0] [ 1918.213158][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1918.220429][ C0] CPU: 0 PID: 18893 Comm: syz.4.3672 Not tainted syzkaller #0 [ 1918.227876][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1918.238098][ C0] Call Trace: [ 1918.241396][ C0] [ 1918.244269][ C0] dump_stack_lvl+0x18c/0x250 [ 1918.249009][ C0] ? show_regs_print_info+0x20/0x20 [ 1918.254221][ C0] ? load_image+0x400/0x400 [ 1918.258731][ C0] panic+0x2dc/0x730 [ 1918.262659][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 1918.267166][ C0] __warn+0x2e0/0x470 [ 1918.271151][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.276880][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.282768][ C0] report_bug+0x2be/0x4f0 [ 1918.287090][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.292815][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.298530][ C0] ? __ieee80211_beacon_get+0x1235/0x1600 [ 1918.304259][ C0] handle_bug+0xcf/0x120 [ 1918.308501][ C0] exc_invalid_op+0x1a/0x50 [ 1918.313087][ C0] asm_exc_invalid_op+0x1a/0x20 [ 1918.318023][ C0] RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 [ 1918.324349][ C0] Code: 24 4c 89 e7 e8 2e a7 c1 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 09 ee 83 f7 0f 0b e9 f6 f7 ff ff e8 fd ed 83 f7 <0f> 0b e9 48 fb ff ff e8 f1 ed 83 f7 48 c7 c7 00 61 64 8e 4c 89 e6 [ 1918.343966][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 1918.350047][ C0] RAX: ffffffff8a032e63 RBX: ffffffff8a031c66 RCX: ffff88802d67da00 [ 1918.358054][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 1918.366029][ C0] RBP: 0000000000000000 R08: ffff88802d67da00 R09: 0000000000000003 [ 1918.374000][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805f8fe3c0 [ 1918.381995][ C0] R13: dffffc0000000000 R14: ffff88805f8fe8b0 R15: ffff88805eff4824 [ 1918.389977][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 1918.395560][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.401458][ C0] ? __ieee80211_beacon_get+0x1233/0x1600 [ 1918.407376][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 1918.412936][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 1918.418403][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 1918.425319][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 1918.430892][ C0] __iterate_interfaces+0x243/0x500 [ 1918.436102][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1918.442344][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 1918.449543][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 1918.455876][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 1918.462985][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 1918.468221][ C0] __hrtimer_run_queues+0x520/0xc40 [ 1918.473443][ C0] ? ktime_get_update_offsets_now+0x99/0x3f0 [ 1918.479422][ C0] ? hw_scan_work+0xf60/0xf60 [ 1918.484102][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 1918.489211][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 1918.495318][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 1918.500452][ C0] handle_softirqs+0x280/0x820 [ 1918.505226][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 1918.510012][ C0] ? do_softirq+0x1a0/0x1a0 [ 1918.514537][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 1918.519757][ C0] __irq_exit_rcu+0xd3/0x190 [ 1918.524344][ C0] ? irq_exit_rcu+0x20/0x20 [ 1918.529040][ C0] irq_exit_rcu+0x9/0x20 [ 1918.533288][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1918.538929][ C0] [ 1918.541871][ C0] [ 1918.544800][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1918.550781][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 1918.557367][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 0b c9 cd f6 65 8b 05 2c f8 74 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 1918.577062][ C0] RSP: 0018:ffffc900032875a0 EFLAGS: 00000206 [ 1918.583126][ C0] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: f0b233e247b35700 [ 1918.591265][ C0] RDX: dffffc0000000000 RSI: ffffffff8acac960 RDI: 0000000000000001 [ 1918.599243][ C0] RBP: ffffc90003287638 R08: ffffffff911c15af R09: 1ffffffff22382b5 [ 1918.607827][ C0] R10: dffffc0000000000 R11: fffffbfff22382b6 R12: dffffc0000000000 [ 1918.615814][ C0] R13: 1ffff1100fa4f246 R14: ffff88807d2791d0 R15: 1ffff92000650eb4 [ 1918.623967][ C0] ? _raw_spin_unlock+0x40/0x40 [ 1918.628926][ C0] __skb_try_recv_datagram+0x17d/0x4d0 [ 1918.634476][ C0] ? sock_load_diag_module+0x140/0x140 [ 1918.640038][ C0] __unix_dgram_recvmsg+0x2f8/0xd80 [ 1918.645239][ C0] ? unix_unhash+0x10/0x10 [ 1918.649747][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1918.656009][ C0] ? mark_lock+0x94/0x320 [ 1918.660361][ C0] ? unix_dgram_recvmsg+0xad/0xd0 [ 1918.665396][ C0] ? unix_dgram_sendmsg+0x16d0/0x16d0 [ 1918.670765][ C0] sock_recvmsg_nosec+0x82/0xd0 [ 1918.675838][ C0] ____sys_recvmsg+0x4e8/0x5e0 [ 1918.680660][ C0] ? __sys_recvmsg_sock+0x50/0x50 [ 1918.685684][ C0] ? import_iovec+0x73/0xa0 [ 1918.690185][ C0] ___sys_recvmsg+0x216/0x590 [ 1918.694946][ C0] ? __sys_recvmsg+0x2a0/0x2a0 [ 1918.699799][ C0] ? __lock_acquire+0x7d40/0x7d40 [ 1918.704821][ C0] ? __might_fault+0xc6/0x120 [ 1918.709499][ C0] ? __might_fault+0xaa/0x120 [ 1918.714349][ C0] do_recvmmsg+0x39a/0x870 [ 1918.718773][ C0] ? __sys_recvmmsg+0x290/0x290 [ 1918.723803][ C0] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1918.729772][ C0] ? rcu_read_lock_sched_held+0x8a/0x110 [ 1918.735405][ C0] __x64_sys_recvmmsg+0x199/0x250 [ 1918.740430][ C0] ? do_recvmmsg+0x870/0x870 [ 1918.745104][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 1918.750302][ C0] do_syscall_64+0x55/0xa0 [ 1918.754720][ C0] ? clear_bhb_loop+0x40/0x90 [ 1918.759397][ C0] ? clear_bhb_loop+0x40/0x90 [ 1918.764075][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1918.769964][ C0] RIP: 0033:0x7f944879c799 [ 1918.774528][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1918.794243][ C0] RSP: 002b:00007f94495c3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1918.802661][ C0] RAX: ffffffffffffffda RBX: 00007f9448a16090 RCX: 00007f944879c799 [ 1918.810895][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 1918.818867][ C0] RBP: 00007f9448832bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1918.827009][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 1918.834991][ C0] R13: 00007f9448a16128 R14: 00007f9448a16090 R15: 00007ffc97d2c8c8 [ 1918.842980][ C0] [ 1918.846473][ C0] Kernel Offset: disabled [ 1918.850940][ C0] Rebooting in 86400 seconds..