last executing test programs: 17.662816345s ago: executing program 3 (id=1120): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SNDRV_PCM_IOCTL_PREPARE(0xffffffffffffffff, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(0xffffffffffffffff, 0x40044145, &(0x7f0000000000)=0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000005c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000010000000f00000008000300", @ANYRES32=r4, @ANYBLOB="0500330002000000080032000700000008003100"], 0x44}}, 0x80) 17.568320507s ago: executing program 0 (id=1121): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getpid() sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) socket$rds(0x15, 0x5, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 16.551913933s ago: executing program 3 (id=1123): syz_open_dev$hidraw(&(0x7f00000000c0), 0x785, 0x20000) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000480), 0x6, 0x280000) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f0000000100)={0x4000031, 0x0}) splice(0xffffffffffffffff, &(0x7f0000000240)=0xfffffffffffffff7, r0, &(0x7f0000000400)=0x7, 0x9, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777) r2 = socket(0x1, 0x3, 0x0) bind$unix(r2, &(0x7f0000000400)=@file={0x1, './bus\x00'}, 0x6e) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='fdinfo/4\x00') ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000c80)=@v1={0x0, @aes128, 0x10, @desc2}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), r5) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000000)=0x7ff, 0x12) 16.298647499s ago: executing program 0 (id=1124): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x25) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 12.566865781s ago: executing program 0 (id=1125): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x11) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c89770000fdfd", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) 12.427301584s ago: executing program 3 (id=1126): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000140)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=r0], 0x24}}, 0x0) 12.101727902s ago: executing program 3 (id=1129): syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x4004000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x24000016}, 0x4048004) ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000300)={"7591273db7f9b25f105102d88c110b5a4a3ef6cb30e9df379ca600fee7429cd446f75fcab66c011295e024c81ecd0ce96d616dc461476ee77aeba5a0eb231ccca6dbc5a95a209956794cf6e04d5222b287320239d8160839d54a14530cd0216cf4ee6612c5454b8e578f6e11e0cd422842577d27683d4dfc8d6b07fb1220b0f9beb2d05724bba04a5d387c612b1ff798d84cd93701a30933fb7547126cc5bfb6c36fa21bcf6153b89cbc399e2ccfc085ce3f6abf678511584195f45a2a23506dd044e3f9ad51c1558c664a462ea3c7f3439117a7b6a579f04b4fe7a66b98191e0446f7363bb3476b502e6816aac03015d1bbe024575e510f7e3ee6c6e7dfff125182472402198548763f74f049945aea74a2c73f9dccce0bc3a17592883738bd41fdb831423e2779576eb2db93485e6499e84a2a88479bf7bed2dce066ba220e4b9a84dfcaa609fdf9f182beaf7d64f152f3ff7b48b3d35b64e5aa789af425e771e98e05d5164cd26a190fe05f6b9c1351e491738ef6475b713b55aeaedf3e692857a25506bb3757adc192d76fac58e95455843c88c89428219fecc44ccc62165b1238953554eaa0e0dc9ca7ad044243df81ba55989363cdbf8878091761923a46072ea851bc951bfee1c4507b9e2c841b27486f7c408d75ad7361e0103ff9f446309b5ed1b6ea8d26ea76ae6bffa730560d0c1afbe1d234d84cbc4b936078adef0875373d7a8d7ca374d0d04dc87c4fb0436d19d8a865d9e95267e92b0d4002074ff4bcfbea9f6d704b9d0f58fde50d59aa59b2500ff1158ee533b52534e3b49032c2d4615b518e3bf95951728ef7da07fdfa9530cd7f960e044cccfca64895db312a9b2152b2ba9e00baf16ff9bedc5373fc23e5fade6ba077037d42cc30fd5ac0cb0b5f3396327e8d08fc8a73899989c1ad1ba2fc9c84a9cf741a0af1e63000e99823f971d19d61f7e90117589d84834f009fa8fa9a352e386b0bb98ed1846b22d8387d00d1b0ca4cf380052982423405b9ff00767735655b1940b1a6be241cf37422a77de496a8a9e9a9f27c04b9ab0aa03e7aa1173d45c3a6af4d97cf68b5244d77d9629bf93b15bba5cd0c0ce3c3c27b44bc4ed2cf1298cefaf49d364d93943d1a6b9afdf13f3399958df20083931ef7aa6274daeabc58f108a7721be95350e09565987a4244f7fcdd76554ab57070561a33b36bd0cc22bf403171a0485c4f21fcaeb616f5d683f595615790bc38a271c768ef5d755c13934229a7b7ffda0ba53e610d7436d9525296c5a031c9e5a5eb5453fb2b54055b6e6eb6ad81d4340ea178c2acfa95752b8d24976fe238230064e1d6cccc36830c6f84f53c400e6e1155d6b6f4cd044f3e19ca7755a12369fd95672ec45c42eb1ffba25f4392aa9ad75bc0bb37cd24f7f8330800"}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0x1, 0x0, [{0x1, 0x0, 0x0, 0x0, 0x0, 0x1200000}]}) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b0001010000000904"], 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x1b, 0x0, 0xfee00d00}, {0x832, 0x0, 0x3fffd}]}) 10.273081067s ago: executing program 4 (id=1135): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x25) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 10.272412047s ago: executing program 2 (id=1136): syz_open_dev$hidraw(&(0x7f00000000c0), 0x785, 0x20000) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000480), 0x6, 0x280000) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f0000000100)={0x4000031, 0x0}) splice(0xffffffffffffffff, &(0x7f0000000240)=0xfffffffffffffff7, r0, &(0x7f0000000400)=0x7, 0x9, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777) r2 = socket(0x1, 0x3, 0x0) bind$unix(r2, &(0x7f0000000400)=@file={0x1, './bus\x00'}, 0x6e) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='fdinfo/4\x00') ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000c80)=@v1={0x0, @aes128, 0x10, @desc2}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), r5) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000000)=0x7ff, 0x12) 8.606683968s ago: executing program 4 (id=1138): r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000001c0)={0x1, 0x7e, 0x22, 0x0, 0x407}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x20}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000240)={@hyper, 0x1}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000000), 0x0, 0x40002) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x1, &(0x7f0000001300)=[0x0]) ioctl$FE_SET_FRONTEND(r4, 0x40246f4c, &(0x7f0000000080)={0x30a32c0, 0x1, @qam={0x3, 0xb, 0xa}}) 8.516327431s ago: executing program 2 (id=1139): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000002c0)={0x1000000, 0x1, 0x0, 0x0, 0x0, 0x28fc0, 0x9f8c}) 7.507526005s ago: executing program 0 (id=1140): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000140)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a00010000", @ANYRES32=0x0, @ANYRES32=r0], 0x24}}, 0x0) 7.481021216s ago: executing program 2 (id=1141): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x40000) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) socket(0x1d, 0x2, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udp6\x00') socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 7.350816929s ago: executing program 3 (id=1143): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/devices/usb1/1-0:1.0/usb1-port1/disable\x00', 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2a0471a, &(0x7f0000000180)={[{@test_dummy_encryption_v1}]}, 0x2, 0x46b, &(0x7f0000000580)="$eJzs3M1vFOUfAPDvzLbw+/HWivgColaJsfGlpQWVgxeNJh4wmugB9VTbQgiFGloTIUSqMXgxMSR6Vo8m/gXevBj1ZGLiSe+GhCgX0FPNzM5Ad9ltt3TZrd3PJxl4nn2e7TzfPvPMPDPPbgPoWUPZP0nEtoj4LSIGqtnaCkPV/65dOTf595Vzk0ksLr72Z5LXu3rl3GRZtXzf1iIznEakHyXFTmrNnTl7YmJmZvp0kR+dP/nO6NyZs08ePzlxbPrY9KnxQ4cOHhh75unxp9oSZxbX1T3vz+7d/dIbF1+ePHLx7R+/ydq7rShfGsct2XTzS0NZ4H8t5urLHon/r2l36832Jemkr4sNYVUqEZF1V38+/geiEjc6byBe/LCrjQNuq+zatLl58cIisIEl0e0WAN1RXuiz+99y69DUY124/Fz1BiiL+1qxVUv6Ii3q9Nfd37bTUEQcWfjni2yLdjyHAABYwSeTnx+OJxrN/9K4e0m9HcUaymBE3BEROyPizojYFRF3ReR174mIe1e5//qloZvnP+mlWwqsRdn879libat2/lfO/mKwUuS25/H3J0ePz0zvL34nw9G/OcuPLbOP71745dNmZUvnf9mW7b+cCxbtuNRX94BuamJ+Ip+UtsHlDyL29DWKP7m+EpBExO6I2LO6H72jTBx/7Ou9zSqtHP8y2rDOtPhVxKPV/l+IuvhLyfLrk6P/i5np/aPlUXGzn36+8Gqz/a8p/jbI+n9L7fFflHx5pkgMvrV0vXYuVr1yeeH3j5ve09zq8b8peT0/H5XLru9NzM+fHovYlBzO8zWvj994b5kv62fxD+9rPP53Fu/J+v++iMgO4vsj4oGIeLBo+0MR8XBE7Fsm/h+eb162Hvp/quH57/rxP5jU9P/qE5UT33/bbP+t9f/BPDVcvJKf/1bQagPX8rsDAACA/4o0/wx8ko5cT6fpyEj1M/y7Yks6Mzs3//jR2XdPTVU/Kz8Y/Wn5pGtgyfPQsWSh+InV/HjxrLgsP1A8N/6sEnl+ZHJ2ZqrLsUOv29pk/Gf+qHS7dcBt12gdbbzBF9qAjad+/Ke12fOvdLIxQEf5vjb0rhXGf9qpdgCd5/oPvavR+D9fl7cWABuT6z/0LuMfepfxD72rbvxX4tdutQTooLV8r1+ilxORrotmtJRo/e9B3O7Em+ujGS0kun1mAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaI9/AwAA//9sbvBf") write(r4, &(0x7f0000000200)='1', 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x2, 0x0, 0x0) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) 7.194583073s ago: executing program 0 (id=1144): r0 = fanotify_init(0x200, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f511, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) madvise(&(0x7f0000c38000/0x3000)=nil, 0x3000, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(0xffffffffffffffff, 0x84, 0x23, &(0x7f0000000100)={0x0, 0x8}, 0x8) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x4004804) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x64010102}}, 0x1, 0x2, 0x8, 0x50c4, 0x10, 0x101, 0x1}, 0x9c) fanotify_mark(r0, 0x161, 0x40000867, r1, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000480)='fdinfo/3\x00') read$eventfd(r5, &(0x7f0000000280), 0x8) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r6, 0x0, 0x48f, &(0x7f0000000080)={0x11, @loopback, 0x4e20, 0x3, 'sed\x00', 0x1c, 0x248, 0x4b}, 0x2c) syz_emit_ethernet(0x32, &(0x7f0000000340)=ANY=[@ANYRESDEC], 0x0) 6.90990245s ago: executing program 2 (id=1146): setns(0xc9, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) mount(0x0, 0x0, 0x0, 0x1c3425, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000140)={@my=0x1}) socket$vsock_stream(0x28, 0x1, 0x0) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)=')o', 0x2) 6.402936202s ago: executing program 1 (id=1147): openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_pidfd_open(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) socket$rds(0x15, 0x5, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 5.916279484s ago: executing program 2 (id=1148): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x25) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000480)=0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r10, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 3.966211762s ago: executing program 2 (id=1149): syz_open_dev$hidraw(&(0x7f00000000c0), 0x785, 0x20000) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000480), 0x6, 0x280000) ioctl$FE_SET_PROPERTY(r1, 0x40106f52, &(0x7f0000000100)={0x4000031, 0x0}) splice(0xffffffffffffffff, &(0x7f0000000240)=0xfffffffffffffff7, r0, &(0x7f0000000400)=0x7, 0x9, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777) r2 = socket(0x1, 0x3, 0x0) bind$unix(r2, &(0x7f0000000400)=@file={0x1, './bus\x00'}, 0x6e) ioctl$SIOCGETMIFCNT_IN6(r2, 0x89e0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000140), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) syz_open_procfs(0xffffffffffffffff, &(0x7f00000003c0)='fdinfo/4\x00') ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000c80)=@v1={0x0, @aes128, 0x10, @desc2}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), r5) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000000)=0x7ff, 0x12) 3.914832773s ago: executing program 1 (id=1150): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000200)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_ecred_conn_req={{0x17, 0x42, 0xa}, {0x80, 0x200, 0x200, 0x2286, [0x40]}}}}, 0x17) recvmsg$unix(0xffffffffffffffff, 0x0, 0x80) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0004}]}) close_range(r1, 0xffffffffffffffff, 0x0) 2.218429095s ago: executing program 4 (id=1151): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x11) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r4 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c89770000fdfd", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) 2.114725328s ago: executing program 1 (id=1152): r0 = syz_open_dev$radio(&(0x7f0000000080), 0x2, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r0, 0x40305652, &(0x7f00000002c0)={0x1000000, 0x1, 0x0, 0x0, 0x0, 0x28fc0, 0x9f8c}) 975.799966ms ago: executing program 1 (id=1153): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) getpid() openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x440, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') read$FUSE(r2, 0x0, 0x0) syz_emit_ethernet(0x42, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setitimer(0x0, &(0x7f0000000180)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) read$nci(r0, 0x0, 0x0) 974.685856ms ago: executing program 4 (id=1154): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000140)=0x6, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a00010000", @ANYRES32=0x0, @ANYRES32=r0], 0x24}}, 0x0) 698.671012ms ago: executing program 4 (id=1155): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_mount_image$udf(&(0x7f0000000c40), &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='noadinicb,nostrict,mode=00000000000000000000004,uid=forget,noadinicb,umask=00000000000000040002000,lastblock=00000000000000000013,undelete,partition=00000000000000000005,\x00', @ANYRES32=0x0], 0x47, 0xc15, &(0x7f0000001940)="$eJzs3V1sZOdZB/DnnWPHY6e0TtNuWmjKSEXtymWj/equq0WVt3ENlbabql5X5Koef+x2FO94ZXvppkBlQAWJm4rcIG6QRYlA6gVXhEtcGqRWCAlVvSgXSJZoo1xw4YtKCFBqdM68Y493vVk3G39s8vtFzv/MmeeM34/xmWNpX58AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACI++7nLp8+ko24FAHCYrk5+6fQ5n/8A8K5yze//AAAAAAAAAAAAAABw3KUo4kSkGHplM01XjzvqV1rt23emxif2PmwwRYpaFFV9+VU/c/bc+U9duDjazTc//u324Xhu8trlxrOLN28tzS8vz881ptqt2cW5+X2/wsMef7eRagAaN1+4PXf9+nLj7DPndj19Z/i1gcdPDF+6eOrCaLd2anxiYrKnpq//LX/3e9xvhcdjUUQzUrwx/HpqRkQtHn4sHvDeOWiDVSdGqk5MjU9UHVloNdsr5ZOplqtqEY2eg8a6Y3QIc/FQxiJWy+aXDR4puzd5q7nUnFmYb3yxubTSWmkttlOt09qyP42oxWiKWIuIjYF7X64/ivhopHjp9GaaiYiiOw6frBYGP7g9tQPo4z6U7Wz0R6zVHoE5O8YGooirkeJnr56M2XLM8ld8POILZb4S8XKZn4lI5RvjfMRP93gf8WjqiyL+NVIsps00V50PuueVK19ufL59fbGntnteeeQ/Hw7TMT831aOImeqMv5ne+sUOAAAAAAAAAAAAAAAAAG+3wSji25Hij57+nWpdcVTr0t93afQ9z/9m75rxpx7wOmXtMxGxWtvfmtz+vHQ41cr/DqBj7Es9ivhGXv/3B0fdGAAAAAAAAAAAAAAAAAAAgHe1Ip6PFF85dTKtRe89xVvtG41rzZmFzl1hu/f+7d4zfWtra6uROjmWczrnas61nOs5N3JGLR+fcyzndM7VnGs513Nu5IwiH59zLOd0ztWcaznXc27kjL58fM6xnNM5V3Ou5VzPuZEzjsm9ewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3klqUcTPI8W3vraZIkXEWMR0dHJ94KhbBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACU6qmIZyLF+vP16vFaLeJaRPx8a2ur+vqfra2tiM1y+2EddV8BAAAAAAAAAAAAAAAAAADg2EpFfCxSPPm/m6kREXeGXxt4/MTwpYunLowWUUQqS3rrn5u8drnx7OLNW0vzy8vzc42pdmt2cW5+v9+ufqXVvn1nanziQDrzQIMH3P7B+rOLt15cat346sqezw/VL88sryw1Z/d+OgajFjHdu2ekavDU+ETV6IVWs10dmmr3aWAtYmy/nQEAAAAAAAAAAAAAAAAAAODYGEpFfC5S/OQ/zqfuuvG+zpr/X+o8KrZrX/69nb8FsHBXdvX+/YD9bKf9NnSkWnjfmBqfmJjs2d3Xf29p2aaUingqUnzipQ9V6+FTDO25Nr6se29Zd/N8rhv+lbJudVdVfWRqfKJxdbF96vLCwuJsc6U5szDfmLzVnN33Hw4AAAAAAAAAAAAAAAAAAACANzGUivhRpPivv/231L3vfF7/39d51LP+/zeqJfSVetqd26q1/e+t1vZ3tt93aXToo0/fb/9BrP8v25RSEd+MFOd+9KHqfvrd9f/Td9WWdX8SKV5/+iO5rvZYWdfsdqfzitdbC/Ony9q/jBS/+ka3NqraG7n2yZ3aM2XtYKT4883dtV/NtR/YqT1b1p6MFN/7z71rP7hTe66s/Umk+Ie/aXRrh8ra3821J3Zqn5ldXJh70LCW8/+dSPHXV38rdft83/nv+fsPq3fltnvm/M233675H+7Zt5rn9Y/z/DcfMP8XIsV36h/JdZ2xn8nPP1H9f2f+PxEp/v1fdtdez7Xv36k9s99uHbVy/r8dKb77Fz/e7nOe/zyyOzPUO/+/3Lc7t98lRzT/T/TsG87tmv0Fx+LdaPnFr7/QXFiYX7Jhw4aN7Y2jPjNxGMrP/z+NFP93okjd65j8+f+ezqOd67///sbO5/+lu3LbEX3+v79n36V81dLfF1FfuXmr/6mI+vKLXz/Vutm8MX9jvn32zOlPf/rCmdNnLvQ/1r2429na99i9E5Tz/4NI8cO/++H27zG7r//2vv4fuiu3HdH8P9nbp13XNfseinelcv7/KlI88dkfb/+++WbX/93f/09+bHdu//wd0fx/oGffcG5X6xccCwAAAAAAAAAAgEfJUCrizyLFb//hr6fuGqL9/Pu/ubty2xH9+68TPfvmDmldw74HGQDgGCmv/z4YKf5x6/vba7l3X//Fr3Vre6//7uc43P8fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAedSmK+P1IMfTKZlofKB931K+02rfvTI1P7H3YYIoUtSiq+vKrfubsufOfunBxtJtXBg6zGx+O5yavXW48u3jz1tL88vL8XGOq3ZpdnJvf9ys87PF3G6kGsHHzhdtz168vN84+c27X03eGXxt4/MTwpYunLox2a6fGJyYme2r6+t/yd79Hus/+x6KI70eKN4ZfT98diKjFw4/FA947B22w6sRI1Ymp8YmqIwutZnulfDLVclUtotFz0Fh3jA5hLh7KWMRq2fyywSNl9yZvNZeaMwvzjS82l1ZaK63Fdqp1Wlv2pxG1GE0RaxGxscePZH8U8c1I8dLpzfRPAxFFdxw+eXXyS6fPPbg9tQPo4z6U7Wz0R6zVHoE5O8YGooi/jxQ/e/VkfG8goi86X/HxiC+U+UrEy2V+JiKVb4zzET891FM7B6kvijgfKRbTZnp1oDwfdM8rV77c+Hz7+mJPbfe88sh/PhymY35uqkcRP6jO+Jvpn/1cAwAAAAAAAAAAAAAAABwjRaxFiq+cOpmq9cHba4pb7RuNa82Zhc6yvu7av+6a6a2tra1G6uRYzumcqznXcq7n3MgZtXx8zrGc0zlXc67lXM+5kTOKfHzOsZzTOVdzruVcz7mRM/ry8TnHck7nXM25lnM950bOOCZr9wAAAAAAAAAAAAAAAAAAgHeWWhTVXdy/9bXNtDXQub/0dHRy3f1A3/H+PwAA//8YNXNU") syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000280)='./bus\x00', 0x0, 0x0, 0xff, 0x0, &(0x7f00000007c0)) symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r2 = io_uring_setup(0x2688, &(0x7f0000000300)={0x0, 0x600, 0x400, 0x8001002, 0x3d7}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) lsetxattr(&(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000900)=@known='user.syz\x00', &(0x7f0000000940)='!', 0x1, 0x2) r5 = accept(r3, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x12, 0x4, 0x4, 0xa4}, 0x50) r7 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_G_TUNER(r7, 0xc054561d, &(0x7f0000000140)={0x7f, "bf2ffba23b2335d02c18e646d53cff14a23b92eefffbd24560c4552bef19ce8c", 0x2, 0x10, 0x2, 0xe04b, 0x8, 0x4, 0x24c}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r6, &(0x7f0000000080), &(0x7f00000002c0)=@tcp=r5}, 0x20) recvmsg$can_bcm(r5, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x2000) close_range(r2, 0xffffffffffffffff, 0x0) move_mount(0xffffffffffffffff, &(0x7f0000000500)='./bus\x00', r1, &(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', 0x336) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@RTM_NEWMDB={0x78, 0x55, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x0, 0x0, 0xfe0f, {@ip4=@empty}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x0, {@ip4=@rand_addr=0x3ff, 0x800}}}, @MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x0, 0x3, 0x0, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x436e}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x44}, 0x20000100) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(0xffffffffffffffff, 0x8004587d, &(0x7f00000001c0)={@id={0x2, 0x0, @c}}) sendfile(r8, r8, 0x0, 0xe3aa6ea) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x12c}}, 0x0) 557.715696ms ago: executing program 1 (id=1156): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x20, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) 279.008753ms ago: executing program 0 (id=1157): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x80002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000080)=0x40000) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$ublk_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) socket(0x1d, 0x2, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udp6\x00') socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 223.950014ms ago: executing program 1 (id=1158): setns(0xc9, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x9, 0x3ba9bfc6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) mount(0x0, 0x0, 0x0, 0x1c3425, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000140)={@my=0x1}) socket$vsock_stream(0x28, 0x1, 0x0) r2 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)=')o', 0x2) 110.780107ms ago: executing program 3 (id=1159): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x25) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f00000012c0)=""/102376, 0x18fe8) sched_setaffinity(r2, 0x8, &(0x7f0000000100)=0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = dup(r8) syz_ublk_setup_queues(r9, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x1f00, 0x1, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7fffde, 0x200, 0x2, 0x15e, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x80, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf90f, 0x4e52ba9def4ca6b0, 0x3, 0x0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0x1e9}}], 0x1, &(0x7f0000000340)={0x2e, 0x2, 0x0, r9, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x8004, 0x0, 0x0}}, 0x0) 0s ago: executing program 4 (id=1160): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, 0x0, 0x0) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x2000413, &(0x7f0000019080)=ANY=[]) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x50, 0x0, 0xfff, {0x7, 0x29, 0xcf940281, 0xa00010, 0x1, 0x3a76, 0x10, 0x1801, 0x0, 0x0, 0x2, 0x2000009e}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080003006400000008000200c8"], 0x2c}}, 0x0) kernel console output (not intermixed with test programs): a:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.763770][ T4278] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.773993][ T4278] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 112.786395][ T4281] Bluetooth: hci3: command 0x0419 tx timeout [ 112.791152][ T4278] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 112.794190][ T4275] Bluetooth: hci2: command 0x0419 tx timeout [ 112.805087][ T49] Bluetooth: hci1: command 0x0419 tx timeout [ 112.816936][ T4281] Bluetooth: hci0: command 0x0419 tx timeout [ 112.838122][ T4278] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.858729][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 112.868456][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.872792][ T4279] Bluetooth: hci4: command 0x0419 tx timeout [ 112.903255][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 112.914201][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 112.924323][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 112.934255][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.937684][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 112.951647][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 112.988353][ T4278] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 113.000843][ T4278] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 113.015916][ T4278] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 113.027350][ T4278] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 113.039917][ T4278] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.062465][ T4286] device veth0_vlan entered promiscuous mode [ 113.074834][ T4272] device veth1_macvtap entered promiscuous mode [ 113.096385][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 113.116615][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 113.127848][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 113.138386][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 113.149737][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 113.160689][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 113.173216][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 113.188908][ T4278] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.218364][ T4278] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.237225][ T4278] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.259487][ T4278] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.307723][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.332616][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.622023][ T4356] loop0: detected capacity change from 0 to 32768 [ 113.651240][ T4286] device veth1_vlan entered promiscuous mode [ 113.678903][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 113.746065][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 113.774817][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 113.794234][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 113.826680][ T4356] XFS (loop0): Mounting V5 Filesystem [ 113.848260][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 113.861713][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 113.876286][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 113.896589][ T4272] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.929930][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 113.958305][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 113.971918][ T4356] XFS (loop0): Ending clean mount [ 113.988830][ T4356] XFS (loop0): Quotacheck needed: Please wait. [ 114.030892][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 114.050730][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.065489][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 114.082663][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.122036][ T4272] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 114.144921][ T4356] XFS (loop0): Quotacheck: Done. [ 114.179319][ T4272] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 114.318073][ T4272] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.432455][ T4286] device veth0_macvtap entered promiscuous mode [ 114.482818][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 114.521169][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 114.532984][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 114.553217][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 114.572984][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 114.615257][ T4272] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.655819][ T4272] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.683118][ T4272] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.702713][ T4272] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.945878][ T4286] device veth1_macvtap entered promiscuous mode [ 114.975376][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 114.988983][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.002023][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.025689][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.044445][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.089148][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.418651][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 115.919771][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 115.975138][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 116.031412][ T4276] XFS (loop0): Unmounting Filesystem [ 116.057241][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 116.096069][ T57] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 116.111942][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.137086][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.229126][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.262605][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.288536][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.305943][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.324021][ T4286] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 116.345109][ T4286] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 116.378105][ T4286] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.417056][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 116.443982][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 116.458726][ T4286] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.475100][ T4286] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.490874][ T4286] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.506454][ T4286] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.534938][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.565364][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.861034][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.861588][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 116.900897][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.950990][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 117.093384][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.140018][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.235816][ T4375] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 117.283259][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.319017][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.333959][ T4375] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.374170][ T4375] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.390108][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 117.410217][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 117.434703][ T4381] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 117.571076][ T4320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.603826][ T4320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.673931][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 117.892817][ T3598] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 118.118022][ T3598] usb 1-1: config 1 has an invalid interface number: 113 but max is 0 [ 118.142905][ T4338] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 118.345257][ T4392] loop4: detected capacity change from 0 to 32768 [ 118.399721][ T3598] usb 1-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 118.462783][ T3598] usb 1-1: config 1 has no interface number 0 [ 118.469537][ T3598] usb 1-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 118.534339][ T3598] usb 1-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 118.588128][ T4338] usb 4-1: config 0 interface 0 altsetting 255 endpoint 0x7 has an invalid bInterval 0, changing to 4 [ 118.620931][ T3598] usb 1-1: config 1 interface 113 has no altsetting 0 [ 118.640749][ T4338] usb 4-1: config 0 interface 0 has no altsetting 0 [ 118.688249][ T3598] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 118.732987][ T4338] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 118.764364][ T3598] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.787194][ T4338] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 118.806971][ T3598] usb 1-1: Product: syz [ 118.812219][ T4338] usb 4-1: Product: syz [ 118.817396][ T3598] usb 1-1: Manufacturer: syz [ 118.824799][ T4338] usb 4-1: Manufacturer: syz [ 118.830781][ T3598] usb 1-1: SerialNumber: syz [ 118.836804][ T4338] usb 4-1: SerialNumber: syz [ 118.870836][ T4405] loop1: detected capacity change from 0 to 256 [ 118.908273][ T4338] usb 4-1: config 0 descriptor?? [ 118.942999][ T4392] XFS (loop4): Mounting V5 Filesystem [ 119.077864][ T4338] usb 4-1: selecting invalid altsetting 0 [ 119.132210][ T3598] hub 1-1:1.113: bad descriptor, ignoring hub [ 119.206543][ T3598] hub: probe of 1-1:1.113 failed with error -5 [ 119.216835][ T4392] XFS (loop4): Ending clean mount [ 119.229162][ T4392] XFS (loop4): Quotacheck needed: Please wait. [ 119.334217][ T3598] usb 1-1: USB disconnect, device number 2 [ 119.400344][ T4338] usb 4-1: USB disconnect, device number 2 [ 119.497425][ T4392] XFS (loop4): Quotacheck: Done. [ 120.166562][ T4265] udevd[4265]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.392667][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 120.412633][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.424615][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.433960][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.443785][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.456724][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.467301][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.479120][ T0] NOHZ tick-stop error: local softirq work is pending, handler #8a!!! [ 120.490170][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 120.500883][ T0] NOHZ tick-stop error: local softirq work is pending, handler #18a!!! [ 126.544827][ T4434] Bluetooth: MGMT ver 1.22 [ 127.038803][ T4286] XFS (loop4): Unmounting Filesystem [ 128.108809][ T4455] loop2: detected capacity change from 0 to 2048 [ 130.012734][ T4371] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 130.725139][ T4455] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 130.734977][ T4455] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 130.796958][ T4371] usb 1-1: config 1 has an invalid interface number: 113 but max is 0 [ 130.879124][ T4371] usb 1-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 130.962688][ T4371] usb 1-1: config 1 has no interface number 0 [ 130.995970][ T4371] usb 1-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 131.062647][ T4371] usb 1-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 131.131760][ T4371] usb 1-1: config 1 interface 113 has no altsetting 0 [ 131.164925][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 131.313228][ T4371] usb 1-1: string descriptor 0 read error: -71 [ 131.349696][ T4371] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 131.386870][ T4371] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.641243][ T4481] loop1: detected capacity change from 0 to 32768 [ 131.734882][ T4371] usb 1-1: can't set config #1, error -71 [ 131.762889][ T4371] usb 1-1: USB disconnect, device number 3 [ 131.990808][ T4483] loop2: detected capacity change from 0 to 32768 [ 132.079195][ T4483] XFS (loop2): Mounting V5 Filesystem [ 132.080284][ T4481] XFS (loop1): Mounting V5 Filesystem [ 132.693418][ T4483] XFS (loop2): Ending clean mount [ 132.705091][ T4483] XFS (loop2): Quotacheck needed: Please wait. [ 132.734944][ T4481] XFS (loop1): Ending clean mount [ 132.748919][ T4481] XFS (loop1): Quotacheck needed: Please wait. [ 132.788799][ T4483] XFS (loop2): Quotacheck: Done. [ 133.030146][ T4481] XFS (loop1): Quotacheck: Done. [ 134.491303][ T4525] loop0: detected capacity change from 0 to 256 [ 134.579106][ T4278] XFS (loop2): Unmounting Filesystem [ 135.301177][ T4514] XFS (loop1): User initiated shutdown received. [ 135.639141][ T4514] XFS (loop1): Metadata I/O Error (0x4) detected at xfs_fs_goingdown+0x6d/0x150 (fs/xfs/xfs_fsops.c:495). Shutting down filesystem. [ 135.777964][ T4514] XFS (loop1): Please unmount the filesystem and rectify the problem(s) [ 135.853871][ T126] loop1: writeback error on inode 4427, offset 0, sector 24320 [ 138.066375][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.081626][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.699890][ T4282] XFS (loop1): Unmounting Filesystem [ 140.828392][ T4574] loop4: detected capacity change from 0 to 256 [ 141.473170][ T4576] tipc: Started in network mode [ 141.497188][ T4576] tipc: Node identity 7e300ab025f7, cluster identity 4711 [ 141.520730][ T4576] tipc: Enabled bearer , priority 0 [ 141.587485][ T4576] tipc: Resetting bearer [ 141.656415][ T4575] tipc: Disabling bearer [ 142.018954][ T4587] loop3: detected capacity change from 0 to 8 [ 144.352917][ T4600] syz.2.52 uses obsolete (PF_INET,SOCK_PACKET) [ 145.900902][ T4618] loop2: detected capacity change from 0 to 256 [ 147.750168][ T4629] loop4: detected capacity change from 0 to 512 [ 147.821879][ T4629] EXT4-fs (loop4): Test dummy encryption mode enabled [ 147.916882][ T4629] EXT4-fs (loop4): 1 truncate cleaned up [ 147.932769][ T4629] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 148.175213][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 148.335498][ T4639] device syzkaller0 entered promiscuous mode [ 150.087893][ T4656] loop4: detected capacity change from 0 to 256 [ 150.836058][ T4659] loop3: detected capacity change from 0 to 1024 [ 150.961481][ T4659] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 151.268269][ T4671] device dummy0 entered promiscuous mode [ 152.353345][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 152.714443][ T4681] capability: warning: `syz.2.79' uses deprecated v2 capabilities in a way that may be insecure [ 152.788330][ T4685] device syzkaller0 entered promiscuous mode [ 153.492733][ T4371] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 153.676934][ T4371] usb 1-1: Using ep0 maxpacket: 16 [ 153.685772][ T4371] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 153.729005][ T4371] usb 1-1: config 0 has no interface number 0 [ 153.754970][ T4371] usb 1-1: config 0 interface 49 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 16 [ 153.796281][ T4371] usb 1-1: config 0 interface 49 altsetting 0 has an invalid endpoint with address 0x29, skipping [ 153.859671][ T4371] usb 1-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=76.b7 [ 153.904970][ T4371] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 153.944941][ T4371] usb 1-1: Product: syz [ 153.949214][ T4371] usb 1-1: Manufacturer: syz [ 153.991156][ T4371] usb 1-1: SerialNumber: syz [ 154.033804][ T4371] usb 1-1: config 0 descriptor?? [ 154.072397][ T4696] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 154.158340][ T4694] loop1: detected capacity change from 0 to 32768 [ 154.213914][ T4694] ======================================================= [ 154.213914][ T4694] WARNING: The mand mount option has been deprecated and [ 154.213914][ T4694] and is ignored by this kernel. Remove the mand [ 154.213914][ T4694] option from the mount to silence this warning. [ 154.213914][ T4694] ======================================================= [ 154.301643][ T4696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.332950][ T4696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.521715][ T4371] qmi_wwan: probe of 1-1:0.49 failed with error -22 [ 154.547223][ T4694] read_mapping_page failed! [ 154.583982][ T4694] ERROR: (device loop1): txCommit: [ 154.583982][ T4694] [ 154.599567][ T4371] usb 1-1: USB disconnect, device number 4 [ 155.092764][ T14] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 155.304698][ T14] usb 3-1: config 0 interface 0 altsetting 255 endpoint 0x7 has an invalid bInterval 0, changing to 4 [ 155.329786][ T14] usb 3-1: config 0 interface 0 has no altsetting 0 [ 155.367216][ T14] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 155.407041][ T14] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 155.425622][ T14] usb 3-1: Product: syz [ 155.434666][ T14] usb 3-1: Manufacturer: syz [ 155.445202][ T14] usb 3-1: SerialNumber: syz [ 155.468668][ T14] usb 3-1: config 0 descriptor?? [ 155.499255][ T14] usb 3-1: selecting invalid altsetting 0 [ 155.685933][ T4721] loop0: detected capacity change from 0 to 256 [ 156.564447][ T4724] usb 3-1: cannot submit urb 0, error -2: endpoint not enabled [ 156.957315][ T14] usb 3-1: USB disconnect, device number 2 [ 158.828966][ T4750] loop4: detected capacity change from 0 to 256 [ 159.750175][ T4755] loop2: detected capacity change from 0 to 256 [ 160.882670][ T7] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 161.537906][ T7] usb 5-1: config 0 interface 0 altsetting 255 has an invalid endpoint with address 0xFF, skipping [ 161.581002][ T7] usb 5-1: config 0 interface 0 has no altsetting 0 [ 161.599017][ T7] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 161.635058][ T7] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 161.726057][ T7] usb 5-1: Product: syz [ 161.782619][ T7] usb 5-1: Manufacturer: syz [ 161.812873][ T7] usb 5-1: SerialNumber: syz [ 161.886524][ T7] usb 5-1: config 0 descriptor?? [ 162.778991][ T7] snd-usb-audio: probe of 5-1:0.0 failed with error -22 [ 162.984226][ T7] usb 5-1: USB disconnect, device number 2 [ 163.234826][ T4413] udevd[4413]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 164.389920][ T4799] loop0: detected capacity change from 0 to 256 [ 168.244377][ T4841] loop0: detected capacity change from 0 to 32768 [ 168.320599][ T4841] XFS (loop0): Mounting V5 Filesystem [ 168.351655][ T4841] XFS (loop0): Ending clean mount [ 168.444699][ T4841] XFS (loop0): Quotacheck needed: Please wait. [ 169.388363][ T4841] XFS (loop0): Quotacheck: Done. [ 169.850765][ T4860] loop1: detected capacity change from 0 to 256 [ 171.517155][ T4879] loop3: detected capacity change from 0 to 512 [ 172.174395][ T4879] EXT4-fs (loop3): Test dummy encryption mode enabled [ 172.230341][ T4276] XFS (loop0): Unmounting Filesystem [ 172.345725][ T4879] EXT4-fs (loop3): 1 truncate cleaned up [ 172.351418][ T4879] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 173.164119][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 176.099732][ T4899] Can't find ip_set type has [ 176.599170][ T4906] loop1: detected capacity change from 0 to 32768 [ 176.820239][ T4906] XFS (loop1): Mounting V5 Filesystem [ 176.886978][ T4906] XFS (loop1): Ending clean mount [ 176.895136][ T4906] XFS (loop1): Quotacheck needed: Please wait. [ 177.049878][ T4906] XFS (loop1): Quotacheck: Done. [ 177.920430][ T4282] XFS (loop1): Unmounting Filesystem [ 178.552663][ T22] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 179.276611][ T22] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 179.315948][ T22] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 179.357116][ T22] usb 3-1: config 1 has no interface number 0 [ 179.387584][ T22] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 179.417811][ T22] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 179.435342][ T22] usb 3-1: config 1 interface 113 has no altsetting 0 [ 179.470830][ T22] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 179.497236][ T22] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 179.510187][ T22] usb 3-1: Product: syz [ 179.518217][ T22] usb 3-1: Manufacturer: syz [ 179.535913][ T22] usb 3-1: SerialNumber: syz [ 179.799719][ T22] hub 3-1:1.113: bad descriptor, ignoring hub [ 179.812755][ T22] hub: probe of 3-1:1.113 failed with error -5 [ 179.876381][ T22] usb 3-1: USB disconnect, device number 3 [ 185.853081][ T4991] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 185.902709][ T126] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 185.920938][ T4991] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 185.967921][ T4991] overlayfs: missing 'lowerdir' [ 186.129099][ T126] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 186.144563][ T126] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 187.032979][ T126] usb 2-1: config 1 has no interface number 0 [ 187.063390][ T126] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 187.118205][ T126] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 187.174693][ T126] usb 2-1: config 1 interface 113 has no altsetting 0 [ 187.225040][ T126] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 187.292664][ T126] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.329642][ T126] usb 2-1: Product: syz [ 187.357055][ T126] usb 2-1: Manufacturer: syz [ 187.369749][ T126] usb 2-1: SerialNumber: syz [ 187.637845][ T4996] loop0: detected capacity change from 0 to 32768 [ 187.656566][ T126] hub 2-1:1.113: bad descriptor, ignoring hub [ 187.662914][ T126] hub: probe of 2-1:1.113 failed with error -5 [ 187.693222][ T126] usb 2-1: USB disconnect, device number 2 [ 187.818623][ T4996] XFS (loop0): Mounting V5 Filesystem [ 187.940210][ T4996] XFS (loop0): Ending clean mount [ 187.947684][ T4996] XFS (loop0): Quotacheck needed: Please wait. [ 187.990670][ T4996] XFS (loop0): Quotacheck: Done. [ 189.140053][ T4276] XFS (loop0): Unmounting Filesystem [ 189.160132][ T5019] device syzkaller0 entered promiscuous mode [ 190.121936][ T5037] loop0: detected capacity change from 0 to 512 [ 190.769099][ T5037] EXT4-fs (loop0): Test dummy encryption mode enabled [ 190.825496][ T5037] EXT4-fs (loop0): 1 truncate cleaned up [ 190.832095][ T5037] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 191.065289][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 192.402641][ T126] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 192.594322][ T126] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 193.860067][ T126] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 193.870801][ T126] usb 3-1: config 1 has no interface number 0 [ 193.877227][ T126] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 193.888717][ T126] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 193.903728][ T126] usb 3-1: config 1 interface 113 has no altsetting 0 [ 193.920135][ T126] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 193.931561][ T126] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 193.940112][ T126] usb 3-1: Product: syz [ 193.944660][ T126] usb 3-1: Manufacturer: syz [ 193.949481][ T126] usb 3-1: SerialNumber: syz [ 194.164383][ T126] hub 3-1:1.113: bad descriptor, ignoring hub [ 194.175175][ T126] hub: probe of 3-1:1.113 failed with error -5 [ 194.304733][ T126] usb 3-1: USB disconnect, device number 4 [ 194.802125][ T5068] device syzkaller0 entered promiscuous mode [ 195.256683][ T5079] loop3: detected capacity change from 0 to 256 [ 195.325472][ T5077] loop2: detected capacity change from 0 to 4096 [ 196.159068][ T5088] loop1: detected capacity change from 0 to 512 [ 196.185944][ T5088] EXT4-fs (loop1): Test dummy encryption mode enabled [ 196.874376][ T5089] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 196.914028][ T5088] EXT4-fs (loop1): 1 truncate cleaned up [ 196.919751][ T5088] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 197.336702][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 199.542956][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.549326][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 199.559835][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056157800: rx timeout, send abort [ 200.069108][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056157800: abort rx timeout. Force session deactivation [ 200.813299][ T49] Bluetooth: hci4: link tx timeout [ 200.818906][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 201.259160][ T49] Bluetooth: hci4: link tx timeout [ 201.264535][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 201.292593][ T49] Bluetooth: hci4: link tx timeout [ 201.297792][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 201.473137][ T5129] device syzkaller0 entered promiscuous mode [ 201.544436][ T49] Bluetooth: hci4: link tx timeout [ 201.549637][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 202.436455][ T49] Bluetooth: hci4: link tx timeout [ 202.443046][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 202.624660][ T49] Bluetooth: hci4: link tx timeout [ 202.629906][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 202.872735][ T49] Bluetooth: hci4: command 0x0406 tx timeout [ 203.264398][ T49] Bluetooth: hci4: link tx timeout [ 203.269674][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 203.349511][ T5136] Can't find ip_set type has [ 205.004344][ T5165] loop4: detected capacity change from 0 to 32768 [ 205.174406][ T5165] XFS (loop4): Mounting V5 Filesystem [ 205.225302][ T5165] XFS (loop4): Ending clean mount [ 205.238383][ T5165] XFS (loop4): Quotacheck needed: Please wait. [ 205.344225][ T5165] XFS (loop4): Quotacheck: Done. [ 205.526862][ T4286] XFS (loop4): Unmounting Filesystem [ 206.223036][ T5190] device syzkaller0 entered promiscuous mode [ 206.517401][ T5197] loop3: detected capacity change from 0 to 512 [ 207.172632][ T5197] EXT4-fs (loop3): Test dummy encryption mode enabled [ 207.296107][ T49] Bluetooth: hci4: link tx timeout [ 207.301447][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 207.336625][ T5197] EXT4-fs (loop3): 1 truncate cleaned up [ 207.342560][ T5197] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 207.742255][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 209.789214][ T49] Bluetooth: hci4: link tx timeout [ 209.794553][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 210.192608][ T49] Bluetooth: hci4: link tx timeout [ 210.197911][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 210.232572][ T5226] loop2: detected capacity change from 0 to 32768 [ 210.257047][ T5226] XFS (loop2): Mounting V5 Filesystem [ 210.428976][ T5226] XFS (loop2): Ending clean mount [ 210.443694][ T5226] XFS (loop2): Quotacheck needed: Please wait. [ 210.608005][ T5226] XFS (loop2): Quotacheck: Done. [ 210.652425][ T4278] XFS (loop2): Unmounting Filesystem [ 210.692656][ T14] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 210.999913][ T14] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 211.040934][ T14] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 211.107473][ T14] usb 2-1: config 1 has no interface number 0 [ 211.153490][ T14] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 211.225847][ T14] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 211.273514][ T14] usb 2-1: config 1 interface 113 has no altsetting 0 [ 211.309698][ T14] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 211.351137][ T14] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 211.381504][ T14] usb 2-1: Product: syz [ 211.422665][ T14] usb 2-1: Manufacturer: syz [ 211.440369][ T14] usb 2-1: SerialNumber: syz [ 211.502042][ T49] Bluetooth: hci4: link tx timeout [ 211.507852][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 211.697927][ T14] hub 2-1:1.113: bad descriptor, ignoring hub [ 211.711388][ T14] hub: probe of 2-1:1.113 failed with error -5 [ 211.783456][ T14] usb 2-1: USB disconnect, device number 3 [ 212.069173][ T5262] loop0: detected capacity change from 0 to 512 [ 212.086629][ T5262] EXT4-fs (loop0): Test dummy encryption mode enabled [ 212.751286][ T5262] EXT4-fs (loop0): 1 truncate cleaned up [ 212.757282][ T5262] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 212.814436][ T49] Bluetooth: hci4: link tx timeout [ 212.819767][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 212.996624][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 214.093543][ T49] Bluetooth: hci4: link tx timeout [ 214.098735][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 214.744456][ T49] Bluetooth: hci4: link tx timeout [ 214.749647][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 217.237159][ T49] Bluetooth: hci4: link tx timeout [ 217.242345][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 218.152664][ T4319] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 218.374318][ T4319] usb 4-1: config 1 has an invalid interface number: 113 but max is 0 [ 218.389963][ T5292] loop4: detected capacity change from 0 to 32768 [ 218.399544][ T4319] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 218.436771][ T4319] usb 4-1: config 1 has no interface number 0 [ 218.466216][ T4319] usb 4-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 218.682113][ T4319] usb 4-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 218.767292][ T4319] usb 4-1: config 1 interface 113 has no altsetting 0 [ 218.810490][ T5292] XFS (loop4): Mounting V5 Filesystem [ 218.820337][ T4319] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 218.893594][ T4319] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 218.957249][ T4319] usb 4-1: Product: syz [ 218.982011][ T4319] usb 4-1: Manufacturer: syz [ 219.030070][ T4319] usb 4-1: SerialNumber: syz [ 219.090752][ T5292] XFS (loop4): Ending clean mount [ 219.114198][ T5292] XFS (loop4): Quotacheck needed: Please wait. [ 219.164888][ T5292] XFS (loop4): Quotacheck: Done. [ 219.293342][ T4319] hub 4-1:1.113: bad descriptor, ignoring hub [ 219.319286][ T4319] hub: probe of 4-1:1.113 failed with error -5 [ 219.393383][ T4319] usb 4-1: USB disconnect, device number 3 [ 219.658072][ T4286] XFS (loop4): Unmounting Filesystem [ 220.070254][ T5340] device syzkaller0 entered promiscuous mode [ 220.445636][ T49] Bluetooth: hci4: link tx timeout [ 220.450875][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 220.459458][ T49] Bluetooth: hci4: link tx timeout [ 220.464751][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 220.473506][ T49] Bluetooth: hci4: link tx timeout [ 220.478646][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 220.821531][ T5346] netlink: 16 bytes leftover after parsing attributes in process `syz.1.251'. [ 221.214909][ T5353] loop4: detected capacity change from 0 to 256 [ 222.162294][ T5367] loop2: detected capacity change from 0 to 512 [ 222.613275][ T5367] EXT4-fs (loop2): Test dummy encryption mode enabled [ 223.473415][ T5367] EXT4-fs (loop2): 1 truncate cleaned up [ 223.479201][ T5367] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 223.734421][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 225.992825][ T4319] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 226.204976][ T4319] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 226.233831][ T4319] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 226.296073][ T4319] usb 2-1: config 1 has no interface number 0 [ 226.302270][ T4319] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 226.387395][ T4319] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 226.458773][ T4319] usb 2-1: config 1 interface 113 has no altsetting 0 [ 226.568563][ T5405] loop3: detected capacity change from 0 to 64 [ 226.788654][ T5405] MINIX-fs: mounting file system with errors, running fsck is recommended [ 227.182971][ T4279] Bluetooth: hci1: command 0x0406 tx timeout [ 227.190012][ T49] Bluetooth: hci0: command 0x0406 tx timeout [ 227.190461][ T4281] Bluetooth: hci3: command 0x0406 tx timeout [ 227.196770][ T49] Bluetooth: hci2: command 0x0406 tx timeout [ 227.420043][ T4319] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 227.577868][ T4319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 227.641359][ T4319] usb 2-1: Product: syz [ 227.662960][ T4319] usb 2-1: Manufacturer: syz [ 227.683570][ T4319] usb 2-1: SerialNumber: syz [ 229.156470][ T4319] hub 2-1:1.113: bad descriptor, ignoring hub [ 230.938865][ T4319] hub: probe of 2-1:1.113 failed with error -5 [ 230.973269][ T4319] usb 2-1: USB disconnect, device number 4 [ 231.036343][ T49] Bluetooth: hci4: link tx timeout [ 231.041650][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 231.206091][ T5423] device syzkaller0 entered promiscuous mode [ 231.747333][ T5425] Zero length message leads to an empty skb [ 231.849523][ T5437] loop3: detected capacity change from 0 to 256 [ 232.923404][ T5450] loop2: detected capacity change from 0 to 256 [ 234.794709][ T5463] loop1: detected capacity change from 0 to 512 [ 234.816425][ T5463] EXT4-fs (loop1): Test dummy encryption mode enabled [ 235.463241][ T5463] EXT4-fs (loop1): 1 truncate cleaned up [ 235.469071][ T5463] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 235.731069][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 236.272704][ T22] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 236.308064][ T49] Bluetooth: hci4: link tx timeout [ 236.313334][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 236.681977][ T22] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 236.718237][ T22] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 236.784417][ T22] usb 2-1: config 1 has no interface number 0 [ 236.824486][ T5456] loop0: detected capacity change from 0 to 32768 [ 236.901687][ T22] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 237.088842][ T22] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 237.439368][ T22] usb 2-1: config 1 interface 113 has no altsetting 0 [ 237.636543][ T22] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 237.677423][ T22] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 237.743562][ T22] usb 2-1: Product: syz [ 237.812209][ T22] usb 2-1: Manufacturer: syz [ 237.880818][ T22] usb 2-1: SerialNumber: syz [ 238.650021][ T22] hub 2-1:1.113: bad descriptor, ignoring hub [ 238.687926][ T22] hub: probe of 2-1:1.113 failed with error -5 [ 238.717541][ T5467] loop2: detected capacity change from 0 to 32768 [ 238.753242][ T22] usb 2-1: USB disconnect, device number 5 [ 239.821217][ T5502] loop3: detected capacity change from 0 to 256 [ 241.023931][ T5490] binder: 5489:5490 ioctl c0306201 0 returned -14 [ 241.197413][ T5499] binder: 5489:5499 ioctl c0306201 0 returned -14 [ 241.330694][ T5515] loop2: detected capacity change from 0 to 512 [ 242.006994][ T5515] EXT4-fs (loop2): Test dummy encryption mode enabled [ 242.058569][ T5515] EXT4-fs (loop2): 1 truncate cleaned up [ 242.064935][ T5515] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 242.269536][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 244.039164][ T5538] loop0: detected capacity change from 0 to 32768 [ 244.185581][ T5538] XFS (loop0): Mounting V5 Filesystem [ 244.342913][ T5538] XFS (loop0): Ending clean mount [ 244.359608][ T5538] XFS (loop0): Quotacheck needed: Please wait. [ 244.403635][ T5538] XFS (loop0): Quotacheck: Done. [ 244.532593][ T4319] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 244.742347][ T4319] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 244.771778][ T4319] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 244.811791][ T4319] usb 2-1: config 1 has no interface number 0 [ 244.849107][ T4319] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 244.893146][ T4319] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 244.956612][ T4319] usb 2-1: config 1 interface 113 has no altsetting 0 [ 244.997589][ T4319] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 245.020454][ T5529] loop4: detected capacity change from 0 to 32768 [ 245.037611][ T4319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 245.098585][ T4319] usb 2-1: Product: syz [ 245.122810][ T4319] usb 2-1: Manufacturer: syz [ 245.127498][ T4319] usb 2-1: SerialNumber: syz [ 245.172061][ T5529] XFS (loop4): Mounting V5 Filesystem [ 245.304470][ T5529] XFS (loop4): Ending clean mount [ 245.347490][ T4319] hub 2-1:1.113: bad descriptor, ignoring hub [ 245.360690][ T4319] hub: probe of 2-1:1.113 failed with error -5 [ 245.418547][ T5529] XFS (loop4): Quotacheck needed: Please wait. [ 245.443897][ T4319] usb 2-1: USB disconnect, device number 6 [ 245.506604][ T4276] XFS (loop0): Unmounting Filesystem [ 245.639642][ T5529] XFS (loop4): Quotacheck: Done. [ 246.369852][ T4286] XFS (loop4): Unmounting Filesystem [ 246.475184][ T5569] device syzkaller0 entered promiscuous mode [ 249.182924][ C0] sched: RT throttling activated [ 251.133211][ T3598] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 251.278763][ T5602] loop4: detected capacity change from 0 to 512 [ 251.327814][ T5602] EXT4-fs (loop4): Test dummy encryption mode enabled [ 251.359078][ T3598] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 251.972163][ T5602] EXT4-fs (loop4): 1 truncate cleaned up [ 251.978013][ T5602] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 252.014393][ T3598] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 252.101692][ T3598] usb 2-1: config 1 has no interface number 0 [ 252.112448][ T3598] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 252.124107][ T3598] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 252.137962][ T3598] usb 2-1: config 1 interface 113 has no altsetting 0 [ 252.170287][ T3598] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 252.328883][ T3598] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 252.390404][ T3598] usb 2-1: Product: syz [ 252.424841][ T3598] usb 2-1: Manufacturer: syz [ 252.436646][ T3598] usb 2-1: SerialNumber: syz [ 252.458798][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 252.631322][ T5610] netlink: 128 bytes leftover after parsing attributes in process `syz.4.322'. [ 252.649134][ T5610] netlink: 16 bytes leftover after parsing attributes in process `syz.4.322'. [ 252.668532][ T3598] hub 2-1:1.113: bad descriptor, ignoring hub [ 252.698041][ T3598] hub: probe of 2-1:1.113 failed with error -5 [ 252.763338][ T3598] usb 2-1: USB disconnect, device number 7 [ 254.722748][ T5606] loop2: detected capacity change from 0 to 32768 [ 254.962877][ T5606] XFS (loop2): Mounting V5 Filesystem [ 255.061977][ T5606] XFS (loop2): Ending clean mount [ 255.087756][ T5606] XFS (loop2): Quotacheck needed: Please wait. [ 255.139634][ T5628] loop4: detected capacity change from 0 to 32768 [ 255.206355][ T5606] XFS (loop2): Quotacheck: Done. [ 255.296952][ T5628] XFS (loop4): Mounting V5 Filesystem [ 255.500147][ T5628] XFS (loop4): Ending clean mount [ 255.536731][ T5628] XFS (loop4): Quotacheck needed: Please wait. [ 256.082289][ T5658] device syzkaller0 entered promiscuous mode [ 256.169246][ T5628] XFS (loop4): Quotacheck: Done. [ 256.192786][ T4278] XFS (loop2): Unmounting Filesystem [ 256.406403][ T4286] XFS (loop4): Unmounting Filesystem [ 256.784777][ T5667] loop0: detected capacity change from 0 to 512 [ 257.452275][ T5667] EXT4-fs (loop0): Test dummy encryption mode enabled [ 257.483954][ T5667] EXT4-fs (loop0): 1 truncate cleaned up [ 257.489709][ T5667] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 257.731302][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 257.854382][ T5678] device syzkaller0 entered promiscuous mode [ 258.042624][ T3598] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 258.906196][ T3598] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 258.931666][ T3598] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 258.947885][ T3598] usb 2-1: config 1 has no interface number 0 [ 258.955961][ T3598] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 259.080319][ T3598] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 259.112568][ T3598] usb 2-1: config 1 interface 113 has no altsetting 0 [ 259.144663][ T3598] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 259.154348][ T3598] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.170817][ T3598] usb 2-1: Product: syz [ 259.176424][ T3598] usb 2-1: Manufacturer: syz [ 259.181394][ T3598] usb 2-1: SerialNumber: syz [ 259.398263][ T5696] device syzkaller0 entered promiscuous mode [ 259.407103][ T3598] hub 2-1:1.113: bad descriptor, ignoring hub [ 259.429449][ T3598] hub: probe of 2-1:1.113 failed with error -5 [ 259.436878][ T5696] tipc: Started in network mode [ 259.495750][ T5696] tipc: Node identity c278de861e7e, cluster identity 4711 [ 259.521994][ T3598] usb 2-1: USB disconnect, device number 8 [ 259.535034][ T5696] tipc: Enabled bearer , priority 0 [ 259.592736][ T5695] tipc: Resetting bearer [ 260.555252][ T5695] tipc: Disabling bearer [ 260.944939][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 260.951685][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.720725][ T5713] device syzkaller0 entered promiscuous mode [ 262.456464][ T5725] loop2: detected capacity change from 0 to 512 [ 262.524043][ T5725] EXT4-fs (loop2): Test dummy encryption mode enabled [ 262.687743][ T5725] EXT4-fs (loop2): 1 truncate cleaned up [ 262.693744][ T5725] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 262.914474][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 264.019542][ T5740] device syzkaller0 entered promiscuous mode [ 264.042222][ T5711] loop1: detected capacity change from 0 to 32768 [ 264.234060][ T5711] XFS (loop1): Mounting V5 Filesystem [ 264.311604][ T5711] XFS (loop1): Ending clean mount [ 264.339826][ T5711] XFS (loop1): Quotacheck needed: Please wait. [ 264.848153][ T5711] XFS (loop1): Quotacheck: Done. [ 265.036630][ T4282] XFS (loop1): Unmounting Filesystem [ 266.382626][ T4338] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 266.712113][ T4338] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 266.734972][ T4338] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 267.313669][ T49] Bluetooth: hci4: link tx timeout [ 267.318884][ T49] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 267.328193][ T49] Bluetooth: hci4: link tx timeout [ 267.333486][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 267.385946][ T4338] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 267.507446][ T4338] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 267.572643][ T4338] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 267.766770][ T4338] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 267.776329][ T4338] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 267.784526][ T4338] usb 3-1: Product: syz [ 267.788882][ T4338] usb 3-1: Manufacturer: syz [ 268.026671][ T5781] loop1: detected capacity change from 0 to 512 [ 268.263745][ T5781] EXT4-fs (loop1): Test dummy encryption mode enabled [ 268.594851][ T4338] cdc_wdm 3-1:1.0: skipping garbage [ 268.608537][ T5781] EXT4-fs (loop1): 1 truncate cleaned up [ 268.614287][ T5781] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 268.632689][ T4338] cdc_wdm 3-1:1.0: skipping garbage [ 268.833560][ T4338] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 268.841659][ T4338] cdc_wdm 3-1:1.0: Unknown control protocol [ 268.899014][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 268.998983][ T5767] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.044755][ T5767] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.422736][ T49] Bluetooth: hci4: command 0x0406 tx timeout [ 269.881079][ T126] usb 3-1: USB disconnect, device number 5 [ 272.263593][ T5821] netlink: 36 bytes leftover after parsing attributes in process `syz.0.374'. [ 272.301608][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state [ 272.310836][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.047644][ T5851] loop0: detected capacity change from 0 to 512 [ 274.887387][ T5851] EXT4-fs (loop0): Test dummy encryption mode enabled [ 275.024713][ T5851] EXT4-fs (loop0): 1 truncate cleaned up [ 275.030459][ T5851] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 275.284259][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 275.346205][ T4315] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 275.559962][ T4315] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 275.575770][ T4315] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 275.640937][ T4315] usb 5-1: config 1 has no interface number 0 [ 275.670068][ T4315] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 275.684085][ T4315] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 275.702604][ T4315] usb 5-1: config 1 interface 113 has no altsetting 0 [ 275.759225][ T4315] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 275.771977][ T4315] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.781390][ T4315] usb 5-1: Product: syz [ 275.786164][ T4315] usb 5-1: Manufacturer: syz [ 275.791791][ T4315] usb 5-1: SerialNumber: syz [ 277.537788][ T4315] hub 5-1:1.113: bad descriptor, ignoring hub [ 278.502382][ T4315] hub: probe of 5-1:1.113 failed with error -5 [ 278.543467][ T4315] usb 5-1: USB disconnect, device number 3 [ 279.050834][ T5885] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 281.048834][ T5895] loop3: detected capacity change from 0 to 32768 [ 281.259317][ T5895] XFS (loop3): Mounting V5 Filesystem [ 281.265776][ T5905] device syzkaller0 entered promiscuous mode [ 281.336093][ T5895] XFS (loop3): Ending clean mount [ 281.400811][ T5895] XFS (loop3): Quotacheck needed: Please wait. [ 281.443076][ T5895] XFS (loop3): Quotacheck: Done. [ 282.252947][ T5914] loop4: detected capacity change from 0 to 512 [ 282.278568][ T5914] EXT4-fs (loop4): Test dummy encryption mode enabled [ 282.354468][ T5914] EXT4-fs (loop4): 1 truncate cleaned up [ 282.360281][ T5914] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 282.629231][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 282.800564][ T5893] loop1: detected capacity change from 0 to 32768 [ 282.897499][ T4272] XFS (loop3): Unmounting Filesystem [ 282.948833][ T5893] XFS (loop1): Mounting V5 Filesystem [ 283.009991][ T5919] loop2: detected capacity change from 0 to 32768 [ 283.055211][ T5893] XFS (loop1): Ending clean mount [ 283.100138][ T5893] XFS (loop1): Quotacheck needed: Please wait. [ 283.207131][ T5919] XFS (loop2): Mounting V5 Filesystem [ 283.213964][ T5893] XFS (loop1): Quotacheck: Done. [ 283.392592][ T5919] XFS (loop2): Ending clean mount [ 283.401200][ T5919] XFS (loop2): Quotacheck needed: Please wait. [ 283.464331][ T5919] XFS (loop2): Quotacheck: Done. [ 283.675632][ T4282] XFS (loop1): Unmounting Filesystem [ 283.801958][ T5946] device syzkaller0 entered promiscuous mode [ 284.146863][ T5952] loop3: detected capacity change from 0 to 256 [ 284.150896][ T4278] XFS (loop2): Unmounting Filesystem [ 286.534735][ T5973] device syzkaller0 entered promiscuous mode [ 288.218344][ T5993] loop1: detected capacity change from 0 to 256 [ 288.571317][ T5995] loop4: detected capacity change from 0 to 512 [ 288.896628][ T5995] EXT4-fs (loop4): Test dummy encryption mode enabled [ 288.922594][ T5995] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 288.982656][ T5995] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 289.095957][ T5995] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 289.135252][ T5980] loop0: detected capacity change from 0 to 32768 [ 289.164703][ T5995] EXT4-fs (loop4): 1 truncate cleaned up [ 289.176829][ T5995] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 289.301641][ T5980] XFS (loop0): Mounting V5 Filesystem [ 289.326241][ T5982] loop2: detected capacity change from 0 to 32768 [ 289.858811][ T5980] XFS (loop0): AIL initialisation failed: error -12 [ 289.983968][ T5980] XFS (loop0): log mount failed [ 290.245670][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 292.538655][ T6052] loop2: detected capacity change from 0 to 512 [ 293.292642][ T6052] EXT4-fs (loop2): Test dummy encryption mode enabled [ 293.686434][ T6052] EXT4-fs (loop2): 1 truncate cleaned up [ 293.692138][ T6052] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 293.803826][ T6057] device syzkaller0 entered promiscuous mode [ 293.975146][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 294.071042][ T6060] loop1: detected capacity change from 0 to 256 [ 295.418080][ T6072] page:ffffea00015f8000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57e00 [ 295.459519][ T6072] head:ffffea00015f8000 order:3 compound_mapcount:0 compound_pincount:0 [ 295.479797][ T6072] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 295.500074][ T6072] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff88801744c280 [ 295.520586][ T6072] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 295.540209][ T6072] page dumped because: unmovable page [ 295.552649][ T6072] page_owner tracks the page as allocated [ 295.570114][ T6072] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4278, tgid 4278 (syz-executor), ts 105200855353, free_ts 33193624744 [ 295.593358][ T4338] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 295.622624][ T6072] post_alloc_hook+0x173/0x1a0 [ 295.632973][ T6072] get_page_from_freelist+0x206b/0x2180 [ 295.648995][ T6072] __alloc_pages+0x1ec/0x4f0 [ 295.654593][ T6072] alloc_slab_page+0x5d/0x180 [ 295.669773][ T6072] new_slab+0x87/0x2d0 [ 295.674350][ T6072] ___slab_alloc+0xbc5/0x1240 [ 295.689373][ T6072] __kmem_cache_alloc_node+0x126/0x270 [ 295.699520][ T6072] kmalloc_trace+0x26/0xe0 [ 295.709679][ T6072] ipv6_add_dev+0x595/0x1110 [ 295.719829][ T6072] addrconf_notify+0x634/0xf60 [ 295.729972][ T6072] raw_notifier_call_chain+0xcb/0x160 [ 295.742573][ T6072] register_netdevice+0x16a8/0x1b80 [ 295.748162][ T6072] veth_newlink+0x66a/0xd60 [ 295.763658][ T6072] rtnl_newlink+0x14b3/0x1f90 [ 295.768719][ T6072] rtnetlink_rcv_msg+0x863/0xfb0 [ 295.782692][ T6072] netlink_rcv_skb+0x1ef/0x440 [ 295.789189][ T4338] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 295.809255][ T4338] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 295.820147][ T6072] page last free stack trace: [ 295.825514][ T6072] free_unref_page_prepare+0x8e5/0x9e0 [ 295.841388][ T4338] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 295.850822][ T6072] free_unref_page+0x2e/0x3f0 [ 295.856077][ T6072] free_contig_range+0x9d/0x150 [ 295.866004][ T4338] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 295.877537][ T6072] destroy_args+0xef/0xa0e [ 295.887530][ T6072] debug_vm_pgtable+0x33c/0x38e [ 295.897672][ T4338] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 295.909782][ T6072] do_one_initcall+0x257/0x800 [ 295.919808][ T6072] do_initcall_level+0x13d/0x1ed [ 295.930133][ T6072] do_initcalls+0x4b/0x8a [ 295.936613][ T4338] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 295.952543][ T4338] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 295.959831][ T6072] kernel_init_freeable+0x401/0x5ab [ 295.965893][ T4338] usb 2-1: Product: syz [ 295.965938][ T4338] usb 2-1: Manufacturer: syz [ 295.976318][ T6064] loop0: detected capacity change from 0 to 32768 [ 295.983552][ T6072] kernel_init+0x19/0x1b0 [ 296.002683][ T4338] cdc_wdm 2-1:1.0: skipping garbage [ 296.014120][ T6072] ret_from_fork+0x1f/0x30 [ 296.018381][ T4338] cdc_wdm 2-1:1.0: skipping garbage [ 296.053570][ T4338] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 296.062667][ T4338] cdc_wdm 2-1:1.0: Unknown control protocol [ 296.090841][ T6064] XFS (loop0): Mounting V5 Filesystem [ 296.104464][ T6075] loop4: detected capacity change from 0 to 32768 [ 296.200978][ T4338] usb 2-1: USB disconnect, device number 9 [ 296.272160][ T6075] XFS (loop4): Mounting V5 Filesystem [ 296.279761][ T6064] XFS (loop0): Ending clean mount [ 296.313210][ T6064] XFS (loop0): Quotacheck needed: Please wait. [ 296.375732][ T6075] XFS (loop4): Ending clean mount [ 296.387199][ T6064] XFS (loop0): Quotacheck: Done. [ 296.398819][ T6075] XFS (loop4): Quotacheck needed: Please wait. [ 296.467890][ T6075] XFS (loop4): Quotacheck: Done. [ 296.787948][ T4276] XFS (loop0): Unmounting Filesystem [ 296.900301][ T6107] loop2: detected capacity change from 0 to 2048 [ 296.920063][ T4286] XFS (loop4): Unmounting Filesystem [ 297.002326][ T6107] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 297.273649][ T6111] loop1: detected capacity change from 0 to 512 [ 297.392892][ T6111] EXT4-fs (loop1): Test dummy encryption mode enabled [ 297.476123][ T6111] EXT4-fs (loop1): 1 truncate cleaned up [ 297.481866][ T6111] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 298.019585][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 298.433799][ T6078] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 299.860496][ T6129] device syzkaller0 entered promiscuous mode [ 300.031444][ T6132] device syzkaller0 entered promiscuous mode [ 300.059601][ T6132] tipc: Enabling of bearer rejected, failed to enable media [ 300.321463][ T6116] loop1: detected capacity change from 0 to 32768 [ 300.496217][ T6116] XFS (loop1): Mounting V5 Filesystem [ 300.521452][ T6148] loop2: detected capacity change from 0 to 4096 [ 300.671922][ T6157] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 300.689472][ T6116] XFS (loop1): Ending clean mount [ 300.824749][ T6148] NILFS (loop2): nilfs_sufile_do_free: segment 9 is already clean [ 300.955450][ T4282] XFS (loop1): Unmounting Filesystem [ 301.442175][ T6161] loop0: detected capacity change from 0 to 512 [ 301.452315][ T6161] EXT4-fs (loop0): Test dummy encryption mode enabled [ 301.579633][ T6161] EXT4-fs (loop0): 1 truncate cleaned up [ 301.585911][ T6161] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 301.630610][ T6140] loop3: detected capacity change from 0 to 32768 [ 301.756902][ T6140] XFS (loop3): Mounting V5 Filesystem [ 301.889211][ T6140] XFS (loop3): Ending clean mount [ 301.947134][ T6140] XFS (loop3): Quotacheck needed: Please wait. [ 302.563858][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 303.164045][ T6140] XFS (loop3): Quotacheck: Done. [ 303.786173][ T4272] XFS (loop3): Unmounting Filesystem [ 303.969431][ T6188] device syzkaller0 entered promiscuous mode [ 304.151724][ T6177] loop1: detected capacity change from 0 to 32768 [ 304.320946][ T6177] XFS (loop1): Mounting V5 Filesystem [ 304.465293][ T6177] XFS (loop1): Ending clean mount [ 304.583167][ T6177] XFS (loop1): Quotacheck needed: Please wait. [ 304.710679][ T6177] XFS (loop1): Quotacheck: Done. [ 304.809674][ T6204] device syzkaller0 entered promiscuous mode [ 304.883276][ T6204] tipc: Enabling of bearer rejected, failed to enable media [ 306.755601][ T6211] loop4: detected capacity change from 0 to 1024 [ 306.763783][ T6211] EXT4-fs: Ignoring removed bh option [ 306.769285][ T6211] EXT4-fs: Ignoring removed bh option [ 306.836874][ T6211] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 306.890413][ T4282] XFS (loop1): Unmounting Filesystem [ 306.933371][ T6211] EXT4-fs (loop4): re-mounted. Quota mode: none. [ 307.138827][ T4286] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /92/control/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 307.267003][ T4286] EXT4-fs error (device loop4): ext4_read_inline_dir:1619: inode #12: block 7: comm syz-executor: path /92/control/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=80 fake=0 [ 307.402155][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 307.474459][ T6224] loop0: detected capacity change from 0 to 512 [ 307.484944][ T6224] EXT4-fs (loop0): Test dummy encryption mode enabled [ 308.383935][ T6224] EXT4-fs (loop0): 1 truncate cleaned up [ 308.390372][ T6224] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 308.620264][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 308.654983][ T6235] loop4: detected capacity change from 0 to 256 [ 308.966028][ T6223] loop3: detected capacity change from 0 to 32768 [ 309.640509][ T6223] XFS (loop3): Mounting V5 Filesystem [ 309.755516][ T6245] Can't find ip_set type has [ 309.836665][ T6223] XFS (loop3): Ending clean mount [ 309.863280][ T6223] XFS (loop3): Quotacheck needed: Please wait. [ 309.936018][ T6223] XFS (loop3): Quotacheck: Done. [ 312.155244][ T4272] XFS (loop3): Unmounting Filesystem [ 312.454206][ T6252] loop4: detected capacity change from 0 to 32768 [ 312.693997][ T6269] loop0: detected capacity change from 0 to 4096 [ 313.152871][ T6269] device gtp0 entered promiscuous mode [ 313.203666][ T6278] loop1: detected capacity change from 0 to 512 [ 313.221299][ T6278] EXT4-fs (loop1): Test dummy encryption mode enabled [ 313.249349][ T6278] EXT4-fs (loop1): 1 truncate cleaned up [ 313.255321][ T6278] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 313.286682][ T6280] device syzkaller0 entered promiscuous mode [ 313.325924][ T6280] tipc: Enabling of bearer rejected, failed to enable media [ 313.520835][ T26] audit: type=1800 audit(1787274615.815:2): pid=6269 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.480" name="file1" dev="loop0" ino=33 res=0 errno=0 [ 314.112978][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 314.243626][ T6292] loop1: detected capacity change from 0 to 256 [ 314.352604][ T14] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 314.647278][ T14] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 314.799339][ T14] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 314.852610][ T14] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 314.861689][ T14] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 314.882258][ T14] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 314.961607][ T14] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 314.997920][ T14] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 315.045491][ T14] usb 4-1: Product: syz [ 315.090852][ T14] usb 4-1: Manufacturer: syz [ 315.498900][ T14] cdc_wdm 4-1:1.0: skipping garbage [ 315.544543][ T14] cdc_wdm 4-1:1.0: skipping garbage [ 315.653945][ T14] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 315.692700][ T14] cdc_wdm 4-1:1.0: Unknown control protocol [ 316.009059][ T6303] netlink: 8 bytes leftover after parsing attributes in process `syz.0.490'. [ 316.123611][ T6286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 316.132366][ T6286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 316.331039][ T6313] device syzkaller0 entered promiscuous mode [ 316.342946][ T6313] tipc: Enabling of bearer rejected, failed to enable media [ 316.447934][ T6300] loop4: detected capacity change from 0 to 32768 [ 316.583354][ T6300] XFS (loop4): Mounting V5 Filesystem [ 316.590070][ T14] usb 4-1: USB disconnect, device number 4 [ 316.785280][ T6300] XFS (loop4): Ending clean mount [ 316.800200][ T6300] XFS (loop4): Quotacheck needed: Please wait. [ 316.837560][ T6329] loop0: detected capacity change from 0 to 512 [ 316.850034][ T6329] EXT4-fs (loop0): Test dummy encryption mode enabled [ 316.894712][ T6329] EXT4-fs (loop0): 1 truncate cleaned up [ 316.900589][ T6329] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 316.937710][ T6300] XFS (loop4): Quotacheck: Done. [ 317.537407][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 317.744755][ T49] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 317.753723][ T49] Bluetooth: hci1: Injecting HCI hardware error event [ 317.763392][ T4281] Bluetooth: hci1: hardware error 0x00 [ 318.510181][ T4286] XFS (loop4): Unmounting Filesystem [ 318.533946][ T6344] loop0: detected capacity change from 0 to 256 [ 320.101476][ T6354] netlink: 16 bytes leftover after parsing attributes in process `syz.0.506'. [ 320.485323][ T6359] device syzkaller0 entered promiscuous mode [ 320.510589][ T6359] tipc: Enabling of bearer rejected, failed to enable media [ 320.752829][ T4281] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 321.285464][ T4338] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 321.475367][ T6365] device syzkaller0 entered promiscuous mode [ 321.495461][ T4338] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 321.512542][ T4338] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 321.534171][ T6365] tipc: Started in network mode [ 321.539125][ T6365] tipc: Node identity 32a5bf05de64, cluster identity 4711 [ 321.555731][ T4338] usb 4-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 321.574686][ T6365] tipc: Enabled bearer , priority 0 [ 321.582883][ T4338] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.590988][ T4338] usb 4-1: Product: syz [ 321.612819][ T6367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.510'. [ 321.624552][ T4338] usb 4-1: Manufacturer: syz [ 321.652297][ T4338] usb 4-1: SerialNumber: syz [ 321.673149][ T4338] usb 4-1: config 0 descriptor?? [ 321.679182][ T6364] tipc: Resetting bearer [ 321.764532][ T6364] tipc: Disabling bearer [ 322.093966][ T6378] loop2: detected capacity change from 0 to 512 [ 322.108335][ T6378] EXT4-fs (loop2): Test dummy encryption mode enabled [ 322.168629][ T6378] EXT4-fs (loop2): 1 truncate cleaned up [ 322.174594][ T6378] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 322.207502][ T5875] usb 4-1: USB disconnect, device number 5 [ 322.385009][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.391512][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.797699][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 325.634953][ T6405] device syzkaller0 entered promiscuous mode [ 325.656421][ T6405] tipc: Enabling of bearer rejected, failed to enable media [ 325.822310][ T6408] netlink: 8 bytes leftover after parsing attributes in process `syz.3.524'. [ 325.938797][ T6410] loop2: detected capacity change from 0 to 1024 [ 326.010174][ T6410] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 326.280551][ T6417] loop3: detected capacity change from 0 to 512 [ 326.290606][ T6417] EXT4-fs (loop3): Test dummy encryption mode enabled [ 326.339518][ T6417] EXT4-fs (loop3): 1 truncate cleaned up [ 326.345501][ T6417] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 327.045919][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 327.425049][ T6432] loop1: detected capacity change from 0 to 64 [ 327.452964][ T6432] MINIX-fs: mounting file system with errors, running fsck is recommended [ 328.167970][ T6435] loop3: detected capacity change from 0 to 512 [ 328.249319][ T6435] EXT4-fs (loop3): Test dummy encryption mode enabled [ 328.257469][ T6435] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 328.285065][ T6435] EXT4-fs (loop3): 1 truncate cleaned up [ 328.292308][ T6435] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 328.333875][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 328.531920][ T6440] loop0: detected capacity change from 0 to 2048 [ 328.641517][ T6440] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 331.008583][ T4281] Bluetooth: hci4: link tx timeout [ 331.014050][ T4281] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 331.023334][ T4281] Bluetooth: hci4: link tx timeout [ 331.028670][ T4281] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 331.658866][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 332.046655][ T6473] device syzkaller0 entered promiscuous mode [ 336.693789][ T6506] loop4: detected capacity change from 0 to 1024 [ 336.739839][ T6511] loop0: detected capacity change from 0 to 512 [ 336.748823][ T6511] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 336.766240][ T6511] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 336.777122][ T6511] EXT4-fs (loop0): can't mount with commit=1, fs mounted w/o journal [ 336.787032][ T6506] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 336.851279][ T6515] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 337.040614][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 337.854436][ T6522] loop1: detected capacity change from 0 to 256 [ 343.601931][ T6559] loop1: detected capacity change from 0 to 2048 [ 343.828458][ T6559] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 344.172680][ T4281] Bluetooth: hci3: Ignoring connect complete event for invalid link type [ 345.474131][ T6590] loop4: detected capacity change from 0 to 2048 [ 345.550137][ T6590] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 345.630294][ T6596] device syzkaller0 entered promiscuous mode [ 351.223781][ T6652] netlink: 32 bytes leftover after parsing attributes in process `syz.4.584'. [ 351.545470][ T6659] loop4: detected capacity change from 0 to 2048 [ 351.555092][ T6657] loop2: detected capacity change from 0 to 4096 [ 351.613035][ T6659] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 351.724186][ T6657] device gtp0 entered promiscuous mode [ 351.903086][ T26] audit: type=1800 audit(1787274654.205:3): pid=6657 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.587" name="file1" dev="loop2" ino=33 res=0 errno=0 [ 352.025116][ T6668] loop3: detected capacity change from 0 to 512 [ 352.050414][ T6665] loop1: detected capacity change from 0 to 2048 [ 352.060275][ T6668] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 352.132897][ T6668] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 352.160531][ T6665] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 352.194598][ T6668] EXT4-fs (loop3): can't mount with commit=1, fs mounted w/o journal [ 353.392185][ T6672] netlink: 16 bytes leftover after parsing attributes in process `syz.4.592'. [ 353.807648][ T6679] loop1: detected capacity change from 0 to 32768 [ 353.848376][ T6679] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.594 (6679) [ 353.946170][ T6679] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 353.979287][ T6679] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 354.014703][ T6679] BTRFS info (device loop1): turning on sync discard [ 354.037288][ T6679] BTRFS info (device loop1): use zlib compression, level 3 [ 354.062546][ T6679] BTRFS info (device loop1): turning off barriers [ 354.086267][ T6679] BTRFS warning (device loop1): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 354.134226][ T6679] BTRFS info (device loop1): trying to use backup root at mount time [ 354.173457][ T6679] BTRFS info (device loop1): force clearing of disk cache [ 354.194150][ T6679] BTRFS info (device loop1): enabling auto defrag [ 354.208744][ T6679] BTRFS info (device loop1): max_inline at 0 [ 354.222729][ T6679] BTRFS info (device loop1): using free space tree [ 354.291279][ T6689] loop3: detected capacity change from 0 to 32768 [ 354.444280][ T4375] BTRFS warning (device loop1): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0xc926492d level 0 [ 354.474139][ T6689] XFS (loop3): Mounting V5 Filesystem [ 354.509639][ T6679] BTRFS error (device loop1): failed to load root extent [ 354.517266][ T6679] BTRFS warning (device loop1): try to load backup roots slot 1 [ 354.527339][ T4375] BTRFS warning (device loop1): checksum verify failed on logical 5324800 mirror 1 wanted 0x9f73850b found 0x80379423 level 0 [ 354.540982][ T6679] BTRFS warning (device loop1): couldn't read tree root [ 354.549804][ T6679] BTRFS warning (device loop1): try to load backup roots slot 2 [ 354.558869][ T6679] BTRFS error (device loop1): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7 [ 354.633192][ T6732] loop0: detected capacity change from 0 to 2048 [ 354.655311][ T6679] BTRFS warning (device loop1): couldn't read tree root [ 354.663973][ T6679] BTRFS warning (device loop1): try to load backup roots slot 3 [ 354.673771][ T6689] XFS (loop3): Ending clean mount [ 354.696327][ T6732] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 354.712701][ T6689] XFS (loop3): Quotacheck needed: Please wait. [ 354.780334][ T6689] XFS (loop3): Quotacheck: Done. [ 354.830798][ T6679] BTRFS info (device loop1): enabling ssd optimizations [ 354.884983][ T6679] BTRFS info (device loop1): rebuilding free space tree [ 354.973943][ T4272] XFS (loop3): Unmounting Filesystem [ 355.266399][ T6679] BTRFS info (device loop1): checking UUID tree [ 355.530214][ T4282] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 357.165783][ T4281] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 357.174575][ T4281] Bluetooth: hci2: Injecting HCI hardware error event [ 357.212636][ T49] Bluetooth: hci2: hardware error 0x00 [ 358.446284][ T6757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.613'. [ 358.669255][ T6768] loop1: detected capacity change from 0 to 512 [ 358.693194][ T6769] loop4: detected capacity change from 0 to 2048 [ 358.722126][ T6768] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 358.739575][ T6769] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 358.785968][ T6768] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 358.831410][ T6768] EXT4-fs (loop1): can't mount with commit=1, fs mounted w/o journal [ 359.542663][ T49] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 361.668965][ T6788] sctp: failed to load transform for md5: -2 [ 361.861932][ T6798] loop0: detected capacity change from 0 to 2048 [ 362.073722][ T6802] loop3: detected capacity change from 0 to 512 [ 362.088305][ T6802] EXT4-fs (loop3): Test dummy encryption mode enabled [ 362.257940][ T6802] EXT4-fs (loop3): 1 truncate cleaned up [ 362.263815][ T6802] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 362.394385][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 362.802561][ T6809] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 363.775600][ T6809] NILFS (loop0): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 363.803105][ T6809] NILFS error (device loop0): nilfs_bmap_propagate: broken bmap (inode number=4) [ 364.769398][ T6809] Remounting filesystem read-only [ 364.794224][ T4276] NILFS (loop0): disposed unprocessed dirty file(s) when stopping log writer [ 366.991099][ T6844] loop2: detected capacity change from 0 to 512 [ 367.314228][ T6844] EXT4-fs (loop2): Test dummy encryption mode enabled [ 367.396682][ T6844] EXT4-fs (loop2): 1 truncate cleaned up [ 367.402687][ T6844] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 367.500234][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 369.047602][ T6841] loop3: detected capacity change from 0 to 32768 [ 369.112762][ T6841] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.636 (6841) [ 369.137705][ T6854] loop4: detected capacity change from 0 to 2048 [ 369.188970][ T6841] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 369.217537][ T6854] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 369.296434][ T6841] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 369.405125][ T6841] BTRFS info (device loop3): enabling auto defrag [ 369.548880][ T6841] BTRFS info (device loop3): use no compression [ 369.721794][ T6841] BTRFS info (device loop3): force clearing of disk cache [ 369.899702][ T6841] BTRFS info (device loop3): max_inline at 4096 [ 370.059313][ T6841] BTRFS info (device loop3): disabling free space tree [ 370.264145][ T6841] BTRFS error (device loop3): open_ctree failed: -12 [ 371.191701][ T6515] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by udevd (6515) [ 373.904158][ T6904] loop4: detected capacity change from 0 to 16 [ 374.072372][ T6904] erofs: (device loop4): mounted with root inode @ nid 36. [ 375.994905][ T6913] Can't find ip_set type has [ 377.456353][ T6924] loop2: detected capacity change from 0 to 2048 [ 377.601531][ T6924] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 378.766220][ T6926] loop4: detected capacity change from 0 to 2048 [ 378.820660][ T6926] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 379.232527][ T3598] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 380.755481][ T6936] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 380.835116][ T3598] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 380.888090][ T3598] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 380.915810][ T3598] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 380.932595][ T3598] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 380.945579][ T3598] usb 4-1: config 0 descriptor?? [ 382.021956][ T3598] cm6533_jd 0003:0D8C:0022.0001: unknown main item tag 0x0 [ 382.048270][ T3598] cm6533_jd 0003:0D8C:0022.0001: unknown main item tag 0x0 [ 382.065205][ T3598] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0D8C:0022.0001/input/input5 [ 382.197865][ T3598] cm6533_jd 0003:0D8C:0022.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.3-1/input0 [ 382.301962][ T14] usb 4-1: USB disconnect, device number 6 [ 383.713647][ T6964] loop2: detected capacity change from 0 to 4096 [ 383.828127][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 383.834575][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 383.866639][ T6969] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 383.906736][ T6955] fido_id[6955]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 389.657431][ T7003] loop4: detected capacity change from 0 to 256 [ 390.896486][ T6984] IPVS: Error connecting to the multicast addr [ 395.175327][ T7028] Can't find ip_set type has [ 395.973361][ T49] Bluetooth: hci4: link tx timeout [ 395.978736][ T49] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 395.992657][ T49] Bluetooth: hci4: link tx timeout [ 395.997821][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 398.797882][ T7064] netlink: 16 bytes leftover after parsing attributes in process `syz.2.691'. [ 404.377968][ T7085] loop0: detected capacity change from 0 to 32768 [ 404.478881][ T7085] XFS (loop0): Mounting V5 Filesystem [ 404.567524][ T7085] XFS (loop0): Ending clean mount [ 406.064641][ T4314] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 406.184364][ T4276] XFS (loop0): Unmounting Filesystem [ 406.252877][ T7117] loop2: detected capacity change from 0 to 2048 [ 406.256379][ T4314] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 406.291099][ T4314] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 406.340386][ T4314] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 406.365090][ T7117] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 406.381021][ T4314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.418683][ T4314] usb 5-1: Product: syz [ 406.442744][ T4314] usb 5-1: Manufacturer: syz [ 406.447575][ T4314] usb 5-1: SerialNumber: syz [ 406.483087][ T4314] usb 5-1: config 0 descriptor?? [ 408.652311][ T14] usb 5-1: USB disconnect, device number 4 [ 409.828142][ T7132] loop4: detected capacity change from 0 to 512 [ 409.836037][ T7132] EXT4-fs (loop4): Test dummy encryption mode enabled [ 409.870963][ T7132] EXT4-fs (loop4): 1 truncate cleaned up [ 409.876959][ T7132] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 412.327236][ T7149] loop3: detected capacity change from 0 to 2048 [ 413.579013][ T7156] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 414.644765][ T7156] NILFS (loop3): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 414.713481][ T7156] NILFS error (device loop3): nilfs_bmap_propagate: broken bmap (inode number=4) [ 414.778667][ T7156] Remounting filesystem read-only [ 414.788442][ T4272] NILFS (loop3): disposed unprocessed dirty file(s) when stopping log writer [ 415.917350][ T7163] loop1: detected capacity change from 0 to 2048 [ 415.978231][ T7163] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 417.549197][ T7179] netlink: 16 bytes leftover after parsing attributes in process `syz.1.723'. [ 418.420149][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 418.678753][ T7183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 418.689636][ T7183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 418.699129][ T7183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 418.710101][ T7183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 418.719414][ T7183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.724'. [ 419.655823][ T7187] loop0: detected capacity change from 0 to 2048 [ 419.885001][ T7187] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 419.928335][ T7196] loop4: detected capacity change from 0 to 2048 [ 419.991072][ T7197] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 420.468686][ T7201] loop0: detected capacity change from 0 to 2048 [ 420.674216][ T7201] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 422.742745][ T7217] loop3: detected capacity change from 0 to 512 [ 424.084446][ T7217] EXT4-fs (loop3): Test dummy encryption mode enabled [ 424.101134][ T7217] EXT4-fs (loop3): 1 truncate cleaned up [ 424.106979][ T7217] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 428.979813][ T7268] loop1: detected capacity change from 0 to 2048 [ 429.108371][ T7272] netlink: 16 bytes leftover after parsing attributes in process `syz.0.749'. [ 429.237269][ T7268] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 431.064430][ T7279] sctp: failed to load transform for md5: -2 [ 431.110426][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 431.315420][ T7293] loop4: detected capacity change from 0 to 2048 [ 431.504016][ T7298] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 434.052160][ T7326] netlink: 16 bytes leftover after parsing attributes in process `syz.0.762'. [ 434.960313][ T7331] loop0: detected capacity change from 0 to 2048 [ 435.100532][ T7331] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 436.135861][ T7344] loop1: detected capacity change from 0 to 512 [ 436.147534][ T7344] EXT4-fs (loop1): Test dummy encryption mode enabled [ 436.186894][ T7344] EXT4-fs (loop1): 1 truncate cleaned up [ 436.192830][ T7344] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 437.276368][ T7350] sctp: failed to load transform for md5: -2 [ 439.772182][ T7377] loop4: detected capacity change from 0 to 2048 [ 439.912621][ T7388] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 440.156412][ T7394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.777'. [ 441.152507][ T7] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 441.344435][ T7] usb 4-1: config 1 has an invalid interface number: 113 but max is 0 [ 441.369129][ T7] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 441.424014][ T7] usb 4-1: config 1 has no interface number 0 [ 441.467204][ T7] usb 4-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 441.532561][ T7] usb 4-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 441.579528][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 441.598552][ T7] usb 4-1: config 1 interface 113 has no altsetting 0 [ 441.646379][ T7] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 441.682716][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 441.690788][ T7] usb 4-1: Product: syz [ 441.716254][ T7] usb 4-1: Manufacturer: syz [ 441.720935][ T7] usb 4-1: SerialNumber: syz [ 441.988040][ T7] hub 4-1:1.113: bad descriptor, ignoring hub [ 442.219236][ T7] hub: probe of 4-1:1.113 failed with error -5 [ 442.933026][ T7] usb 4-1: USB disconnect, device number 7 [ 446.057349][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 446.072599][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 448.888949][ T7453] device syzkaller0 entered promiscuous mode [ 452.024173][ T4314] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 452.890448][ T7499] loop0: detected capacity change from 0 to 512 [ 452.934576][ T7499] EXT4-fs (loop0): Test dummy encryption mode enabled [ 452.976281][ T4314] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 452.998323][ T7499] EXT4-fs (loop0): 1 truncate cleaned up [ 453.004160][ T7499] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 453.029462][ T4314] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 453.105916][ T4314] usb 5-1: config 1 has no interface number 0 [ 453.126062][ T4314] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 453.142583][ T4314] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 453.156456][ T4314] usb 5-1: config 1 interface 113 has no altsetting 0 [ 453.175426][ T4314] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 453.222515][ T4314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 453.262635][ T4314] usb 5-1: Product: syz [ 453.282509][ T4314] usb 5-1: Manufacturer: syz [ 453.308581][ T4314] usb 5-1: SerialNumber: syz [ 453.543017][ T4314] hub 5-1:1.113: bad descriptor, ignoring hub [ 453.549221][ T4314] hub: probe of 5-1:1.113 failed with error -5 [ 453.763109][ T4314] usb 5-1: USB disconnect, device number 5 [ 457.910779][ T7533] device syzkaller0 entered promiscuous mode [ 458.001494][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 460.560817][ T49] Bluetooth: hci4: link tx timeout [ 460.566418][ T49] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 460.574964][ T49] Bluetooth: hci4: link tx timeout [ 460.580882][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 462.202868][ T7475] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 462.802648][ T7572] device syzkaller0 entered promiscuous mode [ 462.844124][ T7475] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 462.877494][ T7475] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 462.901922][ T7475] usb 3-1: config 1 has no interface number 0 [ 464.412432][ T7475] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 464.506070][ T7475] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 465.372735][ T7475] usb 3-1: config 1 interface 113 has no altsetting 0 [ 465.528966][ T7475] usb 3-1: string descriptor 0 read error: -71 [ 465.540148][ T7475] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 465.550236][ T7475] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.561004][ T7475] usb 3-1: can't set config #1, error -71 [ 465.571049][ T7475] usb 3-1: USB disconnect, device number 6 [ 466.071877][ T7605] device syzkaller0 entered promiscuous mode [ 466.086095][ T7605] tipc: Enabled bearer , priority 0 [ 466.098042][ T7604] tipc: Resetting bearer [ 466.141293][ T7608] loop2: detected capacity change from 0 to 512 [ 466.152800][ T7608] EXT4-fs (loop2): Test dummy encryption mode enabled [ 466.219364][ T7604] tipc: Disabling bearer [ 466.245682][ T7608] EXT4-fs (loop2): 1 truncate cleaned up [ 466.251428][ T7608] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 471.536600][ T7643] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 471.640302][ T7646] device syzkaller0 entered promiscuous mode [ 471.932566][ T4338] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 472.139533][ T7651] device syzkaller0 entered promiscuous mode [ 472.160537][ T4338] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 472.178992][ T4338] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 472.200035][ T7652] tipc: Started in network mode [ 472.220113][ T4338] usb 2-1: config 1 has no interface number 0 [ 472.226944][ T7652] tipc: Node identity ba6b083794c3, cluster identity 4711 [ 472.227400][ T7652] tipc: Enabled bearer , priority 0 [ 472.272506][ T4338] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 472.309773][ T7650] tipc: Resetting bearer [ 472.322251][ T4338] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 472.364278][ T4338] usb 2-1: config 1 interface 113 has no altsetting 0 [ 472.400821][ T4338] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 472.414062][ T7650] tipc: Disabling bearer [ 472.420261][ T4338] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.444691][ T4338] usb 2-1: Product: syz [ 472.449029][ T4338] usb 2-1: Manufacturer: syz [ 472.477002][ T4338] usb 2-1: SerialNumber: syz [ 472.539243][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 472.696200][ T4338] hub 2-1:1.113: bad descriptor, ignoring hub [ 472.718586][ T4338] hub: probe of 2-1:1.113 failed with error -5 [ 472.838676][ T4338] usb 2-1: USB disconnect, device number 10 [ 477.481062][ T7696] Can't find ip_set type has [ 477.622118][ T7702] device syzkaller0 entered promiscuous mode [ 478.063772][ T7710] loop0: detected capacity change from 0 to 512 [ 478.080002][ T7710] EXT4-fs (loop0): Test dummy encryption mode enabled [ 478.168470][ T7710] EXT4-fs (loop0): 1 truncate cleaned up [ 478.174409][ T7710] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 479.351348][ T7722] device syzkaller0 entered promiscuous mode [ 480.892568][ T4314] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 482.442795][ T4314] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 482.451094][ T4314] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 482.619729][ T4314] usb 3-1: config 1 has no interface number 0 [ 482.626136][ T4314] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 482.638292][ T4314] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 482.652550][ T4314] usb 3-1: config 1 interface 113 has no altsetting 0 [ 482.666458][ T4314] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 482.676192][ T4314] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.684336][ T4314] usb 3-1: Product: syz [ 482.688546][ T4314] usb 3-1: Manufacturer: syz [ 482.693300][ T4314] usb 3-1: SerialNumber: syz [ 483.036765][ T4314] hub 3-1:1.113: bad descriptor, ignoring hub [ 483.046143][ T4314] hub: probe of 3-1:1.113 failed with error -5 [ 483.154303][ T4314] usb 3-1: USB disconnect, device number 7 [ 483.383550][ T7758] device syzkaller0 entered promiscuous mode [ 483.418459][ T7758] tipc: Enabled bearer , priority 0 [ 483.701208][ T7756] tipc: Resetting bearer [ 483.885452][ T7756] tipc: Disabling bearer [ 483.952111][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 484.986533][ T7776] device syzkaller0 entered promiscuous mode [ 486.577824][ T7791] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 489.138637][ T4315] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 490.152725][ T4315] usb 3-1: device descriptor read/all, error -71 [ 490.227745][ T7809] Can't find ip_set type has [ 490.280702][ T7813] device syzkaller0 entered promiscuous mode [ 490.372536][ T7813] tipc: Enabled bearer , priority 0 [ 490.423246][ T7813] tipc: Resetting bearer [ 491.159234][ T7812] tipc: Resetting bearer [ 491.268263][ T7812] tipc: Disabling bearer [ 492.758833][ T7840] device syzkaller0 entered promiscuous mode [ 498.934430][ T7881] device syzkaller0 entered promiscuous mode [ 499.149833][ T7881] tipc: Started in network mode [ 499.157556][ T7881] tipc: Node identity 32b45e50028e, cluster identity 4711 [ 499.167863][ T7881] tipc: Enabled bearer , priority 0 [ 499.482715][ T7880] tipc: Resetting bearer [ 501.147610][ T7880] tipc: Disabling bearer [ 501.206541][ T27] tipc: Node number set to 809131600 [ 501.276292][ T7900] device syzkaller0 entered promiscuous mode [ 503.465283][ T7917] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 503.802525][ T7625] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 505.515145][ T7625] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 505.534142][ T7625] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 505.544632][ T7625] usb 2-1: config 1 has no interface number 0 [ 505.550755][ T7625] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 505.604498][ T7625] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 505.669437][ T7625] usb 2-1: config 1 interface 113 has no altsetting 0 [ 505.699714][ T7625] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 505.717154][ T7625] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.727649][ T7625] usb 2-1: Product: syz [ 505.731880][ T7625] usb 2-1: Manufacturer: syz [ 505.741847][ T7625] usb 2-1: SerialNumber: syz [ 505.790974][ T7937] loop4: detected capacity change from 0 to 512 [ 505.834268][ T7937] EXT4-fs (loop4): Test dummy encryption mode enabled [ 506.931673][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 507.397516][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 507.462003][ T7937] EXT4-fs: failed to create workqueue [ 507.467648][ T7937] EXT4-fs (loop4): mount failed [ 507.495455][ T7625] hub 2-1:1.113: bad descriptor, ignoring hub [ 507.501642][ T7625] hub: probe of 2-1:1.113 failed with error -5 [ 507.573328][ T7625] usb 2-1: USB disconnect, device number 11 [ 507.794904][ T7949] device syzkaller0 entered promiscuous mode [ 509.446834][ T7967] device syzkaller0 entered promiscuous mode [ 510.332655][ T7967] tipc: Enabled bearer , priority 0 [ 510.391804][ T7973] tipc: Resetting bearer [ 510.451884][ T7966] tipc: Resetting bearer [ 510.539419][ T7966] tipc: Disabling bearer [ 514.152583][ T7475] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 514.364993][ T7475] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 514.435488][ T7475] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 514.465943][ T7475] usb 5-1: config 1 has no interface number 0 [ 514.475266][ T7475] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 514.491562][ T7475] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 514.510811][ T7475] usb 5-1: config 1 interface 113 has no altsetting 0 [ 514.538643][ T7475] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 514.574600][ T7475] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.609059][ T7475] usb 5-1: Product: syz [ 514.631475][ T7475] usb 5-1: Manufacturer: syz [ 514.652139][ T7475] usb 5-1: SerialNumber: syz [ 514.886042][ T7475] hub 5-1:1.113: bad descriptor, ignoring hub [ 514.899464][ T7475] hub: probe of 5-1:1.113 failed with error -5 [ 515.023364][ T7475] usb 5-1: USB disconnect, device number 6 [ 516.099101][ T8015] device syzkaller0 entered promiscuous mode [ 516.146680][ T8015] tipc: Enabled bearer , priority 0 [ 516.188584][ T8015] tipc: Resetting bearer [ 517.003604][ T8014] tipc: Resetting bearer [ 517.053614][ T8014] tipc: Disabling bearer [ 517.121501][ T8025] device syzkaller0 entered promiscuous mode [ 521.857344][ T8064] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 522.232529][ T8048] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 522.466265][ T8048] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 522.484318][ T8048] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 522.546667][ T8048] usb 2-1: config 1 has no interface number 0 [ 522.578054][ T8048] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 522.617941][ T8048] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 522.680023][ T8048] usb 2-1: config 1 interface 113 has no altsetting 0 [ 522.763815][ T8048] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 522.822427][ T8048] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.862468][ T8048] usb 2-1: Product: syz [ 522.871301][ T8048] usb 2-1: Manufacturer: syz [ 522.887484][ T8048] usb 2-1: SerialNumber: syz [ 523.178809][ T8048] hub 2-1:1.113: bad descriptor, ignoring hub [ 523.779744][ T8048] hub: probe of 2-1:1.113 failed with error -5 [ 523.824367][ T8048] usb 2-1: USB disconnect, device number 12 [ 523.840892][ T8073] device syzkaller0 entered promiscuous mode [ 523.887653][ T8073] tipc: Enabled bearer , priority 0 [ 523.991259][ T8073] tipc: Resetting bearer [ 524.015752][ T8072] tipc: Resetting bearer [ 524.089655][ T8072] tipc: Disabling bearer [ 524.701380][ T8087] device syzkaller0 entered promiscuous mode [ 526.333733][ T49] Bluetooth: hci4: link tx timeout [ 526.343770][ T49] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 526.351479][ T49] Bluetooth: hci4: link tx timeout [ 526.356699][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 526.392773][ T8083] Can't find ip_set type has [ 527.294826][ T8105] loop1: detected capacity change from 0 to 512 [ 527.371308][ T8105] EXT4-fs (loop1): Test dummy encryption mode enabled [ 528.021884][ T8105] EXT4-fs (loop1): 1 truncate cleaned up [ 528.028932][ T8105] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 528.455021][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 530.751132][ T8129] device syzkaller0 entered promiscuous mode [ 530.768282][ T8129] tipc: Enabled bearer , priority 0 [ 530.786910][ T8129] tipc: Resetting bearer [ 530.814608][ T8128] tipc: Resetting bearer [ 531.239642][ T8128] tipc: Disabling bearer [ 533.734213][ T8146] device syzkaller0 entered promiscuous mode [ 533.882610][ T4319] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 534.078872][ T4319] usb 2-1: config 1 has an invalid interface number: 113 but max is 0 [ 534.097835][ T4319] usb 2-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 534.127985][ T4319] usb 2-1: config 1 has no interface number 0 [ 534.698001][ T4319] usb 2-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 534.709382][ T4319] usb 2-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 534.722974][ T4319] usb 2-1: config 1 interface 113 has no altsetting 0 [ 534.813048][ T4319] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 534.822190][ T4319] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.872567][ T4319] usb 2-1: Product: syz [ 534.912453][ T4319] usb 2-1: Manufacturer: syz [ 534.917132][ T4319] usb 2-1: SerialNumber: syz [ 535.165958][ T4319] hub 2-1:1.113: bad descriptor, ignoring hub [ 535.208416][ T4319] hub: probe of 2-1:1.113 failed with error -5 [ 535.994700][ T8165] loop4: detected capacity change from 0 to 512 [ 536.149903][ T8165] EXT4-fs (loop4): Test dummy encryption mode enabled [ 536.230245][ T8165] EXT4-fs (loop4): 1 truncate cleaned up [ 536.236020][ T8165] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 538.333683][ T4286] EXT4-fs (loop4): unmounting filesystem. [ 538.343368][ T4319] usb 2-1: USB disconnect, device number 13 [ 541.936257][ T8195] device syzkaller0 entered promiscuous mode [ 541.963512][ T8195] tipc: Enabled bearer , priority 0 [ 542.041977][ T8195] tipc: Resetting bearer [ 542.082287][ T8199] device syzkaller0 entered promiscuous mode [ 542.126563][ T8193] tipc: Resetting bearer [ 542.136668][ T8192] Can't find ip_set type has [ 542.352894][ T8193] tipc: Disabling bearer [ 543.053549][ T8215] loop1: detected capacity change from 0 to 512 [ 543.634612][ T8215] EXT4-fs (loop1): Test dummy encryption mode enabled [ 543.824758][ T8215] EXT4-fs (loop1): 1 truncate cleaned up [ 543.830510][ T8215] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 544.112625][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 548.187987][ T8250] device syzkaller0 entered promiscuous mode [ 548.219020][ T8252] device syzkaller0 entered promiscuous mode [ 548.419940][ T8252] tipc: Enabled bearer , priority 0 [ 548.462954][ T8252] tipc: Resetting bearer [ 548.537272][ T8248] tipc: Resetting bearer [ 548.603321][ T8248] tipc: Disabling bearer [ 549.084602][ T8271] loop1: detected capacity change from 0 to 512 [ 549.585924][ T8271] EXT4-fs (loop1): Test dummy encryption mode enabled [ 549.864659][ T8271] EXT4-fs (loop1): 1 truncate cleaned up [ 549.870515][ T8271] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 550.109330][ T4282] EXT4-fs (loop1): unmounting filesystem. [ 552.305612][ T8286] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 554.532458][ T4315] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 554.724272][ T4315] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 554.760386][ T4315] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 554.809658][ T4315] usb 5-1: config 1 has no interface number 0 [ 554.826565][ T4315] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 554.849208][ T4315] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 554.871385][ T4315] usb 5-1: config 1 interface 113 has no altsetting 0 [ 554.878343][ T8305] device syzkaller0 entered promiscuous mode [ 554.924674][ T4315] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 554.955946][ T4315] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.979260][ T4315] usb 5-1: Product: syz [ 554.994952][ T4315] usb 5-1: Manufacturer: syz [ 555.004020][ T4315] usb 5-1: SerialNumber: syz [ 555.056344][ T8307] device syzkaller0 entered promiscuous mode [ 555.080299][ T8307] tipc: Enabled bearer , priority 0 [ 555.128950][ T8307] tipc: Resetting bearer [ 555.144957][ T8306] tipc: Resetting bearer [ 555.213488][ T8306] tipc: Disabling bearer [ 555.231344][ T4315] hub 5-1:1.113: bad descriptor, ignoring hub [ 555.246421][ T4315] hub: probe of 5-1:1.113 failed with error -5 [ 555.295120][ T4315] usb 5-1: USB disconnect, device number 7 [ 556.929344][ T8329] loop0: detected capacity change from 0 to 512 [ 556.971353][ T8329] EXT4-fs (loop0): Test dummy encryption mode enabled [ 558.727635][ T8329] EXT4-fs (loop0): 1 truncate cleaned up [ 558.734357][ T8329] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 558.995916][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 559.277713][ T8346] device syzkaller0 entered promiscuous mode [ 559.389497][ T8349] device syzkaller0 entered promiscuous mode [ 561.902985][ T8356] tipc: Enabling of bearer rejected, failed to enable media [ 565.502450][ T6877] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 565.944012][ T6877] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 565.955632][ T6877] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 565.979161][ T6877] usb 3-1: config 1 has no interface number 0 [ 566.079124][ T6877] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 566.132904][ T6877] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 566.170754][ T6877] usb 3-1: config 1 interface 113 has no altsetting 0 [ 566.193084][ T6877] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 566.211410][ T6877] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.234825][ T6877] usb 3-1: Product: syz [ 566.243751][ T6877] usb 3-1: Manufacturer: syz [ 566.256265][ T6877] usb 3-1: SerialNumber: syz [ 566.728642][ T8391] loop3: detected capacity change from 0 to 512 [ 566.866291][ T8391] EXT4-fs (loop3): Test dummy encryption mode enabled [ 567.533874][ T6877] hub 3-1:1.113: bad descriptor, ignoring hub [ 567.540187][ T6877] hub: probe of 3-1:1.113 failed with error -5 [ 567.632945][ T6877] usb 3-1: USB disconnect, device number 10 [ 567.666600][ T8391] EXT4-fs (loop3): 1 truncate cleaned up [ 567.672505][ T8391] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 567.689594][ T8395] device syzkaller0 entered promiscuous mode [ 567.758461][ T8400] device syzkaller0 entered promiscuous mode [ 567.772175][ T8400] tipc: Enabled bearer , priority 0 [ 567.791721][ T8400] tipc: Resetting bearer [ 567.803027][ T8398] tipc: Resetting bearer [ 567.847889][ T8398] tipc: Disabling bearer [ 567.952181][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 567.960585][ T8397] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1033'. [ 568.144881][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.151317][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 572.899558][ T8434] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 573.212758][ T22] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 573.583162][ T8449] loop2: detected capacity change from 0 to 512 [ 573.719857][ T8449] EXT4-fs (loop2): Test dummy encryption mode enabled [ 574.094939][ T8449] EXT4-fs (loop2): 1 truncate cleaned up [ 574.100747][ T8449] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 574.264017][ T22] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 574.281703][ T22] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 574.444946][ T22] usb 5-1: config 1 has no interface number 0 [ 574.471892][ T22] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 574.517840][ T22] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 574.534732][ T8453] device syzkaller0 entered promiscuous mode [ 574.579014][ T22] usb 5-1: config 1 interface 113 has no altsetting 0 [ 574.607526][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 574.652841][ T22] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 574.672267][ T22] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.693463][ T22] usb 5-1: Product: syz [ 574.697703][ T22] usb 5-1: Manufacturer: syz [ 574.742526][ T22] usb 5-1: SerialNumber: syz [ 574.948976][ T8455] device syzkaller0 entered promiscuous mode [ 574.973422][ T22] hub 5-1:1.113: bad descriptor, ignoring hub [ 574.979665][ T22] hub: probe of 5-1:1.113 failed with error -5 [ 575.033762][ T22] usb 5-1: USB disconnect, device number 8 [ 575.065765][ T8456] tipc: Enabled bearer , priority 0 [ 575.152992][ T8455] tipc: Resetting bearer [ 575.160425][ T8454] tipc: Resetting bearer [ 575.238085][ T8454] tipc: Disabling bearer [ 582.029258][ T8498] loop0: detected capacity change from 0 to 512 [ 582.179183][ T8498] EXT4-fs (loop0): Test dummy encryption mode enabled [ 583.992916][ T8498] EXT4-fs (loop0): 1 truncate cleaned up [ 583.998656][ T8498] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 584.371911][ T4276] EXT4-fs (loop0): unmounting filesystem. [ 584.622543][ T7475] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 584.833875][ T7475] usb 4-1: config 1 has an invalid interface number: 113 but max is 0 [ 584.852282][ T7475] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 584.922405][ T7475] usb 4-1: config 1 has no interface number 0 [ 584.969139][ T7475] usb 4-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 585.067064][ T7475] usb 4-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 585.125908][ T7475] usb 4-1: config 1 interface 113 has no altsetting 0 [ 585.160402][ T7475] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 585.207648][ T7475] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.243601][ T7475] usb 4-1: Product: syz [ 585.269997][ T7475] usb 4-1: Manufacturer: syz [ 585.292962][ T7475] usb 4-1: SerialNumber: syz [ 585.521608][ T7475] hub 4-1:1.113: bad descriptor, ignoring hub [ 585.538116][ T7475] hub: probe of 4-1:1.113 failed with error -5 [ 585.593213][ T7475] usb 4-1: USB disconnect, device number 8 [ 588.926175][ T8539] device syzkaller0 entered promiscuous mode [ 589.015622][ T8542] tipc: Enabled bearer , priority 0 [ 590.491018][ T49] Bluetooth: hci4: link tx timeout [ 590.496236][ T49] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 590.504394][ T49] Bluetooth: hci4: link tx timeout [ 590.509667][ T49] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 590.678826][ T8537] tipc: Resetting bearer [ 590.739834][ T8552] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1075'. [ 590.820598][ T8537] tipc: Disabling bearer [ 591.632400][ T4408] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 591.826429][ T4408] usb 4-1: config 1 has an invalid interface number: 113 but max is 0 [ 591.840863][ T4408] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 591.901702][ T4408] usb 4-1: config 1 has no interface number 0 [ 591.915685][ T4408] usb 4-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 591.952425][ T4408] usb 4-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 591.965970][ T4408] usb 4-1: config 1 interface 113 has no altsetting 0 [ 591.994649][ T4408] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 592.006228][ T4408] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.022755][ T4408] usb 4-1: Product: syz [ 592.026992][ T4408] usb 4-1: Manufacturer: syz [ 592.031628][ T4408] usb 4-1: SerialNumber: syz [ 592.059927][ T8550] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.067323][ T8550] bridge0: port 1(bridge_slave_0) entered disabled state [ 592.290260][ T4408] hub 4-1:1.113: bad descriptor, ignoring hub [ 592.316078][ T4408] hub: probe of 4-1:1.113 failed with error -5 [ 592.403428][ T4408] usb 4-1: USB disconnect, device number 9 [ 593.699838][ T8550] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 594.474350][ T8550] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 597.702638][ T8550] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.711648][ T8550] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.744407][ T8550] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.765743][ T8550] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.534538][ T8610] device syzkaller0 entered promiscuous mode [ 598.664581][ T8610] tipc: Enabled bearer , priority 0 [ 598.799679][ T8609] tipc: Resetting bearer [ 599.138388][ T8609] tipc: Disabling bearer [ 599.170731][ T8621] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 599.595212][ T7475] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 599.854631][ T7475] usb 3-1: config 1 has an invalid interface number: 113 but max is 0 [ 599.863190][ T7475] usb 3-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 599.901852][ T7475] usb 3-1: config 1 has no interface number 0 [ 599.971294][ T7475] usb 3-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 600.154246][ T7475] usb 3-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 600.314152][ T7475] usb 3-1: config 1 interface 113 has no altsetting 0 [ 600.481201][ T7475] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 600.632594][ T7475] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.692407][ T7475] usb 3-1: Product: syz [ 600.696667][ T7475] usb 3-1: Manufacturer: syz [ 600.701303][ T7475] usb 3-1: SerialNumber: syz [ 600.735312][ T8641] netlink: 256 bytes leftover after parsing attributes in process `syz.1.1098'. [ 600.761999][ T8641] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1098'. [ 600.950662][ T7475] hub 3-1:1.113: bad descriptor, ignoring hub [ 600.962176][ T7475] hub: probe of 3-1:1.113 failed with error -5 [ 601.023087][ T7475] usb 3-1: USB disconnect, device number 11 [ 603.241571][ T8644] loop1: detected capacity change from 0 to 32768 [ 603.287627][ T8644] jfs: Unrecognized mount option "" or missing value [ 603.348835][ T8641] overlayfs: overlapping lowerdir path [ 603.672481][ T7475] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 603.874204][ T7475] usb 2-1: config 0 has an invalid interface number: 117 but max is 0 [ 603.902200][ T7475] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 603.932831][ T7475] usb 2-1: config 0 has no interface number 0 [ 603.948730][ T7475] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 604.045138][ T8657] device syzkaller0 entered promiscuous mode [ 604.125608][ T8657] tipc: Enabled bearer , priority 0 [ 604.162074][ T8655] tipc: Resetting bearer [ 604.164614][ T7475] usb 2-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 604.178544][ T7475] usb 2-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 604.198360][ T7475] usb 2-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 604.207811][ T7475] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.222063][ T7475] usb 2-1: Product: syz [ 604.229046][ T7475] usb 2-1: Manufacturer: syz [ 604.239781][ T7475] usb 2-1: SerialNumber: syz [ 604.251240][ T7475] usb 2-1: config 0 descriptor?? [ 604.257139][ T8659] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1104'. [ 604.312163][ T8650] loop2: detected capacity change from 0 to 32768 [ 604.333230][ T8655] tipc: Disabling bearer [ 604.393354][ T8650] XFS (loop2): Mounting V5 Filesystem [ 604.516531][ T8650] XFS (loop2): Ending clean mount [ 604.558834][ T7475] usbtouchscreen: probe of 2-1:0.117 failed with error -71 [ 604.593578][ T7475] usb 2-1: USB disconnect, device number 14 [ 604.761488][ T4278] XFS (loop2): Unmounting Filesystem [ 606.275933][ T8676] sctp: failed to load transform for md5: -2 [ 606.597856][ T8699] loop3: detected capacity change from 0 to 512 [ 607.060740][ T6875] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 607.318539][ T6875] usb 5-1: config 1 has an invalid interface number: 113 but max is 0 [ 607.384061][ T6875] usb 5-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 608.782482][ T6875] usb 5-1: config 1 has no interface number 0 [ 608.788672][ T6875] usb 5-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 608.896697][ T6875] usb 5-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 608.951272][ T6875] usb 5-1: config 1 interface 113 has no altsetting 0 [ 608.979914][ T6875] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 609.009591][ T6875] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 609.024955][ T6875] usb 5-1: Product: syz [ 609.039433][ T6875] usb 5-1: Manufacturer: syz [ 609.044824][ T6875] usb 5-1: SerialNumber: syz [ 609.193120][ T8699] EXT4-fs: Ignoring removed i_version option [ 609.200645][ T8699] EXT4-fs (loop3): Test dummy encryption mode enabled [ 609.230507][ T8699] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802c118, mo2=0022] [ 609.250664][ T8699] System zones: 1-2, 4-12, 8-8 [ 609.268444][ T8699] EXT4-fs error (device loop3): ext4_orphan_get:1405: inode #15: comm syz.3.1112: iget: bad i_size value: 38620345925642 [ 609.291289][ T6875] hub 5-1:1.113: bad descriptor, ignoring hub [ 609.314567][ T6875] hub: probe of 5-1:1.113 failed with error -5 [ 609.363220][ T6875] usb 5-1: USB disconnect, device number 9 [ 609.363814][ T8699] EXT4-fs error (device loop3): ext4_orphan_get:1410: comm syz.3.1112: couldn't read orphan inode 15 (err -117) [ 609.452583][ T8699] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 609.963573][ T8726] fscrypt (loop3): Missing crypto API support for AES-256-XTS (API name: "xts(aes)") [ 609.983179][ T8722] loop2: detected capacity change from 0 to 512 [ 610.283571][ T8722] EXT4-fs (loop2): Test dummy encryption mode enabled [ 610.393727][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 610.408617][ T8722] EXT4-fs (loop2): 1 truncate cleaned up [ 610.474343][ T8722] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 610.811212][ T8744] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1120'. [ 616.123276][ T8767] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1424729573 (182365385344 ns) > initial count (134528494848 ns). Using initial count to start timer. [ 616.462643][ T126] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 616.522481][ T4278] EXT4-fs (loop2): unmounting filesystem. [ 616.655149][ T126] usb 4-1: config 1 has an invalid interface number: 113 but max is 0 [ 616.713018][ T126] usb 4-1: config 1 has an invalid descriptor of length 174, skipping remainder of the config [ 616.743266][ T126] usb 4-1: config 1 has no interface number 0 [ 616.750107][ T126] usb 4-1: too many endpoints for config 1 interface 113 altsetting 160: 72, using maximum allowed: 30 [ 617.528064][ T8777] sctp: failed to load transform for md5: -2 [ 617.643264][ T126] usb 4-1: config 1 interface 113 altsetting 160 has 0 endpoint descriptors, different from the interface descriptor's value: 72 [ 617.702501][ T126] usb 4-1: config 1 interface 113 has no altsetting 0 [ 617.764983][ T126] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 617.785248][ T126] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.802900][ T126] usb 4-1: Product: syz [ 617.812476][ T126] usb 4-1: Manufacturer: syz [ 617.819865][ T126] usb 4-1: SerialNumber: syz [ 619.648839][ T126] hub 4-1:1.113: bad descriptor, ignoring hub [ 619.702517][ T126] hub: probe of 4-1:1.113 failed with error -5 [ 619.721683][ T8801] loop1: detected capacity change from 0 to 2048 [ 619.753441][ T8801] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 619.834879][ T126] usb 4-1: USB disconnect, device number 10 [ 625.495845][ T8845] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 625.665121][ T8838] loop3: detected capacity change from 0 to 512 [ 625.694374][ T49] Bluetooth: Wrong link type (-22) [ 627.591739][ T8867] loop4: detected capacity change from 0 to 2048 [ 627.710039][ T8867] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 628.097838][ T8877] ================================================================== [ 628.106076][ T8877] BUG: KFENCE: use-after-free read in dvb_device_open+0xc5/0x360 [ 628.106076][ T8877] [ 628.116185][ T8877] Use-after-free read at 0xffff88823bca6f18 (in kfence-#82): [ 628.123561][ T8877] dvb_device_open+0xc5/0x360 [ 628.128259][ T8877] chrdev_open+0x585/0x5f0 [ 628.132754][ T8877] do_dentry_open+0x7dd/0x10b0 [ 628.137576][ T8877] path_openat+0x2674/0x2f10 [ 628.142216][ T8877] do_filp_open+0x1ee/0x420 [ 628.146735][ T8877] do_sys_openat2+0x14b/0x4f0 [ 628.151443][ T8877] __x64_sys_openat+0x135/0x160 [ 628.156331][ T8877] do_syscall_64+0x4c/0xa0 [ 628.160794][ T8877] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 628.166787][ T8877] [ 628.169135][ T8877] kfence-#82: 0xffff88823bca6f00-0xffff88823bca6fd7, size=216, cache=kmalloc-256 [ 628.169135][ T8877] [ 628.180773][ T8877] allocated by task 1 on cpu 1 at 20.754892s: [ 628.187297][ T8877] __kmem_cache_alloc_node+0x202/0x270 [ 628.192796][ T8877] kmalloc_trace+0x26/0xe0 [ 628.197254][ T8877] dvb_register_device+0x305/0x1dc0 [ 628.202483][ T8877] dvb_register_frontend+0x629/0x900 [ 628.207804][ T8877] vidtv_bridge_probe+0x9cf/0xf50 [ 628.212872][ T8877] platform_probe+0x137/0x1c0 [ 628.217592][ T8877] really_probe+0x24a/0xb40 [ 628.222123][ T8877] __driver_probe_device+0x1f5/0x390 [ 628.227465][ T8877] driver_probe_device+0x4f/0x420 [ 628.232517][ T8877] __driver_attach+0x43d/0x6c0 [ 628.237304][ T8877] bus_for_each_dev+0x182/0x1f0 [ 628.242176][ T8877] bus_add_driver+0x324/0x5d0 [ 628.246876][ T8877] driver_register+0x32d/0x430 [ 628.251688][ T8877] vidtv_bridge_init+0x45/0x73 [ 628.256476][ T8877] do_one_initcall+0x257/0x800 [ 628.261266][ T8877] do_initcall_level+0x13d/0x1ed [ 628.266322][ T8877] do_initcalls+0x4b/0x8a [ 628.270676][ T8877] kernel_init_freeable+0x401/0x5ab [ 628.275892][ T8877] kernel_init+0x19/0x1b0 [ 628.280246][ T8877] ret_from_fork+0x1f/0x30 [ 628.284695][ T8877] [ 628.287041][ T8877] freed by task 8845 on cpu 1 at 625.527039s: [ 628.293221][ T8877] dvb_device_open+0x2d2/0x360 [ 628.298012][ T8877] chrdev_open+0x585/0x5f0 [ 628.302477][ T8877] do_dentry_open+0x7dd/0x10b0 [ 628.307299][ T8877] path_openat+0x2674/0x2f10 [ 628.311937][ T8877] do_filp_open+0x1ee/0x420 [ 628.316465][ T8877] do_sys_openat2+0x14b/0x4f0 [ 628.321192][ T8877] __x64_sys_openat+0x135/0x160 [ 628.326069][ T8877] do_syscall_64+0x4c/0xa0 [ 628.330519][ T8877] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 628.336528][ T8877] [ 628.338898][ T8877] CPU: 0 PID: 8877 Comm: syz.2.1149 Not tainted syzkaller #0 [ 628.346441][ T8877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 628.356530][ T8877] RIP: 0010:dvb_device_open+0xc5/0x360 [ 628.362129][ T8877] Code: 4d 8b 3f 4d 85 ff 0f 84 2c 01 00 00 4c 89 24 24 4d 8d 67 18 4c 89 e5 48 c1 ed 03 80 7c 1d 00 00 74 08 4c 89 e7 e8 7b 55 09 fb <4d> 8b 2c 24 4d 85 ed 0f 84 08 01 00 00 4c 89 e8 48 c1 e8 03 80 3c [ 628.382154][ T8877] RSP: 0018:ffffc900033bf7f0 EFLAGS: 00010246 [ 628.388298][ T8877] RAX: 1ffffffff2dfbca7 RBX: dffffc0000000000 RCX: 0000000000000000 [ 628.396314][ T8877] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff [ 628.404308][ T8877] RBP: 1ffff11047794de3 R08: ffffffff8d8c204f R09: 1ffffffff1b18409 [ 628.412327][ T8877] R10: dffffc0000000000 R11: fffffbfff1b1840a R12: ffff88823bca6f18 [ 628.420347][ T8877] R13: dffffc0000000000 R14: ffff888029812d70 R15: ffff88823bca6f00 [ 628.428343][ T8877] FS: 00007f096373c6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 628.437296][ T8877] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 628.443901][ T8877] CR2: ffff88823bca6f18 CR3: 000000014daa8000 CR4: 00000000003506f0 [ 628.451896][ T8877] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 628.459888][ T8877] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 628.467912][ T8877] Call Trace: [ 628.471300][ T8877] [ 628.474388][ T8877] chrdev_open+0x585/0x5f0 [ 628.478875][ T8877] ? cd_forget+0x160/0x160 [ 628.483332][ T8877] ? fsnotify_perm+0x39b/0x550 [ 628.488202][ T8877] ? cd_forget+0x160/0x160 [ 628.492652][ T8877] do_dentry_open+0x7dd/0x10b0 [ 628.497447][ T8877] path_openat+0x2674/0x2f10 [ 628.502067][ T8877] ? verify_lock_unused+0x140/0x140 [ 628.507354][ T8877] ? do_sys_openat2+0xdd/0x4f0 [ 628.512152][ T8877] ? do_filp_open+0x420/0x420 [ 628.516884][ T8877] do_filp_open+0x1ee/0x420 [ 628.521413][ T8877] ? vfs_tmpfile+0x470/0x470 [ 628.526042][ T8877] ? _raw_spin_unlock+0x24/0x40 [ 628.530923][ T8877] ? alloc_fd+0x590/0x640 [ 628.535328][ T8877] do_sys_openat2+0x14b/0x4f0 [ 628.540055][ T8877] ? do_sys_open+0xe0/0xe0 [ 628.544505][ T8877] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 628.550517][ T8877] ? lock_chain_count+0x20/0x20 [ 628.555415][ T8877] __x64_sys_openat+0x135/0x160 [ 628.560293][ T8877] do_syscall_64+0x4c/0xa0 [ 628.564747][ T8877] ? clear_bhb_loop+0x60/0xb0 [ 628.569451][ T8877] ? clear_bhb_loop+0x60/0xb0 [ 628.574157][ T8877] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 628.580083][ T8877] RIP: 0033:0x7f096275e90e [ 628.584538][ T8877] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 628.604258][ T8877] RSP: 002b:00007f096373bb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 628.612707][ T8877] RAX: ffffffffffffffda RBX: 00007f096373c6c0 RCX: 00007f096275e90e [ 628.620707][ T8877] RDX: 0000000000000002 RSI: 00007f096373bc00 RDI: ffffffffffffff9c [ 628.628715][ T8877] RBP: 00007f096373bc00 R08: 0000000000000000 R09: 0000000000000000 [ 628.636719][ T8877] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 628.644904][ T8877] R13: 00007f0962a26038 R14: 00007f0962a25fa0 R15: 00007ffd3a05fd38 [ 628.652909][ T8877] [ 628.655950][ T8877] ================================================================== [ 628.664039][ T8877] Kernel panic - not syncing: KFENCE: panic_on_warn set ... [ 628.671957][ T8877] CPU: 0 PID: 8877 Comm: syz.2.1149 Not tainted syzkaller #0 [ 628.679361][ T8877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 628.689438][ T8877] Call Trace: [ 628.692755][ T8877] [ 628.695738][ T8877] dump_stack_lvl+0x188/0x24e [ 628.700548][ T8877] ? memcpy+0x3c/0x60 [ 628.704586][ T8877] ? show_regs_print_info+0x12/0x12 [ 628.709839][ T8877] ? load_image+0x410/0x410 [ 628.714442][ T8877] panic+0x2d3/0x710 [ 628.718383][ T8877] ? bpf_jit_dump+0xd0/0xd0 [ 628.722931][ T8877] check_panic_on_warn+0x80/0xa0 [ 628.727974][ T8877] kfence_report_error+0x78d/0xad0 [ 628.733125][ T8877] ? kfence_print_stack+0x290/0x290 [ 628.738355][ T8877] ? dvb_device_open+0xc5/0x360 [ 628.743238][ T8877] ? chrdev_open+0x585/0x5f0 [ 628.747979][ T8877] ? do_dentry_open+0x7dd/0x10b0 [ 628.752968][ T8877] ? path_openat+0x2674/0x2f10 [ 628.757752][ T8877] ? do_filp_open+0x1ee/0x420 [ 628.762454][ T8877] ? do_sys_openat2+0x14b/0x4f0 [ 628.767358][ T8877] ? __x64_sys_openat+0x135/0x160 [ 628.772421][ T8877] ? do_syscall_64+0x4c/0xa0 [ 628.777047][ T8877] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 628.783176][ T8877] ? _raw_spin_lock+0x40/0x40 [ 628.787883][ T8877] ? search_bpf_extables+0x22/0x3c0 [ 628.793178][ T8877] kfence_handle_page_fault+0x553/0x720 [ 628.798762][ T8877] ? trim_init_extable+0x3b0/0x3b0 [ 628.803927][ T8877] ? rcu_guarded_free+0x50/0x50 [ 628.808806][ T8877] ? search_bpf_extables+0x368/0x3c0 [ 628.814153][ T8877] ? search_bpf_extables+0x22/0x3c0 [ 628.819384][ T8877] page_fault_oops+0x1a3/0x8c0 [ 628.824251][ T8877] ? __mutex_trylock_common+0x15c/0x260 [ 628.829834][ T8877] ? ex_get_fixup_type+0x60/0x60 [ 628.834804][ T8877] ? kernelmode_fixup_or_oops+0xd0/0xd0 [ 628.840376][ T8877] ? is_prefetch+0x3df/0x640 [ 628.845000][ T8877] ? page_fault_oops+0x8c0/0x8c0 [ 628.849984][ T8877] exc_page_fault+0xa8/0x100 [ 628.854622][ T8877] ? mutex_lock_nested+0x10/0x10 [ 628.859596][ T8877] asm_exc_page_fault+0x22/0x30 [ 628.864483][ T8877] RIP: 0010:dvb_device_open+0xc5/0x360 [ 628.869981][ T8877] Code: 4d 8b 3f 4d 85 ff 0f 84 2c 01 00 00 4c 89 24 24 4d 8d 67 18 4c 89 e5 48 c1 ed 03 80 7c 1d 00 00 74 08 4c 89 e7 e8 7b 55 09 fb <4d> 8b 2c 24 4d 85 ed 0f 84 08 01 00 00 4c 89 e8 48 c1 e8 03 80 3c [ 628.889637][ T8877] RSP: 0018:ffffc900033bf7f0 EFLAGS: 00010246 [ 628.895758][ T8877] RAX: 1ffffffff2dfbca7 RBX: dffffc0000000000 RCX: 0000000000000000 [ 628.903756][ T8877] RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff [ 628.911754][ T8877] RBP: 1ffff11047794de3 R08: ffffffff8d8c204f R09: 1ffffffff1b18409 [ 628.919752][ T8877] R10: dffffc0000000000 R11: fffffbfff1b1840a R12: ffff88823bca6f18 [ 628.927753][ T8877] R13: dffffc0000000000 R14: ffff888029812d70 R15: ffff88823bca6f00 [ 628.935778][ T8877] chrdev_open+0x585/0x5f0 [ 628.940236][ T8877] ? cd_forget+0x160/0x160 [ 628.944681][ T8877] ? fsnotify_perm+0x39b/0x550 [ 628.949476][ T8877] ? cd_forget+0x160/0x160 [ 628.953922][ T8877] do_dentry_open+0x7dd/0x10b0 [ 628.958734][ T8877] path_openat+0x2674/0x2f10 [ 628.963370][ T8877] ? verify_lock_unused+0x140/0x140 [ 628.968622][ T8877] ? do_sys_openat2+0xdd/0x4f0 [ 628.973421][ T8877] ? do_filp_open+0x420/0x420 [ 628.978154][ T8877] do_filp_open+0x1ee/0x420 [ 628.982689][ T8877] ? vfs_tmpfile+0x470/0x470 [ 628.987323][ T8877] ? _raw_spin_unlock+0x24/0x40 [ 628.992201][ T8877] ? alloc_fd+0x590/0x640 [ 628.996576][ T8877] do_sys_openat2+0x14b/0x4f0 [ 629.001378][ T8877] ? do_sys_open+0xe0/0xe0 [ 629.005833][ T8877] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 629.011876][ T8877] ? lock_chain_count+0x20/0x20 [ 629.016795][ T8877] __x64_sys_openat+0x135/0x160 [ 629.021719][ T8877] do_syscall_64+0x4c/0xa0 [ 629.026201][ T8877] ? clear_bhb_loop+0x60/0xb0 [ 629.031113][ T8877] ? clear_bhb_loop+0x60/0xb0 [ 629.035848][ T8877] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 629.041800][ T8877] RIP: 0033:0x7f096275e90e [ 629.046345][ T8877] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 629.066008][ T8877] RSP: 002b:00007f096373bb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 629.074470][ T8877] RAX: ffffffffffffffda RBX: 00007f096373c6c0 RCX: 00007f096275e90e [ 629.082483][ T8877] RDX: 0000000000000002 RSI: 00007f096373bc00 RDI: ffffffffffffff9c [ 629.090494][ T8877] RBP: 00007f096373bc00 R08: 0000000000000000 R09: 0000000000000000 [ 629.098595][ T8877] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 629.106611][ T8877] R13: 00007f0962a26038 R14: 00007f0962a25fa0 R15: 00007ffd3a05fd38 [ 629.114641][ T8877] [ 629.118310][ T8877] Kernel Offset: disabled [ 629.123226][ T8877] Rebooting in 86400 seconds..