last executing test programs: 9.539070225s ago: executing program 4 (id=686): mkdirat(0xffffffffffffff9c, 0x0, 0x0) close(0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r1 = gettid() r2 = syz_open_procfs(r1, &(0x7f0000000040)='timerslack_ns\x00') write$binfmt_format(r2, &(0x7f0000000180)='0\x00', 0x2) 9.221803641s ago: executing program 4 (id=689): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='veno', 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44080) syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce010203010902"], 0x0) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) 7.641821796s ago: executing program 4 (id=697): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)="62f5ff6ccf3d2ec97f0e4bc8a900d2e75067a5109d749cdf1ba00926335fdca4d6df9c6093533dbe86131af765f8be39df30e3", 0x33) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./trace/events/dwc3/dwc3_ctrl_req/inject\x00', 0x2, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r2, &(0x7f0000000180), 0x1000) 7.374991226s ago: executing program 4 (id=698): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x120, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x1e8, 0x20a, 0x278, 0x1e8, 0x278, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x3}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@loopback, @mcast2, [0x0, 0xff000000], [0x0, 0xffffff00, 0x0, 0xffffffff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x0, 0x13}, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close(r2) 5.712975158s ago: executing program 4 (id=707): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$mouse(&(0x7f0000000000), 0x0, 0x210c0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f00000e6000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x3c}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0x3, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000000)=0x6, 0x4) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 5.712394159s ago: executing program 0 (id=708): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000740)={r3, 0x0, 0x0}, 0x10) 5.438116767s ago: executing program 0 (id=709): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r2 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r2, 0x0, 0x0) listen(r2, 0x0) bpf$LINK_DETACH(0x22, 0x0, 0x0) accept4$bt_l2cap(r1, 0x0, 0x0, 0x800) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x2710, 0x4, 0xeeeee000, 0x1000, &(0x7f0000fef000/0x1000)=nil}) 4.801323985s ago: executing program 1 (id=711): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='temp_file\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000080)='/dev/mapper/control', 0x13) lseek(r0, 0x0, 0x0) read(r0, &(0x7f0000000100), 0x14) openat(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 4.800997816s ago: executing program 4 (id=712): socket$unix(0x1, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000280)={0x0, 0x3}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r4, {0x0, 0xfff2}, {0xb, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x405c071}, 0x400c840) 4.491529244s ago: executing program 1 (id=714): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@code={0x1, 0x81, {"0f22e5c744240060420000c744240233d8cecbc7442406000000000f011c24668f38896810c4027958b20000000064449966baf80cb83284af80ef66bafc0c66ed66baf80cb8cc07ff8aef66bafc0cb8d4000000ef48b8f8000000000000000f23c00f2135030009000f23f8450f2244"}}], 0x81}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x89, 0x0, 0x3, 0x8d], 0x100000, 0x2c08c6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.93763791s ago: executing program 0 (id=715): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='nb7vpq904m 0x10\n\x00', 0x11) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/i2c/devices/i2c-1/new_device\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='nb7vpq904m 0x10\n\x00', 0x11) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/i2c/devices/i2c-2/new_device\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='nb7vpq904m 0x10\n\x00', 0x11) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/i2c/devices/i2c-3/new_device\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='nb7vpq904m 0x10\n\x00', 0x11) 3.789875188s ago: executing program 1 (id=716): unshare(0x2068000) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setpriority(0x0, 0x0, 0x200002a14b56) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) 3.306202231s ago: executing program 3 (id=718): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = memfd_create(0x0, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) pwrite64(r0, &(0x7f0000000140), 0x0, 0xfff) r1 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x6, @mcast1, 0x6}, 0x1c) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) 3.272603968s ago: executing program 0 (id=719): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x2, 0x184, 0x2, 0x10, 0xf1, 0x100000001, 0x1, 0x5, 0x0, 0x29, 0x0, 0x2, 0x0, 0xbd9], 0xffff1001}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x3, 0x1000000000, 0x0, 0x200000000000043, 0x2000004, 0x0, 0x2004cb, 0x0, 0x0, 0x68ff, 0x7529, 0x8000000009, 0x803, 0x0, 0x9, 0x2], 0xeeee8000, 0x306780}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xf, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x1, 0x5, 0x75, 0x6, 0x36, 0xe, 0x2, 0x87}, {0x3000, 0xdddd0000, 0x4, 0x5, 0x3, 0x6, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0xfec00000, 0xeeee0000, 0x4, 0x6, 0x5, 0x7f, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0xd000, 0xf, 0x3, 0x16, 0x6, 0x2, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0x0, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0xdddd0000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x8, 0x8, 0x81, 0x42, 0x70}, {0xdddd0000, 0xa000, 0xa, 0x5, 0xcd, 0x7, 0x9, 0x9, 0x7, 0xc, 0xb0, 0x91}, {0xeeee0000, 0x30}, {0x10000, 0x7}, 0x1, 0x0, 0x3000, 0x2024, 0x2, 0x0, 0x100000, [0x6800000000000000, 0x3, 0x3, 0x8]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.116687998s ago: executing program 1 (id=720): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, 0x0, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) close(r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, &(0x7f00000003c0)="90", 0x1, 0x10, &(0x7f0000000240)={0xa, 0x4e1f, 0xfffffffc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3}, 0xffffffffffffff39) sendmsg$can_bcm(r0, 0x0, 0xc0) 3.048728653s ago: executing program 3 (id=721): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000fea000/0x1000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xccdb, 0xc000, 0x0, 0x20002fb}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x29, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.961072909s ago: executing program 1 (id=722): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00007af000/0x1000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.80893246s ago: executing program 1 (id=723): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000800000002", @ANYBLOB], 0x48) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x900, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)={'vcan0\x00', 0x100}) prlimit64(0x0, 0x7, &(0x7f0000000080)={0x4, 0xeb}, 0x0) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007110bd00000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x8c) getrlimit(0x4, &(0x7f0000000200)) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x2400c011}, 0x8004) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0x8}, 0x1000003a, [0x8000, 0xc91a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000009, 0x101, 0x6, 0x0, 0x0, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x4, 0x0, 0x4, 0x8, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0xd, 0x7, 0x48, 0xffffffff, 0x100e661, 0x629, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x5, 0xe, 0x0, 0x80008071, 0x10007, 0x17, 0x1, 0x0, 0x7fff, 0x3e, 0x88, 0x6, 0x1, 0x9, 0x82, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0x7f, 0xe, 0x2c0, 0xfffffff7, 0x9, 0xfffffffb, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xf, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x7, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x902, 0x2, 0x4, 0x7, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000004, 0xffff, 0x2, 0x4, 0x24f6d000, 0x0, 0x7c9d, 0x9, 0x8, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x401, 0x7, 0x5, 0xfffffffc, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x14, 0x7ff, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x82, 0x0, 0x4, 0x2950bfad, 0x1000, 0xa2, 0x7, 0xffffffff, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x80, 0x12b, 0x0, 0x1, 0xa, 0x0, 0x5, 0x4000001c, 0x120000, 0x3, 0x2002, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x2, 0x93a, 0x5, 0x6, 0x7, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x81, 0x3, 0x101, 0x10000, 0x2, 0x7fff, 0x10000, 0x5, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x5, 0x6, 0x16, 0x6, 0x7ffffffc, 0x5, 0x4, 0x2, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9604, 0x7, 0xaf, 0x5, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x10, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1000]}, 0x45c) socket(0x1e, 0x802, 0x0) 2.80780397s ago: executing program 3 (id=724): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8002) r2 = fcntl$dupfd(r1, 0x0, r1) read$FUSE(r2, 0x0, 0x2000) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffc, 0x6, 0xe9, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000180)='\x00\x00\x00\x00\x00\x00', 0x0, 0x9, 0x0, 0x80, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) 2.598751104s ago: executing program 2 (id=725): bpf$MAP_CREATE(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) lsm_set_self_attr(0x66, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0208000004000000010000000900010000", @ANYRES32], 0x48) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) sendmmsg(r0, &(0x7f000000e740)=[{{&(0x7f0000000000)=@can={0x1d, r1}, 0x80, 0x0}}], 0x1, 0x480d0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x26048880) 2.496858449s ago: executing program 2 (id=726): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x2, @local, 0x8ac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b9312948f6651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267513308a3d40aa1c788df6"}, 0xd8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$int_in(r0, 0x5421, &(0x7f0000000140)=0xffff) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) 1.991458458s ago: executing program 0 (id=727): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, 0x0) mremap(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000ffe000/0x2000)=nil) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x28}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r4, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ff9000/0x4000)=nil) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.612524999s ago: executing program 2 (id=728): socket(0x10, 0x3, 0x0) fanotify_init(0x200, 0x400) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="03c800341f30e51d2ada9852ea20033c3ba772e15f0b8f7b868423941b600c253e8f98b7d6a7ae5ab7530a6c5a2a373b4e9cfd3673df8e"], 0x38) r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0}, 0x94) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x4000000) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) read$FUSE(r1, &(0x7f0000006540)={0x2020}, 0xfffffce2) 1.611183879s ago: executing program 3 (id=729): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000000000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000240)={0x1, 0x0, [{0x280}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/drivers/ehci-pci/new_id\x00', 0x1, 0x0) write(r5, &(0x7f0000000180)='8086 2', 0x6) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x8100, 0xe, 0x0, &(0x7f00000002c0)="c810e19e00399da26f0000000000", 0x0, 0xadf0, 0x21, 0x0, 0x0, 0x0, 0x0}, 0x50) 853.617236ms ago: executing program 3 (id=730): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x7, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000140)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x3, 0x8001, 0x4002004c4, 0x5f, 0x8000000000100000, 0xd, 0x8, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x4000000000b3, 0x89], 0xeeee8000, 0x2839d1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 835.089947ms ago: executing program 0 (id=731): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r0, 0x1000) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, 0x0) r2 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0xbb42) ioctl$HIDIOCGFEATURE(r2, 0xc0404807, &(0x7f0000000080)={0x5, "1f7f67491b5a90eeaddb94a4031a82687063ba6e44f7b91d902d0008424ad04b9634bef178be4ba64223a1d6da6d232b4ea6a453724e5a9c45a204ec36715596"}) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000140)={0xa, {0x1, 0x3, 0xff}}, 0xa) 694.00427ms ago: executing program 2 (id=732): ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000040)=0x90000) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xfffffffffffffe01, 0x9, 0xffffffffffffffff, 0x10000000, 0x10000, 0x3, 0x400004002004c2, 0x5, 0x1, 0x0, 0x404, 0x82, 0x3, 0xfffffffffffffff8, 0x6, 0x9], 0xeeee8000, 0x240456}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8}, 0x94) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 297.983031ms ago: executing program 3 (id=733): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffffb}) socket$inet_smc(0x2b, 0x1, 0x0) rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') r2 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x6, 0x9, 0x0, 0x1, 0xfffa0000}, {0x66, 0x0, 0x0, 0x6}}, [@printk={@llu, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x8000) syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYRESDEC=r1, @ANYRES32=r1, @ANYRES8=r3, @ANYRESHEX=r0], 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x200080d0) 198.57212ms ago: executing program 2 (id=734): r0 = open(&(0x7f00000002c0)='./file1\x00', 0xc27e, 0x1bb) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x13, r0, 0x0) fallocate(r0, 0x0, 0x9e1f, 0x575) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x1, @loopback, 0x7}, 0x1c) shutdown(r1, 0x2) listen(r1, 0x5) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x24040004, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty, 0x7f}, 0x1c) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x40, 0x0, 0x0, 0x0, 0x1}, {0x1, 0xddccb000, 0xd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0xe, 0x0, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x6}, {0xb000, 0x2000, 0xd, 0xfd, 0xa0, 0x0, 0x3}, {0x1000, 0x0, 0xd, 0x0, 0x70, 0x80, 0x0, 0x0, 0xfd, 0x1c, 0x7, 0xa8}, {0xeeee8000, 0x3000, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x6, 0xfc, 0x86, 0xfe}, {0xeeee8000, 0xe000, 0x0, 0x0, 0x5, 0x0, 0x0, 0x80, 0x0, 0x4}, {0xd000, 0x41000, 0xe, 0x82, 0x0, 0x10, 0x4, 0xe}, {}, {0x1, 0xfffe}, 0x50011, 0x0, 0x0, 0x10, 0x1000000000000001, 0x0, 0x900, [0x0, 0x0, 0x2, 0x5]}) sendto(r2, &(0x7f00000000c0)="1e1a02f8045f40dec1eee1eda0a1358fc61764f0678eb2354b1b5f7972d8d8a583060b008d5676a814b496b5598751acd495188d3526e054fe90538588262f1e704b8a262cfa495499471986ca25e6c90ccdd6d2464dab555f566ac4f2eacb636c4b439b4a7ddc6e07fb12322dc050230ef3cc1b464316e3585fb35f", 0xfffffffffffffec5, 0x4048096, 0x0, 0x0) 0s ago: executing program 2 (id=735): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/midi.usb0/id\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='MyMidiCard\n', 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1/midi.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='dummy_udc.0\n', 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. [ 74.153880][ T5591] cgroup: Unknown subsys name 'net' [ 74.395757][ T5591] cgroup: Unknown subsys name 'cpuset' [ 74.469669][ T5591] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.127202][ T5591] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.493296][ T5608] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 78.510217][ T4918] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.556775][ T5617] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.578983][ T5617] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.580766][ T5620] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.607575][ T5617] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.632542][ T5621] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 78.636401][ T5620] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.637588][ T5623] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.637985][ T5620] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.643194][ T5620] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.651728][ T5620] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.652312][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.654519][ T5620] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.655909][ T5621] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.658884][ T5621] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.662020][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.664038][ T5621] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.664748][ T5621] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.665106][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.665555][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.672356][ T59] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 78.672752][ T59] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.724139][ T4918] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.726560][ T4918] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 80.731837][ T5616] Bluetooth: hci0: command tx timeout [ 80.809171][ T5616] Bluetooth: hci1: command tx timeout [ 80.809344][ T5616] Bluetooth: hci2: command tx timeout [ 80.809428][ T5616] Bluetooth: hci3: command tx timeout [ 80.879897][ T4918] Bluetooth: hci4: command tx timeout [ 81.114703][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.114803][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.114949][ T5603] bridge_slave_0: entered allmulticast mode [ 81.117042][ T5603] bridge_slave_0: entered promiscuous mode [ 81.143652][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.144067][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.144217][ T5605] bridge_slave_0: entered allmulticast mode [ 81.146712][ T5605] bridge_slave_0: entered promiscuous mode [ 81.148812][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.148917][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.157981][ T5607] bridge_slave_0: entered allmulticast mode [ 81.165042][ T5607] bridge_slave_0: entered promiscuous mode [ 81.171201][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.171318][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.171782][ T5606] bridge_slave_0: entered allmulticast mode [ 81.174462][ T5606] bridge_slave_0: entered promiscuous mode [ 81.185301][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.185456][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.185650][ T5603] bridge_slave_1: entered allmulticast mode [ 81.193903][ T5603] bridge_slave_1: entered promiscuous mode [ 81.216195][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.216400][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.216862][ T5605] bridge_slave_1: entered allmulticast mode [ 81.224537][ T5605] bridge_slave_1: entered promiscuous mode [ 81.225844][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.225953][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.226097][ T5607] bridge_slave_1: entered allmulticast mode [ 81.228748][ T5607] bridge_slave_1: entered promiscuous mode [ 81.233126][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.233237][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.233390][ T5606] bridge_slave_1: entered allmulticast mode [ 81.236143][ T5606] bridge_slave_1: entered promiscuous mode [ 81.260290][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.260402][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.260555][ T5609] bridge_slave_0: entered allmulticast mode [ 81.262940][ T5609] bridge_slave_0: entered promiscuous mode [ 81.355989][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.357112][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.358154][ T5609] bridge_slave_1: entered allmulticast mode [ 81.361343][ T5609] bridge_slave_1: entered promiscuous mode [ 81.417673][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.436851][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.442796][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.462880][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.465473][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.493994][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.632653][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.634591][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.670373][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.778835][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.838558][ T5603] team0: Port device team_slave_0 added [ 81.852409][ T5605] team0: Port device team_slave_0 added [ 81.882011][ T5607] team0: Port device team_slave_0 added [ 81.886214][ T5606] team0: Port device team_slave_0 added [ 81.901482][ T5603] team0: Port device team_slave_1 added [ 81.907004][ T5605] team0: Port device team_slave_1 added [ 81.962213][ T5607] team0: Port device team_slave_1 added [ 81.965017][ T5606] team0: Port device team_slave_1 added [ 82.028790][ T5609] team0: Port device team_slave_0 added [ 82.085608][ T5609] team0: Port device team_slave_1 added [ 82.086621][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.086631][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.086644][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.088967][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.088980][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.089893][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.091215][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.091227][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.091250][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.095577][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.095590][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.095613][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.118183][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.118200][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.118224][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.119718][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.119734][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.119756][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.127269][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.127285][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.127309][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.131218][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.131234][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.131258][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.220618][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.220635][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.220658][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.495926][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.495955][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.495990][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.799259][ T4918] Bluetooth: hci0: command tx timeout [ 82.847209][ T5603] hsr_slave_0: entered promiscuous mode [ 82.848225][ T5603] hsr_slave_1: entered promiscuous mode [ 82.862947][ T5605] hsr_slave_0: entered promiscuous mode [ 82.863815][ T5605] hsr_slave_1: entered promiscuous mode [ 82.864396][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 82.864475][ T5605] Cannot create hsr debugfs directory [ 82.888599][ T5606] hsr_slave_0: entered promiscuous mode [ 82.889577][ T4918] Bluetooth: hci3: command tx timeout [ 82.889598][ T5616] Bluetooth: hci2: command tx timeout [ 82.889608][ T4918] Bluetooth: hci1: command tx timeout [ 82.893893][ T5606] hsr_slave_1: entered promiscuous mode [ 82.900563][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 82.900589][ T5606] Cannot create hsr debugfs directory [ 82.959329][ T5616] Bluetooth: hci4: command tx timeout [ 82.963755][ T5607] hsr_slave_0: entered promiscuous mode [ 82.965176][ T5607] hsr_slave_1: entered promiscuous mode [ 82.966140][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 82.966162][ T5607] Cannot create hsr debugfs directory [ 83.031319][ T5609] hsr_slave_0: entered promiscuous mode [ 83.032249][ T5609] hsr_slave_1: entered promiscuous mode [ 83.032745][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 83.032764][ T5609] Cannot create hsr debugfs directory [ 83.793318][ T5603] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.864840][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.878106][ T5603] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.913139][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.917743][ T5603] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.956595][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.977243][ T5603] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.020558][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.167931][ T5606] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 84.203235][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.211045][ T5606] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 84.246949][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.257747][ T5606] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 84.282719][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.312044][ T5606] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 84.342494][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.447588][ T5605] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.495793][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.509953][ T5605] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.544153][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.547479][ T5605] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.575608][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.596786][ T5605] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.633726][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.791766][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.831894][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.840514][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 84.879890][ T5616] Bluetooth: hci0: command tx timeout [ 84.886372][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.923850][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 84.942179][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.960262][ T5616] Bluetooth: hci2: command tx timeout [ 84.960281][ T5613] Bluetooth: hci1: command tx timeout [ 84.960293][ T5616] Bluetooth: hci3: command tx timeout [ 85.005262][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.033711][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.039447][ T4918] Bluetooth: hci4: command tx timeout [ 85.164768][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.228267][ T5609] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.263946][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.285633][ T5609] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.312428][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.318670][ T5609] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.355396][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.370838][ T5609] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.403253][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.425536][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.468515][ T3582] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.471500][ T3582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.505607][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.542187][ T3582] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.542274][ T3582] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.640220][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.673174][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.677925][ T3616] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.678030][ T3616] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.732830][ T3616] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.733358][ T3616] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.816027][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.877838][ T992] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.878542][ T992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.915099][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.967072][ T1029] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.967227][ T1029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.082235][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.102039][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.147361][ T3582] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.147457][ T3582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.234676][ T3616] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.234800][ T3616] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.292061][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.354709][ T1029] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.354910][ T1029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.398005][ T1312] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.398154][ T1312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.918072][ T821] cfg80211: failed to load regulatory.db [ 86.959323][ T4918] Bluetooth: hci0: command tx timeout [ 87.040212][ T4918] Bluetooth: hci3: command tx timeout [ 87.040246][ T4918] Bluetooth: hci2: command tx timeout [ 87.041075][ T4918] Bluetooth: hci1: command tx timeout [ 87.044845][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.119227][ T5616] Bluetooth: hci4: command tx timeout [ 87.296423][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.565573][ T5603] veth0_vlan: entered promiscuous mode [ 87.687523][ T5603] veth1_vlan: entered promiscuous mode [ 87.930977][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.936859][ T5603] veth0_macvtap: entered promiscuous mode [ 87.998573][ T5603] veth1_macvtap: entered promiscuous mode [ 88.086929][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.128029][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.222571][ T3616] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.231488][ T3616] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.256962][ T3616] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.277155][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.277314][ T3616] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.301956][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.365097][ T5605] veth0_vlan: entered promiscuous mode [ 88.407051][ T5606] veth0_vlan: entered promiscuous mode [ 88.530593][ T5605] veth1_vlan: entered promiscuous mode [ 88.689313][ T5606] veth1_vlan: entered promiscuous mode [ 88.791554][ T3582] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.791578][ T3582] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.918645][ T5607] veth0_vlan: entered promiscuous mode [ 88.929581][ T5609] veth0_vlan: entered promiscuous mode [ 88.937827][ T5605] veth0_macvtap: entered promiscuous mode [ 88.962226][ T1312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.962246][ T1312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.989977][ T5606] veth0_macvtap: entered promiscuous mode [ 89.010001][ T5605] veth1_macvtap: entered promiscuous mode [ 89.035759][ T5607] veth1_vlan: entered promiscuous mode [ 89.054104][ T5609] veth1_vlan: entered promiscuous mode [ 89.077000][ T5606] veth1_macvtap: entered promiscuous mode [ 89.147840][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.178291][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.208829][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.237357][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.284891][ T1312] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.301197][ T1312] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.303055][ T5607] veth0_macvtap: entered promiscuous mode [ 89.304845][ T1312] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.308744][ T1312] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.356401][ T5609] veth0_macvtap: entered promiscuous mode [ 89.381197][ T1312] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.394688][ T5607] veth1_macvtap: entered promiscuous mode [ 89.410437][ T1312] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.485847][ T5609] veth1_macvtap: entered promiscuous mode [ 89.500013][ T1312] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.516107][ T1312] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.991410][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.197709][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.256928][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.342710][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.391322][ T992] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.397737][ T992] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.425552][ T992] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.435534][ T3582] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.435554][ T3582] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.452232][ T992] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.473126][ T992] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.546641][ T992] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.574505][ T992] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.659884][ T992] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.815850][ T992] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.815871][ T992] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.177896][ T1312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.177914][ T1312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.552075][ T1356] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.552095][ T1356] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.694174][ T1312] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.694196][ T1312] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.944333][ T1356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.944353][ T1356] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.032797][ T3582] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.032817][ T3582] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.329755][ T3582] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.329774][ T3582] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.402545][ T5835] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 94.419438][ T5850] netlink: 132 bytes leftover after parsing attributes in process `syz.0.17'. [ 95.477005][ T5867] netlink: 4 bytes leftover after parsing attributes in process `syz.0.23'. [ 95.593014][ T5868] 9p: Bad value for 'wfdno' [ 95.703145][ T5874] syz.1.28 (5874) used greatest stack depth: 19328 bytes left [ 95.963997][ T5876] sctp: [Deprecated]: syz.3.27 (pid 5876) Use of int in maxseg socket option. [ 95.963997][ T5876] Use struct sctp_assoc_value instead [ 96.211163][ T37] audit: type=1800 audit(1785437406.790:2): pid=5880 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.30" name="dummy_udc" dev="gadgetfs" ino=6955 res=0 errno=0 [ 98.014394][ T5925] kernel read not supported for file /file1 (pid: 5925 comm: syz.3.46) [ 98.017212][ T37] audit: type=1800 audit(1785437408.630:3): pid=5925 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.46" name="file1" dev="mqueue" ino=8685 res=0 errno=0 [ 98.854178][ T5951] netlink: 20 bytes leftover after parsing attributes in process `syz.2.56'. [ 99.236997][ T5970] capability: warning: `syz.2.61' uses deprecated v2 capabilities in a way that may be insecure [ 100.597067][ T5999] netlink: 180 bytes leftover after parsing attributes in process `syz.2.73'. [ 101.381991][ T6013] Bluetooth: MGMT ver 1.23 [ 101.858469][ T6022] warning: `syz.4.82' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 102.017367][ T5719] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 102.308146][ T5719] usb 1-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice= 9.00 [ 102.308176][ T5719] usb 1-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 102.308195][ T5719] usb 1-1: Product: syz [ 102.575616][ T5719] usb 1-1: config 0 descriptor?? [ 102.854337][ T6039] netlink: 48 bytes leftover after parsing attributes in process `syz.2.87'. [ 102.870497][ T5719] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 102.940132][ T5719] usb 1-1: Detected FT232H [ 102.955068][ T5719] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 103.085852][ T6046] bond0: invalid NS target ff00::f9:ffff:ffff:ffff:ff00 specified for addition [ 103.085890][ T6046] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 103.275434][ T6050] vlan0: entered promiscuous mode [ 103.394823][ T6050] team0: Port device vlan0 added [ 103.632699][ T5719] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 103.683561][ T5719] usb 1-1: USB disconnect, device number 2 [ 103.710016][ T197] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 103.872791][ T197] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 103.872818][ T197] usb 3-1: config 0 has no interface number 0 [ 103.872861][ T197] usb 3-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 103.872884][ T197] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 103.872906][ T197] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 103.933446][ T197] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 103.933474][ T197] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 103.933493][ T197] usb 3-1: Product: syz [ 103.933507][ T197] usb 3-1: SerialNumber: syz [ 104.010765][ T197] usb 3-1: config 0 descriptor?? [ 104.046021][ T197] cm109 3-1:0.8: invalid payload size 0, expected 4 [ 104.076192][ T197] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input5 [ 104.168417][ T5719] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 104.244064][ T5719] ftdi_sio 1-1:0.0: device disconnected [ 104.497609][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.501115][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.501370][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.501609][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.501830][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.502052][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.502276][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.502488][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.502706][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 104.502925][ C0] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 105.347441][ C0] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 105.385954][ T197] usb 3-1: USB disconnect, device number 2 [ 105.746176][ T197] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 106.902264][ T6091] netlink: 12 bytes leftover after parsing attributes in process `syz.0.107'. [ 107.567390][ T6104] process 'syz.3.113' launched './file2' with NULL argv: empty string added [ 107.610576][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 107.771047][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 107.772977][ T31] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 107.773000][ T31] usb 2-1: config 0 has no interface number 0 [ 107.800161][ T31] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 107.800190][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.800208][ T31] usb 2-1: Product: syz [ 107.800222][ T31] usb 2-1: Manufacturer: syz [ 107.800235][ T31] usb 2-1: SerialNumber: syz [ 107.918760][ T31] usb 2-1: config 0 descriptor?? [ 107.956591][ T31] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 108.377743][ T31] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 108.449601][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 112 [ 108.654584][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 108.709788][ T6123] syz.4.120 (6123) used greatest stack depth: 17968 bytes left [ 108.788733][ T31] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 108.879274][ T31] usb 2-1: USB disconnect, device number 2 [ 109.419747][ T31] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 109.520936][ T5335] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 109.530295][ T5719] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 109.537366][ T31] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 109.588785][ T31] quatech2 2-1:0.51: device disconnected [ 109.702696][ T5719] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 109.704951][ T5719] usb 3-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 109.704978][ T5719] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 109.704996][ T5719] usb 3-1: Product: syz [ 109.705009][ T5719] usb 3-1: Manufacturer: syz [ 109.795634][ T5335] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 109.795665][ T5335] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 109.795699][ T5335] usb 4-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 109.795721][ T5335] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.882434][ T5719] usb_debug 3-1:1.0: debug converter detected [ 110.007382][ T5719] usb 3-1: debug converter now attached to ttyUSB0 [ 110.042706][ T6133] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 110.042921][ T6133] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 110.044794][ T5719] usb 3-1: USB disconnect, device number 3 [ 110.153436][ T5335] spcp8x5 4-1:1.0: SPCP8x5 converter detected [ 110.173554][ T5335] usb 4-1: SPCP8x5 converter now attached to ttyUSB1 [ 110.195392][ T5719] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 110.221861][ T5719] usb_debug 3-1:1.0: device disconnected [ 110.366298][ T5720] usb 4-1: USB disconnect, device number 2 [ 110.513726][ T5720] SPCP8x5 ttyUSB1: SPCP8x5 converter now disconnected from ttyUSB1 [ 110.532258][ T5720] spcp8x5 4-1:1.0: device disconnected [ 112.137979][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.1.142'. [ 112.571649][ T5335] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 112.740360][ T5335] usb 4-1: not running at top speed; connect to a high speed hub [ 112.741284][ T5335] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 112.741311][ T5335] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.00 [ 112.741323][ T5335] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.815508][ T5335] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 113.017022][ T5335] usb 4-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 113.225163][ T5710] usb 4-1: USB disconnect, device number 3 [ 113.256460][ T6212] batadv_slave_1: entered promiscuous mode [ 113.258184][ T6212] batadv_slave_1: left promiscuous mode [ 113.307331][ T5710] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 113.307869][ T5710] garmin_gps 4-1:1.0: device disconnected [ 114.189751][ T6224] netlink: 'syz.4.156': attribute type 11 has an invalid length. [ 114.409868][ T6229] netlink: 80 bytes leftover after parsing attributes in process `syz.4.158'. [ 115.342276][ T31] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 115.490550][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 115.492744][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 115.492774][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 115.492807][ T31] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 115.492827][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.565913][ T31] usb 5-1: config 0 descriptor?? [ 115.736379][ T31] hub 5-1:0.0: USB hub found [ 115.797929][ T31] hub 5-1:0.0: 1 port detected [ 116.444457][ T31] hub 5-1:0.0: activate --> -90 [ 116.873636][ T5745] hub 5-1:0.0: hub_ext_port_status failed (err = -71) [ 116.873661][ T5745] usb 5-1-port1: connect-debounce failed [ 116.889656][ T6288] netlink: 'syz.2.179': attribute type 3 has an invalid length. [ 116.926687][ T5719] usb 5-1: USB disconnect, device number 2 [ 116.938288][ T3616] usb 5-1: Failed to suspend device, error -19 [ 119.359215][ T4918] Bluetooth: hci4: command 0x0405 tx timeout [ 119.453546][ T6361] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 119.578712][ T6370] Need at least one configuration in g1. [ 119.591006][ T6370] udc dummy_udc.0: failed to start g1: -22 [ 119.591035][ T6370] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 119.667431][ T6370] UDC core: g1: couldn't find an available UDC or it's busy [ 119.903056][ T31] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 119.944094][ T6383] netlink: 20 bytes leftover after parsing attributes in process `syz.0.215'. [ 120.108165][ T31] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 120.108193][ T31] usb 2-1: config 0 has no interface number 0 [ 120.108237][ T31] usb 2-1: config 0 interface 41 has no altsetting 0 [ 120.113944][ T31] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 120.113973][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.113991][ T31] usb 2-1: Product: syz [ 120.114004][ T31] usb 2-1: Manufacturer: syz [ 120.114017][ T31] usb 2-1: SerialNumber: syz [ 120.141669][ T31] usb 2-1: config 0 descriptor?? [ 120.771274][ T9] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 120.938463][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 120.951054][ T9] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 120.951081][ T9] usb 3-1: config 0 has no interface number 0 [ 120.974924][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 120.974953][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.974972][ T9] usb 3-1: Product: syz [ 120.974985][ T9] usb 3-1: Manufacturer: syz [ 120.974998][ T9] usb 3-1: SerialNumber: syz [ 121.048318][ T9] usb 3-1: config 0 descriptor?? [ 121.312862][ T31] CoreChips 2-1:0.41: probe with driver CoreChips failed with error -71 [ 121.362524][ T31] usb 2-1: USB disconnect, device number 3 [ 122.314759][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 122.314788][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 122.315373][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 122.316689][ T9] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 122.370932][ T9] usb 3-1: USB disconnect, device number 4 [ 122.687909][ T6440] tcpci 0-0050: probe with driver tcpci failed with error -5 [ 122.734165][ T6440] i2c i2c-0: new_device: Instantiated device tcpci at 0x50 [ 123.601279][ T6477] trusted_key: syz.0.251 sent an empty control message without MSG_MORE. [ 124.152251][ T6495] netlink: 8 bytes leftover after parsing attributes in process `syz.1.258'. [ 124.879457][ T5720] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 125.009161][ T5335] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 125.029413][ T5720] usb 2-1: Using ep0 maxpacket: 32 [ 125.035208][ T5720] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 125.035232][ T5720] usb 2-1: config 0 has no interface number 0 [ 125.035278][ T5720] usb 2-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 125.035297][ T5720] usb 2-1: config 0 interface 1 has no altsetting 0 [ 125.078261][ T5720] usb 2-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 125.078289][ T5720] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.078307][ T5720] usb 2-1: Product: syz [ 125.078321][ T5720] usb 2-1: Manufacturer: syz [ 125.078332][ T5720] usb 2-1: SerialNumber: syz [ 125.134750][ T5720] usb 2-1: config 0 descriptor?? [ 125.299153][ T5335] usb 5-1: Using ep0 maxpacket: 8 [ 125.304361][ T5335] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 125.304417][ T5335] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 125.304438][ T5335] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 125.304460][ T5335] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 125.304483][ T5335] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 125.304522][ T5335] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 125.304541][ T5335] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.416854][ T5720] cx231xx 2-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 125.461371][ T5720] cx231xx 2-1:0.1: Failed to read PCB config [ 125.461589][ T5720] cx231xx 2-1:0.1: probe with driver cx231xx failed with error -71 [ 125.483831][ T5720] usb 2-1: USB disconnect, device number 4 [ 125.625295][ T5701] udevd[5701]: setting owner of /dev/bus/usb/002/004 to uid=0, gid=0 failed: No such file or directory [ 125.630955][ T5335] usb 5-1: usb_control_msg returned -32 [ 125.631008][ T5335] usbtmc 5-1:16.0: can't read capabilities [ 125.702562][ T6522] erspan0: entered promiscuous mode [ 125.874367][ T6522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.269'. [ 126.014529][ T6533] usbtmc 5-1:16.0: usb_control_msg returned -32 [ 126.046029][ T9] usb 5-1: USB disconnect, device number 3 [ 126.616746][ T6548] netlink: 'syz.1.281': attribute type 11 has an invalid length. [ 127.374003][ T6559] syz.1.285 uses obsolete (PF_INET,SOCK_PACKET) [ 128.202747][ T6578] netlink: 92 bytes leftover after parsing attributes in process `syz.2.290'. [ 129.251953][ T6597] netlink: 8 bytes leftover after parsing attributes in process `syz.0.301'. [ 129.251988][ T6597] netlink: 'syz.0.301': attribute type 10 has an invalid length. [ 129.252003][ T6597] netlink: 12 bytes leftover after parsing attributes in process `syz.0.301'. [ 129.356904][ T6597] geneve2: entered promiscuous mode [ 129.356931][ T6597] geneve2: entered allmulticast mode [ 130.109135][ T197] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 130.281635][ T197] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.283910][ T197] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 130.283938][ T197] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.283955][ T197] usb 5-1: Product: syz [ 130.283968][ T197] usb 5-1: Manufacturer: syz [ 130.283982][ T197] usb 5-1: SerialNumber: syz [ 130.720188][ T5710] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 130.781554][ T6638] netlink: 'syz.0.318': attribute type 1 has an invalid length. [ 130.781574][ T6638] netlink: 'syz.0.318': attribute type 4 has an invalid length. [ 130.781586][ T6638] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.318'. [ 130.879897][ T5710] usb 4-1: Using ep0 maxpacket: 8 [ 130.887363][ T5710] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 130.887391][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.887410][ T5710] usb 4-1: Product: syz [ 130.887422][ T5710] usb 4-1: Manufacturer: syz [ 130.887435][ T5710] usb 4-1: SerialNumber: syz [ 130.946963][ T6642] netlink: 27 bytes leftover after parsing attributes in process `syz.0.320'. [ 130.990030][ T5710] usb 4-1: config 0 descriptor?? [ 131.203199][ T5710] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 131.425425][ T5710] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 131.429468][ T197] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 131.429504][ T197] cdc_ncm 5-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 131.429520][ T197] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 131.468810][ T5710] usb 4-1: USB disconnect, device number 4 [ 131.632186][ T197] cdc_ncm 5-1:1.0: setting tx_max = 88 [ 131.770368][ T197] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 131.811220][ T197] usb 5-1: USB disconnect, device number 4 [ 131.813966][ T197] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 132.459164][ T5720] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 132.628159][ T5720] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 132.628188][ T5720] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.628207][ T5720] usb 4-1: Product: syz [ 132.628220][ T5720] usb 4-1: Manufacturer: syz [ 132.628234][ T5720] usb 4-1: SerialNumber: syz [ 132.946108][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.946204][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.069156][ T6667] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 133.258929][ T5720] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 133.271035][ T5720] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 133.880863][ T5720] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 133.880912][ T5720] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 133.970308][ T5720] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 134.080688][ T5720] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 134.119938][ T5720] usb 4-1: USB disconnect, device number 5 [ 134.541062][ T6682] kvm: user requested TSC rate below hardware speed [ 137.293265][ T6743] netlink: 'syz.1.352': attribute type 83 has an invalid length. [ 137.380135][ T6739] gretap1: entered promiscuous mode [ 138.317112][ T6782] capability: warning: `syz.1.361' uses 32-bit capabilities (legacy support in use) [ 139.043130][ T5616] Bluetooth: hci4: unexpected event for opcode 0x041b [ 139.189365][ T6802] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 139.189392][ T6802] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 139.317819][ T6802] vhci_hcd vhci_hcd.0: Device attached [ 139.363981][ T6805] vhci_hcd: connection closed [ 139.380317][ T1311] vhci_hcd vhci_hcd.2: stop threads [ 139.381228][ T1311] vhci_hcd vhci_hcd.2: release socket [ 139.381341][ T1311] vhci_hcd vhci_hcd.2: disconnect device [ 139.739208][ T5710] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 139.805996][ T6799] team0: Port device vlan0 removed [ 139.918177][ T5710] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 139.918207][ T5710] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.918226][ T5710] usb 4-1: Product: syz [ 139.918240][ T5710] usb 4-1: Manufacturer: syz [ 139.918254][ T5710] usb 4-1: SerialNumber: syz [ 139.988680][ T6810] netlink: 8 bytes leftover after parsing attributes in process `syz.4.373'. [ 140.061573][ T37] audit: type=1326 audit(1785437450.680:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.061692][ T37] audit: type=1326 audit(1785437450.680:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.061803][ T37] audit: type=1326 audit(1785437450.680:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.061918][ T37] audit: type=1326 audit(1785437450.680:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.062027][ T37] audit: type=1326 audit(1785437450.680:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.062162][ T37] audit: type=1326 audit(1785437450.680:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.062271][ T37] audit: type=1326 audit(1785437450.680:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.062412][ T37] audit: type=1326 audit(1785437450.680:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.062521][ T37] audit: type=1326 audit(1785437450.680:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.068204][ T37] audit: type=1326 audit(1785437450.680:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6798 comm="syz.0.369" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d9e29e019 code=0x7fc00000 [ 140.073652][ T5710] usb 4-1: config 0 descriptor?? [ 140.168404][ T5710] ch341 4-1:0.0: ch341-uart converter detected [ 141.056793][ T6832] trusted_key: encrypted_key: insufficient parameters specified [ 141.259993][ T6836] Zero length message leads to an empty skb [ 141.457443][ T5710] ch341-uart ttyUSB0: break control not supported, using simulated break [ 141.478928][ T5710] usb 4-1: ch341-uart converter now attached to ttyUSB0 [ 141.509973][ T5710] usb 4-1: USB disconnect, device number 6 [ 141.543333][ T5710] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 141.564402][ T5710] ch341 4-1:0.0: device disconnected [ 141.789317][ T6843] ======================================================= [ 141.789317][ T6843] WARNING: The mand mount option has been deprecated and [ 141.789317][ T6843] and is ignored by this kernel. Remove the mand [ 141.789317][ T6843] option from the mount to silence this warning. [ 141.789317][ T6843] ======================================================= [ 142.289356][ T5335] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 142.588884][ T6858] io-wq is not configured for unbound workers [ 145.759216][ T5719] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 145.921274][ T5719] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 145.921304][ T5719] usb 1-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 145.921326][ T5719] usb 1-1: config 1 interface 0 has no altsetting 0 [ 145.979161][ T5719] usb 1-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 145.979189][ T5719] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.979207][ T5719] usb 1-1: Product: syz [ 145.979220][ T5719] usb 1-1: Manufacturer: syz [ 145.979234][ T5719] usb 1-1: SerialNumber: syz [ 146.031155][ T6912] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 146.031273][ T6912] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 146.390613][ T5719] rtl8150 1-1:1.0: couldn't reset the device [ 146.390965][ T5719] rtl8150 1-1:1.0: probe with driver rtl8150 failed with error -5 [ 146.454457][ T6929] ip6gre1: entered allmulticast mode [ 146.477575][ T5719] usb 1-1: USB disconnect, device number 3 [ 146.627555][ T1356] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 146.983784][ T6941] Illegal XDP return value 4294967294 on prog (id 28) dev N/A, expect packet loss! [ 147.230308][ T6946] netlink: 68 bytes leftover after parsing attributes in process `syz.0.424'. [ 147.322966][ T6947] netlink: 4 bytes leftover after parsing attributes in process `syz.4.425'. [ 147.533523][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888026541c00: rx timeout, send abort [ 147.818476][ T5719] kernel write not supported for file [eventfd] (pid: 5719 comm: kworker/0:4) [ 148.034091][ C0] vxcan1: j1939_tp_rxtimer: 0xffff88805d6e2400: rx timeout, send abort [ 148.034477][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888026541c00: abort rx timeout. Force session deactivation [ 148.321174][ T4918] Bluetooth: hci5: command 0x1003 tx timeout [ 148.355293][ T5616] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 150.569339][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 151.970928][ T7045] netlink: 16 bytes leftover after parsing attributes in process `syz.4.455'. [ 152.215810][ T7032] team0: Port device syz_tun added [ 153.045908][ T7071] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[5603] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ  "[7071] [ 153.412324][ T7082] netlink: 8 bytes leftover after parsing attributes in process `syz.1.468'. [ 154.146681][ T7109] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 154.174140][ T7110] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 154.242940][ T7107] team0: Port device syz_tun added [ 154.770801][ T7126] kvm: MONITOR instruction emulated as NOP! [ 154.821677][ T7129] netlink: 144 bytes leftover after parsing attributes in process `syz.2.481'. [ 154.904170][ T7131] sctp: [Deprecated]: syz.3.483 (pid 7131) Use of int in maxseg socket option. [ 154.904170][ T7131] Use struct sctp_assoc_value instead [ 155.800484][ T7154] tipc: Started in network mode [ 155.800511][ T7154] tipc: Node identity 4, cluster identity 4711 [ 155.800522][ T7154] tipc: Node number set to 4 [ 155.986599][ T7163] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 156.219457][ T7171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 156.294670][ T7171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 156.309986][ T5335] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 156.389900][ T37] kauditd_printk_skb: 7 callbacks suppressed [ 156.389916][ T37] audit: type=1326 audit(1785437467.010:21): auid=4294967295 uid=255 gid=0 ses=4294967295 subj=_ pid=7172 comm="syz.4.501" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff14311e019 code=0x0 [ 156.464117][ T5335] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 156.464143][ T5335] usb 4-1: config 0 has no interface number 0 [ 156.464201][ T5335] usb 4-1: config 0 interface 41 has no altsetting 0 [ 156.468506][ T5335] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 156.468535][ T5335] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 156.468552][ T5335] usb 4-1: Product: syz [ 156.468564][ T5335] usb 4-1: Manufacturer: syz [ 156.468576][ T5335] usb 4-1: SerialNumber: syz [ 156.543436][ T5335] usb 4-1: config 0 descriptor?? [ 157.590625][ T5335] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 157.628624][ T5335] usb 4-1: USB disconnect, device number 7 [ 157.795587][ T7205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.511'. [ 157.821775][ T7205] netlink: 12 bytes leftover after parsing attributes in process `syz.2.511'. [ 158.288642][ T7211] netlink: 12 bytes leftover after parsing attributes in process `syz.4.514'. [ 158.484330][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 158.536965][ T4918] block nbd0: Receive control failed (result -107) [ 158.956658][ T7203] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 160.296506][ T7260] netlink: 1204 bytes leftover after parsing attributes in process `syz.4.533'. [ 160.385813][ T7264] netlink: 16 bytes leftover after parsing attributes in process `syz.3.534'. [ 161.140302][ T197] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 161.289124][ T197] usb 1-1: Using ep0 maxpacket: 32 [ 161.291303][ T197] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 161.291333][ T197] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 161.291367][ T197] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 161.291403][ T197] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 161.371569][ T197] usb 1-1: config 0 descriptor?? [ 161.394217][ T197] hub 1-1:0.0: USB hub found [ 161.439216][ T5745] page_pool_release_retry() stalled pool shutdown: id 26, 1 inflight 60 sec [ 161.598078][ T197] hub 1-1:0.0: 1 port detected [ 162.222658][ T197] hub 1-1:0.0: activate --> -90 [ 162.439673][ T7315] af_packet: tpacket_rcv: packet too big, clamped from 65512 to 4294967272. macoff=96 [ 162.634303][ T5720] hub 1-1:0.0: hub_ext_port_status failed (err = -71) [ 162.705542][ T5335] usb 1-1: USB disconnect, device number 4 [ 162.705754][ T1328] usb 1-1: Failed to suspend device, error -19 [ 162.849114][ T5745] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 162.999412][ T5745] usb 2-1: Using ep0 maxpacket: 32 [ 163.001893][ T5745] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 163.001924][ T5745] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 163.001959][ T5745] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 163.001980][ T5745] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 163.055092][ T5745] usb 2-1: config 0 descriptor?? [ 163.070893][ T5745] hub 2-1:0.0: USB hub found [ 163.109160][ T31] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 163.184808][ T7330] netlink: 104 bytes leftover after parsing attributes in process `syz.3.561'. [ 163.282786][ T5745] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 163.311294][ T31] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 163.311323][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.311400][ T31] usb 5-1: Product: syz [ 163.311414][ T31] usb 5-1: Manufacturer: syz [ 163.311428][ T31] usb 5-1: SerialNumber: syz [ 163.373509][ T31] usb 5-1: config 0 descriptor?? [ 163.503783][ T7337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.563'. [ 163.503829][ T7337] netlink: 8 bytes leftover after parsing attributes in process `syz.0.563'. [ 163.591242][ T31] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 163.779764][ T5745] hid-generic 0003:046D:C31C.0001: unknown main item tag 0x0 [ 164.153261][ T7351] lo: entered promiscuous mode [ 164.196395][ T7351] tunl0: entered promiscuous mode [ 164.252730][ T7351] gre0: entered promiscuous mode [ 164.405244][ T5745] hid-generic 0003:046D:C31C.0001: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 164.537565][ T5745] usb 2-1: USB disconnect, device number 5 [ 164.547757][ T7351] gretap0: entered promiscuous mode [ 164.646154][ T31] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 164.694128][ T7351] ip_vti0: entered promiscuous mode [ 164.728653][ T31] usb 5-1: USB disconnect, device number 6 [ 164.825735][ T7351] ip6_vti0: entered promiscuous mode [ 164.863380][ T7351] sit0: entered promiscuous mode [ 164.911396][ T7351] ip6tnl0: entered promiscuous mode [ 164.950090][ T7354] fido_id[7354]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 165.056020][ T7351] ip6gre0: entered promiscuous mode [ 165.109697][ T7351] syz_tun: entered promiscuous mode [ 165.254903][ T7351] ip6gretap0: entered promiscuous mode [ 165.376628][ T7351] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.553068][ T7351] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.556008][ T7351] bridge0: entered promiscuous mode [ 165.590678][ T7351] vcan0: entered promiscuous mode [ 165.635949][ T7351] bond0: entered promiscuous mode [ 165.635964][ T7351] bond_slave_0: entered promiscuous mode [ 165.636105][ T7351] bond_slave_1: entered promiscuous mode [ 165.740923][ T7351] team0: entered promiscuous mode [ 165.740939][ T7351] team_slave_0: entered promiscuous mode [ 165.741083][ T7351] team_slave_1: entered promiscuous mode [ 165.827550][ T7351] dummy0: entered promiscuous mode [ 165.911742][ T5720] usb 5-1: new low-speed USB device number 7 using dummy_hcd [ 166.000581][ T7351] nlmon0: entered promiscuous mode [ 166.020036][ T7351] batadv0: entered promiscuous mode [ 166.027557][ T7351] vxcan0: entered promiscuous mode [ 166.030315][ T7351] vxcan1: entered promiscuous mode [ 166.067640][ T5720] usb 5-1: config 0 has no interfaces? [ 166.067677][ T5720] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 166.067698][ T5720] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.078398][ T7351] veth0: entered promiscuous mode [ 166.080537][ T5720] usb 5-1: config 0 descriptor?? [ 166.121773][ T7351] veth1: entered promiscuous mode [ 166.289595][ T7351] wg0: entered promiscuous mode [ 166.327660][ T5719] usb 5-1: USB disconnect, device number 7 [ 166.338426][ T7351] wg1: entered promiscuous mode [ 166.413575][ T7351] wg2: entered promiscuous mode [ 166.427848][ T7351] veth0_to_bridge: entered promiscuous mode [ 166.461717][ T7351] veth1_to_bridge: entered promiscuous mode [ 166.550564][ T7351] veth0_to_bond: entered promiscuous mode [ 166.567382][ T7351] veth1_to_bond: entered promiscuous mode [ 166.603829][ T7351] veth0_to_team: entered promiscuous mode [ 166.647363][ T7351] veth1_to_team: entered promiscuous mode [ 166.759486][ T7351] veth0_to_batadv: entered promiscuous mode [ 166.777410][ T7351] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 166.780772][ T7351] batadv_slave_0: entered promiscuous mode [ 166.793908][ T7351] veth1_to_batadv: entered promiscuous mode [ 166.844737][ T7351] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 166.844828][ T7351] batadv_slave_1: entered promiscuous mode [ 166.980468][ T7351] xfrm0: entered promiscuous mode [ 167.063469][ T7351] veth0_to_hsr: entered promiscuous mode [ 167.126685][ T7351] veth1_to_hsr: entered promiscuous mode [ 167.170595][ T7351] hsr0: entered promiscuous mode [ 167.189776][ T7351] veth1_virt_wifi: entered promiscuous mode [ 167.255971][ T7351] veth0_virt_wifi: entered promiscuous mode [ 167.267051][ T7351] virt_wifi0: entered promiscuous mode [ 167.486513][ T7351] vlan0: entered promiscuous mode [ 167.531741][ T7351] vlan1: entered promiscuous mode [ 167.640754][ T7351] macvlan0: entered promiscuous mode [ 167.686083][ T7351] macvlan1: entered promiscuous mode [ 167.706785][ T7351] ipvlan0: entered promiscuous mode [ 167.706995][ T7351] ipvlan1: entered promiscuous mode [ 167.851181][ T7351] macvtap0: entered promiscuous mode [ 167.902415][ T7351] macsec0: entered promiscuous mode [ 167.964901][ T7351] geneve0: entered promiscuous mode [ 167.977653][ T7351] geneve1: entered promiscuous mode [ 168.081921][ T7351] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 168.082646][ T7410] netlink: 'syz.0.588': attribute type 4 has an invalid length. [ 168.082662][ T7410] netlink: 'syz.0.588': attribute type 1 has an invalid length. [ 168.082674][ T7410] netlink: 61175 bytes leftover after parsing attributes in process `syz.0.588'. [ 168.470180][ T7351] netdevsim netdevsim2 netdevsim1: entered promiscuous mode [ 168.651509][ T7351] netdevsim netdevsim2 netdevsim2: entered promiscuous mode [ 169.018879][ T7351] netdevsim netdevsim2 netdevsim3: entered promiscuous mode [ 169.551428][ T7351] mac80211_hwsim hwsim9 wlan0: entered promiscuous mode [ 169.583948][ T7351] ip6gre1: entered promiscuous mode [ 169.583971][ T7351] ip6gre1: left allmulticast mode [ 169.640665][ T7360] netlink: 20 bytes leftover after parsing attributes in process `syz.3.572'. [ 169.640904][ T7362] netlink: 20 bytes leftover after parsing attributes in process `syz.3.572'. [ 169.855519][ T1311] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.857704][ T1311] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.857944][ T1311] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.858037][ T1311] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 170.994115][ T7461] kvm: emulating exchange as write [ 172.788576][ T7499] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 172.791131][ T7499] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 172.866251][ T7491] input: syz1 as /devices/virtual/input/input6 [ 172.892268][ T7493] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 173.009113][ T7493] udc dummy_udc.0: failed to start g1: -19 [ 173.201525][ T7493] UDC core: g1: couldn't find an available UDC or it's busy [ 174.762755][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 174.939266][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 174.941747][ T9] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 174.941791][ T9] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 174.941803][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 174.941815][ T9] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 174.941826][ T9] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 174.941847][ T9] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 174.941858][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 175.231292][ T9] usb 1-1: usb_control_msg returned -32 [ 175.231320][ T9] usbtmc 1-1:16.0: can't read capabilities [ 177.026415][ T7571] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 178.855872][ T31] usb 1-1: USB disconnect, device number 5 [ 180.229065][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 182.858595][ T37] audit: type=1326 audit(1785437493.470:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7638 comm="syz.1.661" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=39 compat=0 ip=0x7f798ae87d97 code=0x0 [ 183.354893][ T7658] netlink: 28 bytes leftover after parsing attributes in process `syz.4.665'. [ 183.865633][ T7672] tmpfs: Unsupported parameter 'huge' [ 183.926433][ T7672] program syz.3.669 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 184.789274][ T7688] kvm: user requested TSC rate below hardware speed [ 186.929183][ T31] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 187.120879][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 187.123757][ T31] usb 5-1: config 0 has no interfaces? [ 187.126005][ T31] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 187.126032][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 187.126050][ T31] usb 5-1: Product: syz [ 187.126064][ T31] usb 5-1: Manufacturer: syz [ 187.126077][ T31] usb 5-1: SerialNumber: syz [ 187.215852][ T31] usb 5-1: config 0 descriptor?? [ 187.426100][ T5710] usb 5-1: USB disconnect, device number 8 [ 189.659156][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 189.797079][ T7781] netlink: 32 bytes leftover after parsing attributes in process `syz.0.706'. [ 189.849281][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 189.853002][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 189.853033][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 189.854032][ T9] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 189.854055][ T9] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 189.854071][ T9] usb 3-1: Manufacturer: syz [ 189.929973][ T9] usb 3-1: config 0 descriptor?? [ 190.049374][ T5745] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 190.222472][ T5745] usb 4-1: config 1 interface 0 has no altsetting 2 [ 190.222512][ T5745] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00 [ 190.222533][ T5745] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.362575][ T9] creative-sb0540 0003:041E:3100.0002: reserved main item tag 0xe [ 190.362615][ T9] creative-sb0540 0003:041E:3100.0002: item fetching failed at offset 3/5 [ 190.363204][ T9] creative-sb0540 0003:041E:3100.0002: parse failed [ 190.363305][ T9] creative-sb0540 0003:041E:3100.0002: probe with driver creative-sb0540 failed with error -22 [ 190.557087][ T9] usb 3-1: USB disconnect, device number 5 [ 190.710082][ T5745] dvbdev: DVB: registering new adapter (DEC2000-t) [ 190.990578][ T5745] usb 4-1: DVB: registering adapter 1 frontend 0 (TechnoTrend/Hauppauge DEC2000-t Frontend)... [ 191.932843][ T5745] ttusb_dec_send_command: command bulk message failed: error -71 [ 192.154375][ T5745] usb 4-1: USB disconnect, device number 8 [ 192.463030][ T7806] i2c i2c-0: new_device: Instantiated device nb7vpq904m at 0x10 [ 193.152782][ T37] audit: type=1326 audit(1785437503.770:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7825 comm="syz.1.723" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f798ae8e019 code=0x0 [ 194.331432][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.307481][ T5719] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 195.367010][ T5719] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 195.690582][ T37] audit: type=1800 audit(1785437506.310:24): pid=7863 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.734" name="file1" dev="tmpfs" ino=739 res=0 errno=0 [ 195.809168][ T197] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 195.868780][ T7865] ==============================================================[ 195.868780][ T7865] ================================================================== [ 195.868797][ T7865] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 [ 195.868831][ T7865] Read of size 8 at addr ffff88803d314d90 by task syz.2.735/7865 [ 195.868849][ T7865] [ 195.868871][ T7865] CPU: 1 UID: 0 PID: 7865 Comm: syz.2.735 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 195.868900][ T7865] Tainted: [L]=SOFTLOCKUP [ 195.868907][ T7865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.868920][ T7865] Call Trace: [ 195.868927][ T7865] [ 195.868935][ T7865] dump_stack_lvl+0xe8/0x150 [ 195.868967][ T7865] print_address_description+0x55/0x1e0 [ 195.869001][ T7865] ? filp_flush+0x31/0x190 [ 195.869020][ T7865] print_report+0x58/0x70 [ 195.869045][ T7865] kasan_report+0x117/0x150 [ 195.869069][ T7865] ? filp_flush+0x31/0x190 [ 195.869092][ T7865] kasan_check_range+0x264/0x2c0 [ 195.869116][ T7865] filp_flush+0x31/0x190 [ 195.869136][ T7865] filp_close+0x1d/0x40 [ 195.869157][ T7865] gaudio_cleanup+0x54/0xf0 [ 195.869196][ T7865] f_audio_bind+0x4a0/0x630 [ 195.869223][ T7865] ? __pfx_f_audio_bind+0x10/0x10 [ 195.869244][ T7865] ? kasan_quarantine_put+0xbb/0x1f0 [ 195.869260][ T7865] ? lockdep_hardirqs_on+0x7a/0x110 [ 195.869286][ T7865] usb_add_function+0x290/0x930 [ 195.869307][ T7865] ? check_remote_wakeup_config+0x58/0x1c0 [ 195.869331][ T7865] configfs_composite_bind+0xde0/0x1410 [ 195.869357][ T7865] ? __pfx_configfs_composite_bind+0x10/0x10 [ 195.869379][ T7865] gadget_bind_driver+0x2ca/0x9e0 [ 195.869413][ T7865] ? __pfx_gadget_bind_driver+0x10/0x10 [ 195.869440][ T7865] really_probe+0x254/0xae0 [ 195.869469][ T7865] __driver_probe_device+0x1e8/0x360 [ 195.869495][ T7865] driver_probe_device+0x4f/0x240 [ 195.869523][ T7865] __driver_attach+0x339/0x600 [ 195.869551][ T7865] bus_for_each_dev+0x23e/0x2c0 [ 195.869571][ T7865] ? __pfx___driver_attach+0x10/0x10 [ 195.869595][ T7865] ? __pfx_bus_for_each_dev+0x10/0x10 [ 195.869615][ T7865] ? rt_spin_unlock+0x163/0x200 [ 195.869644][ T7865] bus_add_driver+0x348/0x670 [ 195.869683][ T7865] driver_register+0x23a/0x320 [ 195.869713][ T7865] usb_gadget_register_driver_owner+0xf9/0x270 [ 195.869745][ T7865] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 195.869771][ T7865] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 195.869795][ T7865] configfs_write_iter+0x33a/0x430 [ 195.869816][ T7865] vfs_write+0x61e/0xbb0 [ 195.869838][ T7865] ? __pfx_vfs_write+0x10/0x10 [ 195.869858][ T7865] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 195.869878][ T7865] ? lockdep_hardirqs_on+0x7a/0x110 [ 195.869901][ T7865] ? mutex_lock_nested+0x152/0x1d0 [ 195.869928][ T7865] ? fdget_pos+0x252/0x320 [ 195.869952][ T7865] ksys_write+0x156/0x270 [ 195.869978][ T7865] ? __pfx_ksys_write+0x10/0x10 [ 195.870004][ T7865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.870024][ T7865] do_syscall_64+0x174/0x580 [ 195.870049][ T7865] ? trace_irq_disable+0x3b/0x140 [ 195.870068][ T7865] ? clear_bhb_loop+0x40/0x90 [ 195.870089][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.870108][ T7865] RIP: 0033:0x7f099401e019 [ 195.870136][ T7865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.870153][ T7865] RSP: 002b:00007f0992276028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 195.870182][ T7865] RAX: ffffffffffffffda RBX: 00007f09942a5fa0 RCX: 00007f099401e019 [ 195.870204][ T7865] RDX: 000000000000000c RSI: 00002000000002c0 RDI: 0000000000000004 [ 195.870217][ T7865] RBP: 00007f09940b500c R08: 0000000000000000 R09: 0000000000000000 [ 195.870229][ T7865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 195.870240][ T7865] R13: 00007f09942a6038 R14: 00007f09942a5fa0 R15: 00007fffbbfd75a8 [ 195.870264][ T7865] [ 195.870272][ T7865] [ 195.870276][ T7865] Allocated by task 5603: [ 195.870287][ T7865] kasan_save_track+0x3e/0x80 [ 195.870306][ T7865] __kasan_slab_alloc+0x6c/0x80 [ 195.870326][ T7865] kmem_cache_alloc_noprof+0x355/0x650 [ 195.870344][ T7865] alloc_empty_file+0x5b/0x1d0 [ 195.870361][ T7865] alloc_file_pseudo+0x115/0x1e0 [ 195.870379][ T7865] sock_alloc_file+0xb8/0x2f0 [ 195.870406][ T7865] __sys_socket+0x13f/0x1b0 [ 195.870422][ T7865] __x64_sys_socket+0x7a/0x90 [ 195.870438][ T7865] do_syscall_64+0x174/0x580 [ 195.870461][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.870480][ T7865] [ 195.870484][ T7865] Freed by task 20: [ 195.870493][ T7865] kasan_save_track+0x3e/0x80 [ 195.870507][ T7865] kasan_save_free_info+0x40/0x50 [ 195.870529][ T7865] __kasan_slab_free+0x5c/0x80 [ 195.870547][ T7865] slab_free_after_rcu_debug+0x12a/0x220 [ 195.870572][ T7865] rcu_cpu_kthread+0x950/0x1480 [ 195.870594][ T7865] smpboot_thread_fn+0x57c/0xa80 [ 195.870619][ T7865] kthread+0x388/0x470 [ 195.870649][ T7865] ret_from_fork+0x514/0xb70 [ 195.870675][ T7865] ret_from_fork_asm+0x1a/0x30 [ 195.870690][ T7865] [ 195.870696][ T7865] Last potentially related work creation: [ 195.870704][ T7865] kasan_save_stack+0x3e/0x60 [ 195.870721][ T7865] kasan_record_aux_stack+0xbd/0xd0 [ 195.870745][ T7865] kmem_cache_free+0x513/0x6c0 [ 195.870766][ T7865] fput_close_sync+0x11f/0x240 [ 195.870783][ T7865] __x64_sys_close+0x7e/0x110 [ 195.870799][ T7865] do_syscall_64+0x174/0x580 [ 195.870818][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.870835][ T7865] [ 195.870839][ T7865] The buggy address belongs to the object at ffff88803d314c00 [ 195.870839][ T7865] which belongs to the cache filp of size 408 [ 195.870853][ T7865] The buggy address is located 400 bytes inside of [ 195.870853][ T7865] freed 408-byte region [ffff88803d314c00, ffff88803d314d98) [ 195.870874][ T7865] [ 195.870879][ T7865] The buggy address belongs to the physical page: [ 195.870901][ T7865] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88803d315800 pfn:0x3d314 [ 195.870920][ T7865] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 195.870936][ T7865] memcg:ffff88803226ac01 [ 195.870946][ T7865] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 195.870967][ T7865] page_type: f5(slab) [ 195.870986][ T7865] raw: 0080000000000240 ffff888140416000 ffffea0000a9f310 ffffea000088f210 [ 195.871005][ T7865] raw: ffff88803d315800 000000080010000f 00000000f5000000 ffff88803226ac01 [ 195.871023][ T7865] head: 0080000000000240 ffff888140416000 ffffea0000a9f310 ffffea000088f210 [ 195.871042][ T7865] head: ffff88803d315800 000000080010000f 00000000f5000000 ffff88803226ac01 [ 195.871061][ T7865] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 195.871078][ T7865] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 195.871088][ T7865] page dumped because: kasan: bad access detected [ 195.871102][ T7865] page_owner tracks the page as allocated [ 195.871109][ T7865] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4980, tgid 4980 (udevd), ts 31051384709, free_ts 0 [ 195.871144][ T7865] post_alloc_hook+0x1f9/0x250 [ 195.871164][ T7865] get_page_from_freelist+0x262a/0x26a0 [ 195.871186][ T7865] __alloc_frozen_pages_noprof+0x18d/0x380 [ 195.871211][ T7865] allocate_slab+0x79/0x5e0 [ 195.871233][ T7865] refill_objects+0x2d8/0x350 [ 195.871258][ T7865] __pcs_replace_empty_main+0x330/0x690 [ 195.871281][ T7865] kmem_cache_alloc_noprof+0x452/0x650 [ 195.871297][ T7865] alloc_empty_file+0x5b/0x1d0 [ 195.871315][ T7865] path_openat+0x8f/0x3850 [ 195.871336][ T7865] do_file_open+0x23e/0x4a0 [ 195.871357][ T7865] do_sys_openat2+0x115/0x200 [ 195.871373][ T7865] __x64_sys_openat+0x138/0x170 [ 195.871389][ T7865] do_syscall_64+0x174/0x580 [ 195.871410][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.871429][ T7865] page_owner free stack trace missing [ 195.871436][ T7865] [ 195.871441][ T7865] Memory state around the buggy address: [ 195.871452][ T7865] ffff88803d314c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.871467][ T7865] ffff88803d314d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.871480][ T7865] >ffff88803d314d80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 195.871491][ T7865] ^ [ 195.871501][ T7865] ffff88803d314e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.871515][ T7865] ffff88803d314e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.871525][ T7865] ================================================================== [ 195.877373][ T7865] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 195.877398][ T7865] CPU: 1 UID: 0 PID: 7865 Comm: syz.2.735 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 195.877424][ T7865] Tainted: [L]=SOFTLOCKUP [ 195.877431][ T7865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.877441][ T7865] Call Trace: [ 195.877448][ T7865] [ 195.877456][ T7865] vpanic+0x56c/0xa60 [ 195.877480][ T7865] ? rcu_is_watching+0x15/0xb0 [ 195.877505][ T7865] ? __pfx_vpanic+0x10/0x10 [ 195.877528][ T7865] panic+0xc5/0xd0 [ 195.877545][ T7865] ? __pfx_panic+0x10/0x10 [ 195.877563][ T7865] ? preempt_schedule_thunk+0x16/0x40 [ 195.877587][ T7865] ? filp_flush+0x31/0x190 [ 195.877607][ T7865] ? preempt_schedule_thunk+0x16/0x40 [ 195.877630][ T7865] ? filp_flush+0x31/0x190 [ 195.877648][ T7865] check_panic_on_warn+0x89/0xb0 [ 195.877667][ T7865] ? filp_flush+0x31/0x190 [ 195.877686][ T7865] end_report+0x73/0x170 [ 195.877708][ T7865] ? filp_flush+0x31/0x190 [ 195.877726][ T7865] kasan_report+0x128/0x150 [ 195.877749][ T7865] ? filp_flush+0x31/0x190 [ 195.877773][ T7865] kasan_check_range+0x264/0x2c0 [ 195.877798][ T7865] filp_flush+0x31/0x190 [ 195.877819][ T7865] filp_close+0x1d/0x40 [ 195.877838][ T7865] gaudio_cleanup+0x54/0xf0 [ 195.877865][ T7865] f_audio_bind+0x4a0/0x630 [ 195.877891][ T7865] ? __pfx_f_audio_bind+0x10/0x10 [ 195.877916][ T7865] ? kasan_quarantine_put+0xbb/0x1f0 [ 195.877934][ T7865] ? lockdep_hardirqs_on+0x7a/0x110 [ 195.877959][ T7865] usb_add_function+0x290/0x930 [ 195.877980][ T7865] ? check_remote_wakeup_config+0x58/0x1c0 [ 195.878003][ T7865] configfs_composite_bind+0xde0/0x1410 [ 195.878031][ T7865] ? __pfx_configfs_composite_bind+0x10/0x10 [ 195.878053][ T7865] gadget_bind_driver+0x2ca/0x9e0 [ 195.878091][ T7865] ? __pfx_gadget_bind_driver+0x10/0x10 [ 195.878118][ T7865] really_probe+0x254/0xae0 [ 195.878148][ T7865] __driver_probe_device+0x1e8/0x360 [ 195.878175][ T7865] driver_probe_device+0x4f/0x240 [ 195.878210][ T7865] __driver_attach+0x339/0x600 [ 195.878238][ T7865] bus_for_each_dev+0x23e/0x2c0 [ 195.878259][ T7865] ? __pfx___driver_attach+0x10/0x10 [ 195.878283][ T7865] ? __pfx_bus_for_each_dev+0x10/0x10 [ 195.878306][ T7865] ? rt_spin_unlock+0x163/0x200 [ 195.878338][ T7865] bus_add_driver+0x348/0x670 [ 195.878362][ T7865] driver_register+0x23a/0x320 [ 195.878391][ T7865] usb_gadget_register_driver_owner+0xf9/0x270 [ 195.878420][ T7865] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 195.878450][ T7865] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 195.878479][ T7865] configfs_write_iter+0x33a/0x430 [ 195.878504][ T7865] vfs_write+0x61e/0xbb0 [ 195.878531][ T7865] ? __pfx_vfs_write+0x10/0x10 [ 195.878555][ T7865] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 195.878577][ T7865] ? lockdep_hardirqs_on+0x7a/0x110 [ 195.878599][ T7865] ? mutex_lock_nested+0x152/0x1d0 [ 195.878626][ T7865] ? fdget_pos+0x252/0x320 [ 195.878650][ T7865] ksys_write+0x156/0x270 [ 195.878674][ T7865] ? __pfx_ksys_write+0x10/0x10 [ 195.878700][ T7865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.878720][ T7865] do_syscall_64+0x174/0x580 [ 195.878743][ T7865] ? trace_irq_disable+0x3b/0x140 [ 195.878761][ T7865] ? clear_bhb_loop+0x40/0x90 [ 195.878783][ T7865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.878801][ T7865] RIP: 0033:0x7f099401e019 [ 195.878819][ T7865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 195.878835][ T7865] RSP: 002b:00007f0992276028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 195.878855][ T7865] RAX: ffffffffffffffda RBX: 00007f09942a5fa0 RCX: 00007f099401e019 [ 195.878870][ T7865] RDX: 000000000000000c RSI: 00002000000002c0 RDI: 0000000000000004 [ 195.878883][ T7865] RBP: 00007f09940b500c R08: 0000000000000000 R09: 0000000000000000 [ 195.878895][ T7865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 195.878906][ T7865] R13: 00007f09942a6038 R14: 00007f09942a5fa0 R15: 00007fffbbfd75a8 [ 195.878928][ T7865] [ 195.879080][ T7865] Kernel Offset: disabled