last executing test programs: 3m26.996734144s ago: executing program 0 (id=465): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtclass={0x24, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff1}, {0x1, 0xfff1}, {0xfff2}}}, 0x24}}, 0x448c0) 3m23.56766012s ago: executing program 0 (id=470): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 3m21.467706721s ago: executing program 0 (id=472): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) close(0x3) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000400)=@o_path={&(0x7f00000003c0)='./file0\x00', 0x0, 0x4000, r1}, 0x18) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000005c0)={'veth1_virt_wifi\x00', 0x0}) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000600)={@remote, r4}, 0x14) r5 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000740)=@o_path={&(0x7f0000000700)='./file0\x00', 0x0, 0x0, r1}, 0x18) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000580)={@ifindex=r4, r2, 0x27, 0x0, 0x0, @void, @value=r5}, 0x20) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) close(0x3) socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value, &(0x7f00000002c0)=0x4) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00000002c0)=ANY=[], 0xe0) 3m20.783888787s ago: executing program 0 (id=473): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040a41535900002000000010902270001010080fa0904000003ff00000007050202000200070581020002"], 0x0) syz_usb_ep_read(r0, 0x2, 0x40, &(0x7f0000000200)) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) 3m18.348326485s ago: executing program 0 (id=476): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x33c, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000240)={0x0, 0x8, 0x2, {0x2, @sliced={0x0, [0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x88b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3]}}}) syz_clone(0x0, 0x0, 0x29, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 3m16.813563835s ago: executing program 0 (id=477): open(&(0x7f0000000100)='.\x00', 0x20000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000340)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000003c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000001140)=""/102392, 0x18ff8) unshare(0x8000000) semop(0x0, &(0x7f000001a180)=[{0x4, 0xffd, 0x1800}], 0x1) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x8020000) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r6, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="dc", 0x1}], 0x1}, 0x48043) dup(r6) pipe2$9p(&(0x7f0000000080), 0x0) 3m0.988368217s ago: executing program 32 (id=477): open(&(0x7f0000000100)='.\x00', 0x20000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000340)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000003c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000001140)=""/102392, 0x18ff8) unshare(0x8000000) semop(0x0, &(0x7f000001a180)=[{0x4, 0xffd, 0x1800}], 0x1) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x8020000) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r6, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x0, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000002c0)="dc", 0x1}], 0x1}, 0x48043) dup(r6) pipe2$9p(&(0x7f0000000080), 0x0) 2m38.611994814s ago: executing program 3 (id=515): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000180)={0xcf47, 0x19, 0x7, 0x9dff, 0x7, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x200) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000002c0)=0xa) 2m34.160107528s ago: executing program 3 (id=521): r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000940), 0xfefc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000004, 0x10012, r1, 0x0) unshare(0x2c020400) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x44, 0x0, 0x0) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, 0x0, 0x0, {}, 0xfe}, 0x18) connect$can_j1939(r0, 0x0, 0x0) 2m33.569847347s ago: executing program 3 (id=523): openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x100008b}, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000580)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000005c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x141102) writev(r1, &(0x7f00000007c0)=[{&(0x7f0000002980)="94", 0xf000}, {0x0}], 0x2) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c00058008000100667470"], 0x90}}, 0x0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) unshare(0x8040480) connect(r4, &(0x7f00000001c0)=@xdp={0x2c, 0x0, 0x0, 0x31}, 0x80) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000280)="18000000010003", 0x7) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$IPCTNL_MSG_EXP_NEW(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="c8000000000201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c00028005000100060000000600020000140000060003009c400000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff000016000b006e61742d666f6c6c6f772d6d6173746572"], 0xc8}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000800)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x840}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) 2m30.34038332s ago: executing program 3 (id=527): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000023c0)=@delchain={0x110, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0xe4, 0x2, [@TCA_BPF_ACT={0xe0, 0x1, [@m_bpf={0xac, 0x11, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0x63, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248a"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_police={0x30, 0x9, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x110}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 2m29.773392808s ago: executing program 3 (id=530): bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x10, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1b, 0x0, 0x0, 0x0, 0x100}, {}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000340)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m27.648240517s ago: executing program 3 (id=532): r0 = socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x1ff) recvmmsg(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r2 = add_key$fscrypt_v1(0x0, &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) keyctl$chown(0x4, r2, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f4, 0x0, 0x168, 0x9, 0xec, 0xb, 0x32c, 0x250, 0x250, 0x32c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xffffff00, 0x0, 0xffff00], [], 'geneve0\x00', 'erspan0\x00', {0xff}, {}, 0x6c, 0x0, 0x3, 0x38}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0x1f8, 0x240, 0x0, {}, [@common=@inet=@policy={{0x154}, {[{@ipv6=@mcast1, [0xff000000, 0xffffffff, 0x0, 0xff000000], @ipv4=@loopback, [0x0, 0xff, 0xffffffff], 0x4d6, 0x3505, 0x3b, 0x0, 0x0, 0x5}, {@ipv6=@private2, [0x0, 0xff, 0xff, 0xff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x39}, [0xff000000, 0xffffffff, 0xff000000, 0xff], 0x4d3, 0x1592, 0x87, 0x1, 0x0, 0x4}, {@ipv4=@private=0xa010100, [0x0, 0x0, 0xff000000], @ipv6=@loopback, [0xff, 0x0, 0xff000000], 0x4d6, 0x3507, 0x2b, 0x1, 0x4}, {@ipv6=@rand_addr=' \x01\x00', [0x0, 0xffffffff, 0xff, 0xffffffff], @ipv6=@mcast2, [0xff, 0x0, 0x0, 0xffffff00], 0x4d3, 0x34ff, 0x0, 0x1, 0x1, 0x18}], 0x0, 0x3}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xe, 0xa, 0x9, 'netbios-ns\x00', {0x2}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x450) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="d8000000180081034e91f783db4cb9040a1d020006007409e8fc55a10a0015000400142603600e120800060000000401a8000800080002000000000004000461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d4e1cace81ed0bffece0b42a9ecbeeccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d93000000000000004867edef090d82c399b3b549", 0xd8}], 0x1}, 0x4000800) 2m11.984935704s ago: executing program 33 (id=532): r0 = socket$kcm(0x10, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x1ff) recvmmsg(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x2, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x800005}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008011}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x44000) mount(&(0x7f0000000180)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000240)='gfs2\x00', 0x100801f, 0x0) r2 = add_key$fscrypt_v1(0x0, &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000100)={0x0, "de442bfc7910e10ac69ac014b0fa7807b11d2c99ed1f40d47a6edb3367b5cc888e1fd5102ae2d3d05f251f8d49025ceab4152b6e6d87cd6088e97a9d06d29143"}, 0x48, 0xffffffffffffffff) keyctl$chown(0x4, r2, 0xffffffffffffffff, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r3 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r3, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000880)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f4, 0x0, 0x168, 0x9, 0xec, 0xb, 0x32c, 0x250, 0x250, 0x32c, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [0x0, 0xffffff00, 0x0, 0xffff00], [], 'geneve0\x00', 'erspan0\x00', {0xff}, {}, 0x6c, 0x0, 0x3, 0x38}, 0x6000000, 0xa4, 0xec, 0x0, {0x0, 0x28e}}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@broadcast, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0x1f8, 0x240, 0x0, {}, [@common=@inet=@policy={{0x154}, {[{@ipv6=@mcast1, [0xff000000, 0xffffffff, 0x0, 0xff000000], @ipv4=@loopback, [0x0, 0xff, 0xffffffff], 0x4d6, 0x3505, 0x3b, 0x0, 0x0, 0x5}, {@ipv6=@private2, [0x0, 0xff, 0xff, 0xff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x39}, [0xff000000, 0xffffffff, 0xff000000, 0xff], 0x4d3, 0x1592, 0x87, 0x1, 0x0, 0x4}, {@ipv4=@private=0xa010100, [0x0, 0x0, 0xff000000], @ipv6=@loopback, [0xff, 0x0, 0xff000000], 0x4d6, 0x3507, 0x2b, 0x1, 0x4}, {@ipv6=@rand_addr=' \x01\x00', [0x0, 0xffffffff, 0xff, 0xffffffff], @ipv6=@mcast2, [0xff, 0x0, 0x0, 0xffffff00], 0x4d3, 0x34ff, 0x0, 0x1, 0x1, 0x18}], 0x0, 0x3}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0xe, 0xa, 0x9, 'netbios-ns\x00', {0x2}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x450) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)="d8000000180081034e91f783db4cb9040a1d020006007409e8fc55a10a0015000400142603600e120800060000000401a8000800080002000000000004000461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d4e1cace81ed0bffece0b42a9ecbeeccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d93000000000000004867edef090d82c399b3b549", 0xd8}], 0x1}, 0x4000800) 1m52.670082251s ago: executing program 1 (id=576): syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) inotify_init1(0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000380)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f00000003c0)={0x2, &(0x7f0000000400)=[{0x60, 0x8}, {0x6, 0x0, 0xfe, 0x10000000}]}) 1m51.22936921s ago: executing program 1 (id=580): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000300000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100f3ff000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x844) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpgrp(0x0) syz_open_dev$sndmidi(0x0, 0xc7, 0x2000) sched_setaffinity(r4, 0x8, &(0x7f0000000280)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f00000002c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r7, &(0x7f0000000880)=""/102392, 0x18ff8) sched_setaffinity(r6, 0x47, &(0x7f0000019880)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./security/apparmor/.load\x00', &(0x7f00000000c0)='selinuxfs\x00', 0x8ac028, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./security/apparmor/.load\x00', 0x1, 0x0) write(r8, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x30, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1m48.673697363s ago: executing program 1 (id=582): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000002c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f00000003c0), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[], &(0x7f0000001700)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001740), 0x8, 0x10, &(0x7f0000001780), 0x10}, 0x94) 1m47.404037259s ago: executing program 1 (id=583): r0 = socket$pppoe(0x18, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x8) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000003c0), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f0000001280), 0x2, 0x141102) connect$pppoe(r0, &(0x7f0000001340)={0x18, 0x0, {0x4001, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, 'gre0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f00000013c0)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 1m46.568182636s ago: executing program 1 (id=585): pwrite64(0xffffffffffffffff, &(0x7f0000001780)="0000010042", 0x5, 0x1be) pwrite64(0xffffffffffffffff, &(0x7f00000017c0)="55aa", 0x2, 0x1fe) pwrite64(0xffffffffffffffff, &(0x7f0000001800)='PRIVHEAD', 0x8, 0xc00) pwrite64(0xffffffffffffffff, &(0x7f0000001840)="0002000b", 0x4, 0xc0c) pwrite64(0xffffffffffffffff, &(0x7f0000001880)='12345678-1234-1234-1234-12345678', 0x20, 0xc30) pwrite64(0xffffffffffffffff, &(0x7f00000018c0)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0xd23) pwrite64(0xffffffffffffffff, &(0x7f0000001900)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(0xffffffffffffffff, &(0x7f0000001940)='P', 0x1, 0x1e8000) r0 = syz_open_dev$loop(&(0x7f0000001980), 0x0, 0x2) ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000019c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) 1m46.32486103s ago: executing program 1 (id=586): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) sync() sync() r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000100)=0x4038, 0x4) bind$can_j1939(r1, &(0x7f0000000140)={0x1d, r2}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r1, 0x6b, 0x4, &(0x7f0000000480)=0x1, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r5, &(0x7f0000000580)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r5, &(0x7f00000005c0)={&(0x7f0000000600), 0x18, &(0x7f0000000640)={&(0x7f0000000680)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r4, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 1m30.351520289s ago: executing program 34 (id=586): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) sync() sync() r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000100)=0x4038, 0x4) bind$can_j1939(r1, &(0x7f0000000140)={0x1d, r2}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r1, 0x6b, 0x4, &(0x7f0000000480)=0x1, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) r5 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r5, &(0x7f0000000580)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r5, &(0x7f00000005c0)={&(0x7f0000000600), 0x18, &(0x7f0000000640)={&(0x7f0000000680)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r4, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 11.398336298s ago: executing program 4 (id=660): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) quotactl_fd$Q_QUOTAOFF(r2, 0xffffffff80000301, 0xee01, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x0, 0x0, &(0x7f0000000480)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0x2, 0x1, 0x1, 0x8, 0x3}, 0x45, &(0x7f00000000c0)={0x5, 0xf, 0x45, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "5020050d22e16aa5b751625beab5cf7b"}, @ss_container_id={0x14, 0x10, 0x4, 0xf7, "d7592bba334af91fdfaa50c65000e698"}, @ssp_cap={0x18, 0x10, 0xa, 0xb2, 0x3, 0xe, 0xf00, 0x0, [0xc000, 0xc0ff, 0xc0f0]}]}, 0x6, [{0xa, &(0x7f0000000140)=@string={0xa, 0x3, "3a56b08379877f7e"}}, {0x0, 0x0}, {0x0, 0x0}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1c01}}, {0x0, 0x0}]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14}}, 0x64}}, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000006e80), 0x1, 0x402) pwritev(r4, &(0x7f0000006fc0)=[{&(0x7f0000007000)='C', 0x1}], 0x1, 0xfffffff8, 0x3) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000500)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000540)=0x40, 0x4) connect$inet6(r5, &(0x7f0000000580)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000005c0)=0x20a, 0x4) sendmmsg$inet6(r5, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)}], 0x1}}], 0x1, 0x4000001) r6 = dup(r5) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r6) ioctl$TUNSETLINK(r6, 0x400454cd, 0x30e) 9.24457234s ago: executing program 2 (id=661): openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x100008b}, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000580)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000005c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x141102) writev(r1, &(0x7f00000007c0)=[{&(0x7f0000002980)="94", 0xf000}, {0x0}], 0x2) socket$netlink(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c00058008000100667470"], 0x90}}, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) unshare(0x8040480) connect(r3, &(0x7f00000001c0)=@xdp={0x2c, 0x0, 0x0, 0x31}, 0x80) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000280)="18000000010003", 0x7) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x64, r6, 0x1, 0x70bd2c, 0x25dfdbfb, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x6}}}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="c8000000000201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c00028005000100060000000600020000140000060003009c400000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff000016000b006e61742d666f6c6c6f772d6d6173746572"], 0xc8}}, 0x0) 8.734872081s ago: executing program 4 (id=662): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf9477000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000500)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000580), 0x651, 0x0) recvmmsg(r1, &(0x7f00000005c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000600)=0x6) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000680)='./proc_mnt\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./proc_mnt/kcore\x00', 0x0, 0x0) read$msr(r3, &(0x7f00000049c0)=""/102399, 0x18fff) 7.537742011s ago: executing program 4 (id=663): openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000002640)=0x10, 0x4) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000280), 0x41, 0x0) write$nbd(r1, &(0x7f00000002c0)={0x1000000, 0x0, 0x0, 0x40, 0x9, "82b0cfc4337965941538be09000000000000000000007400a391793ba70d0000000000fdf700000000baffda6e4a4d83"}, 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002680)) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0x1, 0x0) read$FUSE(r2, &(0x7f0000002740)={0x2020, 0x0, 0x0}, 0x2082) lgetxattr(&(0x7f0000004780)='./file0\x00', &(0x7f00000047c0)=@known='user.incfs.metadata\x00', 0x0, 0x0) write$FUSE_INIT(r2, &(0x7f0000004800)={0x50, 0x0, r3, {0x7, 0x29, 0x0, 0x11812410, 0x0, 0x200, 0x81}}, 0x50) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000340)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newtfilter={0x60, 0x2c, 0xf3f, 0x70fd2c, 0x25dfdbbd, {0x0, 0x0, 0x0, 0x0, {0xc, 0xc}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_META={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x1}, [@TCA_EM_META_RVALUE={0x4}, @TCA_EM_META_HDR={0xc, 0x1, {{0x0, 0x88}, {0x0, 0x9, 0x2}}}]}}]}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20041090}, 0xc080) 5.942588457s ago: executing program 2 (id=664): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x12c) write(r0, &(0x7f0000000180)='27', 0x2) fsopen(&(0x7f0000000240)='ceph\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) 5.834597094s ago: executing program 2 (id=665): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000740)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000780), 0x200, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x40084503, &(0x7f0000000d00)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mkdirat(0xffffffffffffff9c, 0x0, 0x777) write(0xffffffffffffffff, &(0x7f00000001c0)='100000', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) ioctl$XFS_IOC_BULKSTAT(r2, 0x8040587f, &(0x7f0000000240)={{0x7dc, 0x4, 0x5, 0xff, 0x3}, &(0x7f00000002c0)=[{}, {}, {}]}) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0500000001000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000fffffffffffffffa000000000000"], 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f00000005c0)={@map=r4, 0xffffffffffffffff, 0x2c}, 0x20) write(r3, &(0x7f0000000600)='0', 0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x5, 0x8, 0x4936, 0xc2, 0x1, 0x1, 0x6}, 0x50) connect$netlink(r2, &(0x7f00000006c0)=@kern={0x10, 0x0, 0x0, 0x1}, 0xc) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740), &(0x7f0000000780), 0xca, r5}, 0x38) dup3(r2, r1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f00000007c0)={'filter\x00', 0x104, 0x4, 0x3c8, 0xe8, 0x1d0, 0xe8, 0x2e0, 0x2e0, 0xe8, 0x7fffffe, 0x0, {[{{@arp={@remote, @multicast2, 0x0, 0x0, 0x7, 0x0, {@mac=@link_local={0x2, 0x80, 0xc2, 0x7}}, {}, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x100}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xfc, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_1\x00', 'ipvlan1\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) syz_ublk_setup_io_uring(0x23, &(0x7f0000000bc0)={0x0, 0x0, 0x100, 0x0, 0x1e5}, &(0x7f0000000c40), &(0x7f0000000c80), &(0x7f0000000d40)) 5.366193975s ago: executing program 4 (id=666): openat$dir(0xffffffffffffff9c, 0x0, 0xa880, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x1, 0x8, 0x81, 0x100, {{0x18, 0x4, 0x2, 0x8, 0x60, 0x68, 0x0, 0x1, 0x29, 0x0, @private=0xa010102, @multicast1, {[@lsrr={0x83, 0xf, 0x79, [@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, @multicast2]}, @timestamp_prespec={0x44, 0x3c, 0xe2, 0x3, 0xf, [{@multicast1, 0x100}, {@broadcast, 0xc47b}, {@multicast1, 0x4}, {@multicast2, 0xb}, {@remote, 0x7}, {@rand_addr=0x64010101, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0xd}]}]}}}}}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000480)={'syzkaller0\x00', 0x1}) r0 = syz_ublk_setup_io_uring(0x64d, &(0x7f00000004c0)={0x0, 0xd58c, 0x1000, 0x2, 0x14d}, &(0x7f0000000540)=0x0, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000600)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x40, 0x1}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000006c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000740)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x68ba, 0x0, 0x0, 0x10}}}, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000780)={r4, 0x0, 0x0}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002600)=ANY=[@ANYBLOB="14000000100001fff5000000000000000500000a74000000060a0b0400000000000000000200000048000480440001800a0001006d61746368000000340002800a00010071756f74610000001c000300000000f500006e8f58c2052fade1bc2c62cdeb7521cf85ee08000240000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) ioctl$sock_SIOCBRDELBR(r7, 0x89a2, &(0x7f0000000000)='bridge0\x00') r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x34, 0x0, 0x1, 0x70bd2e, 0x25dfdbfc, {{0x12}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_UAPSD_QUEUES={0x5, 0x1, 0x7}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40c4880}, 0x24048840) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x25dfdbfc, {0x7a, 0x0, 0x0, r11}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}]}}}]}, 0x3c}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x55, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}, @random="6a2ddcf6177a", @val={@void, {0x806, 0x0, 0x1}}, {@llc={0x4, {@llc={0xe, 0xf4, "99"}}}}}, 0x0) 4.11577965s ago: executing program 2 (id=667): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x39, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@typed={0x4, 0xdc}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000005}, 0x20000000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x8, 0x1, 0x3c, 0x42}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000140), 0x1003, r3}, 0x38) 3.844225875s ago: executing program 4 (id=668): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x42, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000180)=@req3={0x1000, 0x3a, 0x1020, 0x3a, 0x7ff, 0xf83, 0x2}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00605d541b7667add98cd76cca35eb68cd658721e8387eb070c244fae226114e305ab14700d7806db77634fc28205cbf4a838a78f2bab65d98e27dfb658c9ae003f09ea63bc815fda62c1912"]) read$FUSE(r1, &(0x7f0000006e80)={0x2020, 0x0, 0x0}, 0x2020) socket(0x2, 0x3, 0xff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r3, 0x0, 0x33, &(0x7f0000000040)=0x80000003, 0x4) listen(r3, 0x100004) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg(r4, &(0x7f0000004d40)=[{{&(0x7f0000000080)=@in={0x2, 0xffff, @dev={0xac, 0x14, 0x14, 0x34}}, 0x80, 0x0}}], 0x1, 0x24008010) write$FUSE_INIT(r1, &(0x7f0000004300)={0x50, 0x0, r2, {0x7, 0x29, 0x0, 0x840120, 0x0, 0x0, 0x57, 0x0, 0x0, 0x0, 0x0, 0x4}}, 0x50) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x280a00, 0x0) file_getattr(r5, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x18, 0x100) read$FUSE(r1, &(0x7f0000004540)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002200)={0x10, 0xffffffffffffffda, r6}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}}, 0x0) 2.459466586s ago: executing program 4 (id=669): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407c2c25010000000000010902270001010080fa0904000003ffffff0007058102000200070502020002000705830340"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) quotactl_fd$Q_QUOTAOFF(r2, 0xffffffff80000301, 0xee01, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_connect$hid(0x1, 0x0, 0x0, &(0x7f0000000480)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0x2, 0x1, 0x1, 0x8, 0x3}, 0x45, &(0x7f00000000c0)={0x5, 0xf, 0x45, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x0, "5020050d22e16aa5b751625beab5cf7b"}, @ss_container_id={0x14, 0x10, 0x4, 0xf7, "d7592bba334af91fdfaa50c65000e698"}, @ssp_cap={0x18, 0x10, 0xa, 0xb2, 0x3, 0xe, 0xf00, 0x0, [0xc000, 0xc0ff, 0xc0f0]}]}, 0x6, [{0xa, &(0x7f0000000140)=@string={0xa, 0x3, "3a56b08379877f7e"}}, {0x0, 0x0}, {0x0, 0x0}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x380a}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1c01}}, {0x0, 0x0}]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}], {0x14}}, 0x64}}, 0x0) r4 = syz_open_dev$I2C(&(0x7f0000006e80), 0x1, 0x402) pwritev(r4, &(0x7f0000006fc0)=[{&(0x7f0000007000)='C', 0x1}], 0x1, 0xfffffff8, 0x3) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000500)={0xa, 0x4e22, 0xfffffffc, @loopback, 0x6}, 0x1c) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f0000000540)=0x40, 0x4) connect$inet6(r5, &(0x7f0000000580)={0xa, 0x4e22, 0x56202325, @empty, 0x4000005}, 0x1c) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f00000005c0)=0x20a, 0x4) sendmmsg$inet6(r5, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000006c0)}], 0x1}}], 0x1, 0x4000001) r6 = dup(r5) syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r6) ioctl$TUNSETLINK(r6, 0x400454cd, 0x30e) 1.500863922s ago: executing program 2 (id=670): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) close(r0) socket$nl_route(0x10, 0x3, 0x0) setpriority(0x1, 0xffffffffffffffff, 0x3) 0s ago: executing program 2 (id=671): openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x8, 0x100008b}, 0x0) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000580)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000005c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000780), 0x2, 0x141102) writev(r1, &(0x7f00000007c0)=[{&(0x7f0000002980)="94", 0xf000}, {0x0}], 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c00058008000100667470"], 0x90}}, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) unshare(0x8040480) connect(r3, &(0x7f00000001c0)=@xdp={0x2c, 0x0, 0x0, 0x31}, 0x80) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f0000000280)="18000000010003", 0x7) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x64, r6, 0x1, 0x70bd2c, 0x25dfdbfb, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x6}}}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="c8000000000201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c00028005000100060000000600020000140000060003009c400000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff000016000b006e61742d666f6c6c6f772d6d6173746572"], 0xc8}}, 0x0) kernel console output (not intermixed with test programs): 9][ T37] usb 4-1: config 0 descriptor?? [ 278.880718][ T6957] usb 1-1: string descriptor 0 read error: -108 [ 279.053639][ T10] usb 1-1: reset high-speed USB device number 16 using dummy_hcd [ 279.144596][ T6961] gfs2: error -5 reading superblock [ 279.285936][ T6961] netlink: 'syz.1.305': attribute type 21 has an invalid length. [ 279.286007][ T6961] IPv6: NLM_F_CREATE should be specified when creating new route [ 279.407414][ T5590] Bluetooth: hci5: command tx timeout [ 279.538837][ T10] usb 1-1: device descriptor read/64, error -32 [ 280.628629][ T10] usb 1-1: reset high-speed USB device number 16 using dummy_hcd [ 281.092302][ T9] usb 4-1: USB disconnect, device number 8 [ 281.880029][ T5831] usb 1-1: USB disconnect, device number 16 [ 282.961550][ T1451] bridge_slave_1: left allmulticast mode [ 282.961594][ T1451] bridge_slave_1: left promiscuous mode [ 282.961904][ T1451] bridge0: port 2(bridge_slave_1) entered disabled state [ 283.291465][ T1451] bridge_slave_0: left allmulticast mode [ 283.291507][ T1451] bridge_slave_0: left promiscuous mode [ 283.291776][ T1451] bridge0: port 1(bridge_slave_0) entered disabled state [ 283.528413][ T7008] gfs2: error -5 reading superblock [ 283.624268][ T7009] netlink: 'syz.4.317': attribute type 21 has an invalid length. [ 283.624355][ T7009] IPv6: NLM_F_CREATE should be specified when creating new route [ 283.818022][ T5780] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 284.283658][ T5780] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 284.337658][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 284.337695][ T5780] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 284.337720][ T5780] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 284.374189][ T5780] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.781752][ T5780] usb 1-1: config 0 descriptor?? [ 285.108024][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 285.279716][ T10] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 285.286726][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 285.286755][ T10] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 285.286794][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 285.371876][ T10] usb 2-1: config 0 descriptor?? [ 285.393205][ T5780] hid_parser_main: 5 callbacks suppressed [ 285.393222][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393243][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393260][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393286][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393303][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393321][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393338][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393355][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393372][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.393389][ T5780] plantronics 0003:047F:FFFF.0008: unknown main item tag 0x0 [ 285.511288][ T5780] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 287.111486][ T7033] usb 1-1: string descriptor 0 read error: -108 [ 287.239566][ T6005] usb 1-1: reset high-speed USB device number 17 using dummy_hcd [ 287.400047][ T6005] usb 1-1: device descriptor read/64, error -32 [ 287.557979][ T1451] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 287.636366][ T1451] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 287.657979][ T6005] usb 1-1: reset high-speed USB device number 17 using dummy_hcd [ 287.683205][ T1451] bond0 (unregistering): Released all slaves [ 287.798296][ T6005] usb 1-1: device descriptor read/64, error -32 [ 287.833324][ T5249] 8021q: adding VLAN 0 to HW filter on device eth1 [ 288.048152][ T6005] usb 1-1: reset high-speed USB device number 17 using dummy_hcd [ 288.068313][ T6005] usb 1-1: device descriptor read/8, error -32 [ 288.075341][ T7043] Bluetooth: MGMT ver 1.23 [ 288.175847][ T5831] usb 2-1: USB disconnect, device number 6 [ 288.328994][ T6005] usb 1-1: reset high-speed USB device number 17 using dummy_hcd [ 288.360513][ T6005] usb 1-1: device descriptor read/8, error -32 [ 288.470623][ T6005] raw-gadget.0 gadget.0: failed to queue suspend event [ 288.498852][ T5780] usb 1-1: USB disconnect, device number 17 [ 288.527692][ T7029] raw-gadget.0 gadget.0: failed to queue suspend event [ 288.547453][ T7029] raw-gadget.0 gadget.0: failed to queue disconnect event [ 288.854643][ T1451] hsr_slave_0: left promiscuous mode [ 288.890853][ T1451] hsr_slave_1: left promiscuous mode [ 288.894943][ T1451] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 288.952343][ T1451] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 290.655887][ T7071] random: crng reseeded on system resumption [ 293.420021][ T1451] team0 (unregistering): Port device team_slave_1 removed [ 293.588886][ T1451] team0 (unregistering): Port device team_slave_0 removed [ 293.727408][ T7070] block device autoloading is deprecated and will be removed. [ 294.302956][ T7086] loop0: detected capacity change from 0 to 6 [ 294.501297][ T7087] ldm_validate_privheads(): Disk read failed. [ 294.501525][ T7087] loop0: [ 294.501547][ T7087] loop0: partition table partially beyond EOD, truncated [ 295.029865][ T6872] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.031019][ T6872] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.031204][ T6872] bridge_slave_0: entered allmulticast mode [ 295.037596][ T6872] bridge_slave_0: entered promiscuous mode [ 295.114796][ T5249] 8021q: adding VLAN 0 to HW filter on device eth2 [ 295.126293][ T5780] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 295.217957][ T5879] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 295.260615][ T6872] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.260750][ T6872] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.260954][ T6872] bridge_slave_1: entered allmulticast mode [ 295.291580][ T5780] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 295.293457][ T6872] bridge_slave_1: entered promiscuous mode [ 295.295942][ T5780] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 295.295982][ T5780] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 295.296009][ T5780] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.370977][ T5879] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 295.372523][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 295.372556][ T5879] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.372580][ T5879] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 295.372625][ T5879] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.448932][ T5780] usb 5-1: config 0 descriptor?? [ 295.479579][ T5879] usb 4-1: config 0 descriptor?? [ 295.528003][ T10] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 295.703560][ T10] usb 2-1: New USB device found, idVendor=15a4, idProduct=9035, bcdDevice= 2.00 [ 295.705304][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 295.705363][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.705389][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 295.705435][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 296.096872][ T10] usb 2-1: dvb_usb_v2: 2nd usb_bulk_msg() failed=-8 [ 296.097011][ T10] dvb_usb_af9035 2-1:1.0: probe with driver dvb_usb_af9035 failed with error -8 [ 296.224747][ T5879] hid_parser_main: 5 callbacks suppressed [ 296.224817][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224840][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224859][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224879][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224898][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224917][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224935][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224954][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224973][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.224992][ T5879] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 296.371290][ T10] usb 2-1: USB disconnect, device number 7 [ 296.429128][ T6872] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 296.465920][ T5879] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 296.577569][ T6872] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 296.907502][ T6872] team0: Port device team_slave_0 added [ 296.928811][ T6872] team0: Port device team_slave_1 added [ 296.987973][ T1238] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 297.009825][ T6872] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 297.009845][ T6872] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 297.009873][ T6872] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 297.012055][ T6872] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 297.012068][ T6872] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 297.012090][ T6872] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 297.137942][ T1238] usb 1-1: Using ep0 maxpacket: 32 [ 297.138910][ T1238] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 297.140608][ T1238] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 297.140641][ T1238] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 297.140689][ T1238] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 297.320011][ T1238] usb 1-1: config 0 descriptor?? [ 297.344388][ T1238] hub 1-1:0.0: USB hub found [ 297.548981][ T1238] hub 1-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 297.800227][ T6872] hsr_slave_0: entered promiscuous mode [ 297.828648][ T6872] hsr_slave_1: entered promiscuous mode [ 297.852718][ T6872] debugfs: 'hsr0' already exists in 'hsr' [ 297.852751][ T6872] Cannot create hsr debugfs directory [ 298.021491][ T7115] usb 4-1: string descriptor 0 read error: -108 [ 298.148939][ T5780] usb 4-1: reset high-speed USB device number 9 using dummy_hcd [ 298.183137][ T7111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 298.183832][ T7111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 298.278945][ T5780] usb 4-1: device descriptor read/64, error -32 [ 298.321912][ T4965] usb 5-1: USB disconnect, device number 9 [ 298.520044][ T5780] usb 4-1: reset high-speed USB device number 9 using dummy_hcd [ 298.647954][ T5780] usb 4-1: device descriptor read/64, error -32 [ 298.669624][ T1238] hid-generic 0003:046D:C31C.000A: hidraw1: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.0-1/input0 [ 298.803610][ T1238] usb 1-1: USB disconnect, device number 18 [ 298.889148][ T5780] usb 4-1: reset high-speed USB device number 9 using dummy_hcd [ 298.909832][ T5780] usb 4-1: device descriptor read/8, error -32 [ 299.147982][ T5780] usb 4-1: reset high-speed USB device number 9 using dummy_hcd [ 299.175305][ T5780] usb 4-1: device descriptor read/8, error -32 [ 299.278017][ T5780] raw-gadget.1 gadget.3: failed to queue suspend event [ 299.278895][ T5879] usb 4-1: USB disconnect, device number 9 [ 299.306941][ T7140] fido_id[7140]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 299.343088][ T7115] raw-gadget.1 gadget.3: failed to queue disconnect event [ 299.887595][ T5249] 8021q: adding VLAN 0 to HW filter on device eth3 [ 300.573564][ T38] kauditd_printk_skb: 42 callbacks suppressed [ 300.573587][ T38] audit: type=1326 audit(1791917698.427:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7160 comm="syz.3.347" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f54121ee2d9 code=0x0 [ 302.147907][ T1238] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 302.318975][ T1238] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 302.320565][ T1238] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 302.320591][ T1238] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 302.320629][ T1238] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.476219][ T1238] usb 2-1: config 0 descriptor?? [ 302.794949][ T7198] 9p: Bad value for 'rfdno' [ 302.827980][ T1238] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 303.006899][ T1238] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 303.017022][ T1238] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 303.017124][ T1238] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 303.017185][ T1238] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 303.017299][ T1238] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.122473][ T1238] usb 5-1: config 0 descriptor?? [ 303.982412][ T1238] hid_parser_main: 6 callbacks suppressed [ 303.982439][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982471][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982500][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982528][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982556][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982585][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.982613][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.994177][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.994281][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 303.994309][ T1238] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 304.144802][ T1238] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 304.760802][ T7226] bridge0: port 3(syz_tun) entered blocking state [ 304.760934][ T7226] bridge0: port 3(syz_tun) entered disabled state [ 304.763784][ T7226] syz_tun: entered allmulticast mode [ 304.861156][ T7226] syz_tun: entered promiscuous mode [ 304.877533][ T7231] netlink: 'syz.0.360': attribute type 8 has an invalid length. [ 305.003210][ T7226] bridge0: port 3(syz_tun) entered blocking state [ 305.003341][ T7226] bridge0: port 3(syz_tun) entered forwarding state [ 305.301282][ T1238] usb 2-1: USB disconnect, device number 8 [ 305.648653][ T7232] usb 5-1: string descriptor 0 read error: -108 [ 305.779434][ T999] usb 5-1: reset high-speed USB device number 10 using dummy_hcd [ 305.907923][ T999] usb 5-1: device descriptor read/64, error -32 [ 306.147971][ T999] usb 5-1: reset high-speed USB device number 10 using dummy_hcd [ 306.280783][ T999] usb 5-1: device descriptor read/64, error -32 [ 306.513218][ T6872] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 306.518127][ T999] usb 5-1: reset high-speed USB device number 10 using dummy_hcd [ 306.539490][ T999] usb 5-1: device descriptor read/8, error -32 [ 306.653395][ T6872] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 306.692325][ T6872] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 306.783446][ T6872] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 306.784754][ T6872] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 306.823978][ T7270] 9p: Bad value for 'rfdno' [ 306.872156][ T6872] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 306.873579][ T6872] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 307.074283][ T6872] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 307.420099][ T5879] usb 5-1: USB disconnect, device number 10 [ 308.093935][ T758] IPVS: starting estimator thread 0... [ 308.580154][ T7296] IPVS: using max 7 ests per chain, 16800 per kthread [ 308.990671][ T6872] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.242911][ T6872] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.267993][ T5879] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 309.299074][ T1451] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.299215][ T1451] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.356409][ T1451] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.356561][ T1451] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.418774][ T5879] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 309.420260][ T5879] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 309.420316][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 309.466086][ T5879] usb 2-1: config 0 descriptor?? [ 309.494842][ T5879] pwc: Askey VC010 type 2 USB webcam detected. [ 309.617338][ T7312] netlink: 'syz.4.375': attribute type 8 has an invalid length. [ 309.917359][ T5879] pwc: recv_control_msg error -32 req 02 val 2b00 [ 309.941053][ T5879] pwc: recv_control_msg error -32 req 02 val 2700 [ 309.943943][ T5879] pwc: recv_control_msg error -32 req 02 val 2c00 [ 309.947350][ T5879] pwc: recv_control_msg error -32 req 04 val 1000 [ 309.951648][ T5879] pwc: recv_control_msg error -32 req 04 val 1300 [ 309.989096][ T5879] pwc: recv_control_msg error -32 req 04 val 1400 [ 310.005868][ T5879] pwc: recv_control_msg error -32 req 02 val 2000 [ 310.017978][ T5879] pwc: recv_control_msg error -32 req 02 val 2100 [ 310.020394][ T5879] pwc: recv_control_msg error -32 req 04 val 1500 [ 310.026764][ T5879] pwc: recv_control_msg error -32 req 02 val 2500 [ 310.027154][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.027534][ T5879] pwc: recv_control_msg error -32 req 02 val 2400 [ 310.027886][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.039737][ T5879] pwc: recv_control_msg error -32 req 02 val 2600 [ 310.040142][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.082222][ T5879] pwc: recv_control_msg error -32 req 02 val 2900 [ 310.083640][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.083821][ T5879] pwc: recv_control_msg error -32 req 02 val 2800 [ 310.087487][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.115614][ T5879] pwc: recv_control_msg error -32 req 04 val 1100 [ 310.116144][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 310.116406][ T5879] pwc: recv_control_msg error -32 req 04 val 1200 [ 310.182180][ T5879] pwc: Registered as video103. [ 310.247216][ T5879] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input10 [ 310.635248][ T5879] usb 2-1: USB disconnect, device number 9 [ 310.895837][ T7331] 9p: Bad value for 'wfdno' [ 310.958007][ T10] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 311.026077][ T7334] netlink: 16 bytes leftover after parsing attributes in process `syz.1.378'. [ 311.188603][ T10] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 311.190158][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 311.190194][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 311.190231][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 311.190276][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.336303][ T10] usb 1-1: config 0 descriptor?? [ 312.835871][ T10] hid_parser_main: 5 callbacks suppressed [ 312.835898][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.835931][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.835961][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.835990][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836033][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836068][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836098][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836126][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836162][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.836191][ T10] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x0 [ 312.857274][ T10] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 313.319597][ T6872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 313.726293][ T6872] veth0_vlan: entered promiscuous mode [ 313.757080][ T6872] veth1_vlan: entered promiscuous mode [ 313.936729][ T6872] veth0_macvtap: entered promiscuous mode [ 314.003676][ T6872] veth1_macvtap: entered promiscuous mode [ 314.021905][ T7386] nbd3: detected capacity change from 0 to 63 [ 314.216625][ T6872] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 314.479267][ T5590] block nbd3: Receive control failed (result -104) [ 314.550004][ T7388] usb 1-1: string descriptor 0 read error: -108 [ 314.555943][ T6872] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 314.681002][ T5879] usb 1-1: reset high-speed USB device number 19 using dummy_hcd [ 314.741356][ T758] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 314.810018][ T5879] usb 1-1: device descriptor read/64, error -32 [ 314.850080][ T1049] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.061535][ T5879] usb 1-1: reset high-speed USB device number 19 using dummy_hcd [ 315.212450][ T5879] usb 1-1: device descriptor read/64, error -32 [ 315.455869][ T1049] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.480443][ T5879] usb 1-1: reset high-speed USB device number 19 using dummy_hcd [ 315.499089][ T5879] usb 1-1: device descriptor read/8, error -32 [ 315.520215][ T1049] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.737966][ T5879] usb 1-1: reset high-speed USB device number 19 using dummy_hcd [ 315.768291][ T5879] usb 1-1: device descriptor read/8, error -32 [ 315.878032][ T5879] raw-gadget.0 gadget.0: failed to queue suspend event [ 315.878822][ T999] usb 1-1: USB disconnect, device number 19 [ 316.003796][ T7327] raw-gadget.0 gadget.0: failed to queue disconnect event [ 316.625597][ T1490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 316.625620][ T1490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 316.657892][ T999] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 316.818837][ T999] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 316.820871][ T999] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 316.820911][ T999] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 316.911471][ T999] usb 1-1: config 0 descriptor?? [ 316.989580][ T999] pwc: Askey VC010 type 2 USB webcam detected. [ 317.250850][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.250919][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.402005][ T999] pwc: recv_control_msg error -32 req 02 val 2b00 [ 317.427662][ T999] pwc: recv_control_msg error -32 req 02 val 2700 [ 317.449246][ T999] pwc: recv_control_msg error -32 req 02 val 2c00 [ 317.450092][ T999] pwc: recv_control_msg error -32 req 04 val 1000 [ 317.451225][ T999] pwc: recv_control_msg error -32 req 04 val 1300 [ 317.451882][ T999] pwc: recv_control_msg error -32 req 04 val 1400 [ 317.455990][ T999] pwc: recv_control_msg error -32 req 02 val 2000 [ 317.490348][ T999] pwc: recv_control_msg error -32 req 02 val 2100 [ 317.503796][ T999] pwc: recv_control_msg error -32 req 04 val 1500 [ 317.547946][ T1238] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 317.569712][ T999] pwc: recv_control_msg error -32 req 02 val 2500 [ 317.595307][ T999] pwc: recv_control_msg error -71 req 02 val 2400 [ 317.607112][ T999] pwc: recv_control_msg error -71 req 02 val 2600 [ 317.607570][ T999] pwc: recv_control_msg error -71 req 02 val 2900 [ 317.608540][ T999] pwc: recv_control_msg error -71 req 02 val 2800 [ 317.611607][ T999] pwc: recv_control_msg error -71 req 04 val 1100 [ 317.623092][ T999] pwc: recv_control_msg error -71 req 04 val 1200 [ 317.738827][ T1475] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 317.738846][ T1475] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 317.767902][ T1238] usb 2-1: Using ep0 maxpacket: 32 [ 317.768653][ T1238] usb 2-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 317.774491][ T1238] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 317.774526][ T1238] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 317.774551][ T1238] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 317.774596][ T1238] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.879245][ T999] pwc: Registered as video103. [ 317.937533][ T999] input: PWC snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/input/input11 [ 317.970450][ T1238] usb 2-1: config 0 descriptor?? [ 318.085900][ T999] usb 1-1: USB disconnect, device number 20 [ 318.508776][ T7417] netlink: 'syz.4.391': attribute type 8 has an invalid length. [ 320.368019][ T5694] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 321.883625][ T5694] usb 4-1: Using ep0 maxpacket: 32 [ 321.907253][ T1238] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.000D/input/input12 [ 322.389554][ T5694] usb 4-1: device descriptor read/all, error -71 [ 322.686987][ T1238] input: HID 0458:5011 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0458:5011.000D/input/input13 [ 322.875445][ T1238] kye 0003:0458:5011.000D: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.1-1/input0 [ 322.927261][ T1238] usb 2-1: USB disconnect, device number 10 [ 323.252791][ T7437] fido_id[7437]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 326.517962][ T37] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 326.674238][ T37] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 326.675862][ T37] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 326.675896][ T37] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 326.675920][ T37] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 326.675965][ T37] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 326.748335][ T37] usb 4-1: config 0 descriptor?? [ 327.181932][ T37] usbhid 4-1:0.0: can't add hid device: -71 [ 327.182094][ T37] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 327.218004][ T37] usb 4-1: USB disconnect, device number 13 [ 329.159132][ T5590] Bluetooth: hci0: command 0x0406 tx timeout [ 333.390736][ T1238] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 333.653844][ T7487] FAULT_INJECTION: forcing a failure. [ 333.653844][ T7487] name failslab, interval 1, probability 0, space 0, times 0 [ 333.653885][ T7487] CPU: 0 UID: 0 PID: 7487 Comm: syz.0.410 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 333.653925][ T7487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 333.653945][ T7487] Call Trace: [ 333.653954][ T7487] [ 333.653965][ T7487] dump_stack_lvl+0xe8/0x150 [ 333.654016][ T7487] should_fail_ex+0x46b/0x600 [ 333.654061][ T7487] should_failslab+0xa8/0x100 [ 333.654090][ T7487] __kmalloc_cache_noprof+0xa1/0x680 [ 333.654128][ T7487] ? pkcs7_parse_message+0xf9/0x640 [ 333.654159][ T7487] ? pkcs7_parse_message+0xf9/0x640 [ 333.654199][ T7487] pkcs7_parse_message+0xf9/0x640 [ 333.654239][ T7487] verify_pkcs7_signature+0x30/0x90 [ 333.654277][ T7487] pkcs7_preparse+0x8b/0xc0 [ 333.654309][ T7487] ? __pfx_pkcs7_view_content+0x10/0x10 [ 333.654347][ T7487] __key_create_or_update+0x354/0xa70 [ 333.654387][ T7487] ? __pfx___key_create_or_update+0x10/0x10 [ 333.654421][ T7487] ? lookup_user_key+0xb68/0x1150 [ 333.654461][ T7487] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 333.654498][ T7487] key_create_or_update+0x42/0x60 [ 333.654532][ T7487] __se_sys_add_key+0x349/0x420 [ 333.654569][ T7487] ? __pfx___se_sys_add_key+0x10/0x10 [ 333.654614][ T7487] ? __x64_sys_add_key+0x20/0xc0 [ 333.654650][ T7487] do_syscall_64+0x166/0x520 [ 333.654684][ T7487] ? trace_irq_disable+0x3b/0x140 [ 333.654726][ T7487] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.654751][ T7487] ? clear_bhb_loop+0x70/0xc0 [ 333.654781][ T7487] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.654806][ T7487] RIP: 0033:0x7f6377dbe2d9 [ 333.654829][ T7487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 333.654849][ T7487] RSP: 002b:00007f6376016028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 333.654875][ T7487] RAX: ffffffffffffffda RBX: 00007f6378045fa0 RCX: 00007f6377dbe2d9 [ 333.654892][ T7487] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000007cc0 [ 333.654908][ T7487] RBP: 00007f6377e55888 R08: fffffffffffffffb R09: 0000000000000000 [ 333.654924][ T7487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 333.654938][ T7487] R13: 00007f6378046038 R14: 00007f6378045fa0 R15: 00007fff651a9e18 [ 333.654977][ T7487] [ 333.688194][ T1238] usb 5-1: Using ep0 maxpacket: 32 [ 333.713378][ T1238] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 333.722419][ T1238] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 333.722500][ T1238] usb 5-1: config 0 has no interface number 0 [ 333.817963][ T37] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 333.851309][ T1238] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.851392][ T1238] usb 5-1: Product: syz [ 333.851435][ T1238] usb 5-1: Manufacturer: syz [ 333.851476][ T1238] usb 5-1: SerialNumber: syz [ 333.943750][ T1238] usb 5-1: config 0 descriptor?? [ 334.007919][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 334.009014][ T37] usb 3-1: New USB device found, idVendor=08ca, idProduct=2060, bcdDevice=c6.58 [ 334.011422][ T37] usb 3-1: config index 0 descriptor too short (expected 3659, got 75) [ 334.011450][ T37] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 334.016486][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.016515][ T37] usb 3-1: Product: syz [ 334.016532][ T37] usb 3-1: Manufacturer: syz [ 334.016549][ T37] usb 3-1: SerialNumber: syz [ 334.101120][ T37] usb 3-1: config 0 descriptor?? [ 334.126337][ T37] gspca_main: sunplus-2.14.0 probing 08ca:2060 [ 334.680406][ T37] gspca_sunplus: reg_r err -110 [ 335.209624][ T1238] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 335.209910][ T1238] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 335.302733][ T1238] usb 5-1: USB disconnect, device number 11 [ 336.432280][ T7509] loop0: detected capacity change from 0 to 3904 [ 336.587942][ T5879] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 336.608691][ T7509] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 336.608722][ T7509] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 336.608737][ T7509] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 336.608796][ T7509] loop0: [ 336.739331][ T5879] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 336.741909][ T5879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 336.741942][ T5879] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 336.741969][ T5879] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 336.742015][ T5879] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 336.815714][ T5879] usb 2-1: config 0 descriptor?? [ 337.078959][ T37] sunplus 3-1:0.0: probe with driver sunplus failed with error -110 [ 337.158849][ T37] usb 3-1: USB disconnect, device number 8 [ 337.398214][ T1238] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 337.474482][ T5879] hid_parser_main: 5 callbacks suppressed [ 337.474503][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474526][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474546][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474566][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474585][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474605][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474624][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474644][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474663][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.474682][ T5879] plantronics 0003:047F:FFFF.000E: unknown main item tag 0x0 [ 337.619269][ T1238] usb 4-1: unable to get BOS descriptor or descriptor too short [ 337.619333][ T1238] usb 4-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 337.621031][ T1238] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 337.621058][ T1238] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 337.621111][ T1238] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 337.621153][ T1238] usb 4-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 337.621188][ T1238] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 337.621211][ T1238] usb 4-1: config 1 interface 1 has no altsetting 0 [ 337.748059][ T1238] usb 4-1: string descriptor 0 read error: -22 [ 337.748226][ T1238] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.997114][ T5879] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 338.069814][ T7521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.070463][ T7521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 338.390916][ T1238] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 338.390942][ T1238] usb 4-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 338.390955][ T1238] usb 4-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/1/1 [ 338.778901][ T1238] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 339.092421][ T1238] usb 4-1: 2:0: cannot get min/max values for control 2 (id 2) [ 339.180028][ T1238] usb 4-1: USB disconnect, device number 14 [ 339.268215][ T7531] usb 2-1: string descriptor 0 read error: -108 [ 339.551853][ T4965] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 340.779546][ T4965] usb 2-1: device descriptor read/64, error -32 [ 340.784589][ T7533] program syz.4.422 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 341.018044][ T4965] usb 2-1: reset high-speed USB device number 11 using dummy_hcd [ 342.143092][ T758] IPVS: starting estimator thread 0... [ 342.234716][ T7542] IPVS: using max 11 ests per chain, 26400 per kthread [ 344.118044][ T5694] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 344.317988][ T9] usb 2-1: USB disconnect, device number 11 [ 344.505387][ T7553] loop0: detected capacity change from 0 to 3904 [ 344.562160][ T7553] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 344.562193][ T7553] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 344.562209][ T7553] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 344.562337][ T7553] loop0: [ 344.738986][ T4965] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 344.798158][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 30 seconds [ 344.801557][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 30 seconds [ 344.801593][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 30 seconds [ 344.929429][ T4965] usb 3-1: Using ep0 maxpacket: 16 [ 344.930320][ T4965] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 344.931960][ T4965] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 344.936093][ T4965] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.936120][ T4965] usb 3-1: Product: syz [ 344.936136][ T4965] usb 3-1: Manufacturer: syz [ 344.936152][ T4965] usb 3-1: SerialNumber: syz [ 345.002787][ T4965] usb 3-1: config 0 descriptor?? [ 345.022236][ T4965] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 345.022275][ T4965] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 345.671698][ T7552] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 345.707409][ T7552] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.721176][ T4965] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 345.778124][ T1238] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 345.938751][ T1238] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 345.940473][ T1238] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.940677][ T1238] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.940705][ T1238] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 345.940853][ T1238] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 346.009937][ T1238] usb 4-1: config 0 descriptor?? [ 346.162812][ T7552] netlink: 4 bytes leftover after parsing attributes in process `syz.2.429'. [ 348.115081][ T1238] hid_parser_main: 5 callbacks suppressed [ 348.115110][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.115142][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.115171][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.115218][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155433][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155468][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155497][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155524][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155552][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.155580][ T1238] plantronics 0003:047F:FFFF.000F: unknown main item tag 0x0 [ 348.335031][ T1238] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 348.802989][ T4965] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 348.803025][ T4965] em28xx 3-1:0.0: board has no eeprom [ 348.920087][ T4965] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 348.920144][ T4965] em28xx 3-1:0.0: dvb set to bulk mode. [ 348.921957][ T1238] em28xx 3-1:0.0: Binding DVB extension [ 349.105414][ T1502] IPVS: starting estimator thread 0... [ 349.175052][ T4965] usb 3-1: USB disconnect, device number 9 [ 349.189971][ T7583] IPVS: using max 7 ests per chain, 16800 per kthread [ 349.210491][ T4965] em28xx 3-1:0.0: Disconnecting em28xx [ 349.524901][ T7581] usb 4-1: string descriptor 0 read error: -108 [ 349.659721][ T5694] usb 4-1: reset high-speed USB device number 16 using dummy_hcd [ 349.787928][ T5694] usb 4-1: device descriptor read/64, error -32 [ 349.833729][ T1238] em28xx 3-1:0.0: Registering input extension [ 349.874029][ T4965] em28xx 3-1:0.0: Closing input extension [ 350.039781][ T5694] usb 4-1: reset high-speed USB device number 16 using dummy_hcd [ 350.167923][ T5694] usb 4-1: device descriptor read/64, error -32 [ 351.443507][ T4965] em28xx: Freeing device [ 352.493441][ T5694] usb 4-1: reset high-speed USB device number 16 using dummy_hcd [ 352.552425][ T5694] usb 4-1: device descriptor read/8, error -32 [ 353.930426][ T5694] usb 4-1: reset high-speed USB device number 16 using dummy_hcd [ 353.948306][ T5694] usb 4-1: device descriptor read/8, error -32 [ 354.059152][ T5694] raw-gadget.1 gadget.3: failed to queue suspend event [ 354.202368][ T37] usb 4-1: USB disconnect, device number 16 [ 354.347205][ T4965] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 354.396144][ T7574] raw-gadget.1 gadget.3: failed to queue disconnect event [ 354.519108][ T4965] usb 1-1: Using ep0 maxpacket: 32 [ 354.520911][ T4965] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 354.523960][ T4965] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 354.523987][ T4965] usb 1-1: config 0 has no interface number 0 [ 354.669929][ T4965] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 354.669961][ T4965] usb 1-1: Product: syz [ 354.669978][ T4965] usb 1-1: Manufacturer: syz [ 354.669994][ T4965] usb 1-1: SerialNumber: syz [ 354.712228][ T4965] usb 1-1: config 0 descriptor?? [ 355.127457][ T4965] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 355.127495][ T4965] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 357.695234][ T7603] program syz.4.437 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 357.978381][ T4965] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 357.978622][ T4965] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 358.053809][ T4965] usb 1-1: USB disconnect, device number 21 [ 358.318031][ T5694] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 358.479564][ T5694] usb 4-1: Using ep0 maxpacket: 32 [ 358.484162][ T5694] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 358.485780][ T5694] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 358.485815][ T5694] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 358.485842][ T5694] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 358.485888][ T5694] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.585848][ T5694] usb 4-1: config 0 descriptor?? [ 358.598857][ T4965] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 358.757922][ T4965] usb 1-1: Using ep0 maxpacket: 16 [ 358.759994][ T4965] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 358.784496][ T4965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 358.805287][ T4965] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 358.805320][ T4965] usb 1-1: Product: syz [ 358.805338][ T4965] usb 1-1: Manufacturer: syz [ 358.805354][ T4965] usb 1-1: SerialNumber: syz [ 358.853277][ T4965] usb 1-1: config 0 descriptor?? [ 358.881376][ T4965] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 358.881417][ T4965] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 359.389809][ T5694] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0010/input/input15 [ 359.574511][ T7609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.614462][ T7609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.615739][ T5694] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0010/input/input16 [ 359.662133][ T4965] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 359.865433][ T5694] kye 0003:0458:5011.0010: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 360.361941][ T7615] netlink: 4 bytes leftover after parsing attributes in process `syz.0.446'. [ 360.426319][ C0] kye 0003:0458:5011.0010: usb_submit_urb(ctrl) failed: -1 [ 361.083858][ T4965] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 361.083894][ T4965] em28xx 1-1:0.0: board has no eeprom [ 361.187920][ T4965] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 361.187956][ T4965] em28xx 1-1:0.0: dvb set to bulk mode. [ 361.189391][ T10] em28xx 1-1:0.0: Binding DVB extension [ 361.255248][ T4965] usb 1-1: USB disconnect, device number 22 [ 361.274132][ T5694] usb 4-1: USB disconnect, device number 18 [ 363.110022][ T4965] em28xx 1-1:0.0: Disconnecting em28xx [ 363.439140][ T10] em28xx 1-1:0.0: Registering input extension [ 363.443032][ T4965] em28xx 1-1:0.0: Closing input extension [ 365.439957][ T4965] em28xx: Freeing device [ 365.488972][ T7097] udevd[7097]: setting owner of /dev/bus/usb/001/022 to uid=0, gid=0 failed: No such file or directory [ 365.879861][ T4965] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 366.064402][ T4965] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 366.072204][ T4965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 366.072313][ T4965] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 366.072389][ T4965] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 366.072514][ T4965] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 366.151426][ T4965] usb 1-1: config 0 descriptor?? [ 369.750052][ T4965] usbhid 1-1:0.0: can't add hid device: -71 [ 369.750183][ T4965] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 369.924210][ T4965] usb 1-1: USB disconnect, device number 23 [ 373.208415][ T5831] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 376.347959][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 60 seconds [ 376.348011][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 60 seconds [ 376.348035][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 60 seconds [ 377.951604][ T4953] udevd[4953]: worker [7133] /devices/virtual/block/nbd3 is taking a long time [ 379.240107][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.240186][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.955618][ T37] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 380.468746][ T37] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 380.471694][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 380.471738][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 380.471763][ T37] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 380.471808][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 381.610151][ T37] usb 3-1: config 0 descriptor?? [ 381.772344][ T7695] program syz.4.457 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 382.048015][ T4965] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 382.231758][ T4965] usb 2-1: Using ep0 maxpacket: 32 [ 382.232642][ T4965] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 382.232836][ T37] hid_parser_main: 5 callbacks suppressed [ 382.232857][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.232887][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.232914][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.232942][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.232971][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.232998][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.233026][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.233054][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.233091][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.233119][ T37] plantronics 0003:047F:FFFF.0011: unknown main item tag 0x0 [ 382.248969][ T4965] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 382.249051][ T4965] usb 2-1: config 0 has no interface number 0 [ 382.366036][ T37] plantronics 0003:047F:FFFF.0011: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 382.418372][ T4965] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.418404][ T4965] usb 2-1: Product: syz [ 382.418420][ T4965] usb 2-1: Manufacturer: syz [ 382.418436][ T4965] usb 2-1: SerialNumber: syz [ 382.468280][ T4965] usb 2-1: config 0 descriptor?? [ 382.767943][ T37] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 382.944308][ T37] usb 1-1: New USB device found, idVendor=15a4, idProduct=9035, bcdDevice= 2.00 [ 382.967069][ T4965] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 382.967104][ T4965] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 383.093917][ T37] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 383.094074][ T37] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 383.094125][ T37] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 383.967805][ T37] dvb_usb_af9035 1-1:1.0: command=00 checksum mismatch (0000 != fdfc) [ 383.967921][ T37] dvb_usb_af9035 1-1:1.0: probe with driver dvb_usb_af9035 failed with error -5 [ 384.023166][ T10] usb 3-1: USB disconnect, device number 10 [ 384.233224][ T37] usb 1-1: USB disconnect, device number 24 [ 385.048009][ T37] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 385.197874][ T37] usb 4-1: Using ep0 maxpacket: 8 [ 385.234008][ T37] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 385.250899][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.250931][ T37] usb 4-1: Product: syz [ 385.250949][ T37] usb 4-1: Manufacturer: syz [ 385.250983][ T37] usb 4-1: SerialNumber: syz [ 385.284019][ T37] usb 4-1: config 0 descriptor?? [ 385.302693][ T37] gspca_main: se401-2.14.0 probing 047d:5003 [ 385.666546][ T10] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 385.841467][ T10] usb 3-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.40 [ 385.864019][ T10] usb 3-1: config 1 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 95, changing to 10 [ 385.864281][ T10] usb 3-1: config 1 interface 0 has no altsetting 0 [ 385.895604][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.895883][ T10] usb 3-1: Product: Ј [ 385.895904][ T10] usb 3-1: Manufacturer: 㰊 [ 385.895921][ T10] usb 3-1: SerialNumber: 䀁 [ 386.619929][ T4965] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000006c: -71 [ 386.621824][ T4965] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 386.731624][ T4965] usb 2-1: USB disconnect, device number 12 [ 387.055069][ T10] usbhid 3-1:1.0: can't add hid device: -71 [ 387.055194][ T10] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 387.088899][ T10] usb 3-1: USB disconnect, device number 11 [ 393.507537][ T37] gspca_se401: read req failed req 0x06 error -19 [ 393.529763][ T37] usb 4-1: USB disconnect, device number 20 [ 396.730682][ T7751] program syz.3.484 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 396.969551][ T9] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 397.127403][ T9] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 397.677996][ T5590] Bluetooth: hci5: command 0x0406 tx timeout [ 398.165321][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 398.165359][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 398.165386][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 398.165434][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 398.219613][ T9] usb 5-1: config 0 descriptor?? [ 398.665122][ T9] usbhid 5-1:0.0: can't add hid device: -71 [ 398.665262][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 398.729744][ T9] usb 5-1: USB disconnect, device number 12 [ 400.638876][ T37] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 401.958698][ T37] usb 5-1: New USB device found, idVendor=0853, idProduct=0313, bcdDevice= 0.40 [ 401.960101][ T37] usb 5-1: config 1 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 95, changing to 10 [ 401.960140][ T37] usb 5-1: config 1 interface 0 has no altsetting 0 [ 402.275293][ T37] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.275326][ T37] usb 5-1: Product: Ј [ 402.275342][ T37] usb 5-1: Manufacturer: 㰊 [ 402.275358][ T37] usb 5-1: SerialNumber: 䀁 [ 402.776503][ T37] usbhid 5-1:1.0: can't add hid device: -71 [ 402.776642][ T37] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 402.842317][ T37] usb 5-1: USB disconnect, device number 13 [ 402.865876][ T5590] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 402.891808][ T5590] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 402.895783][ T5590] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 402.968526][ T5590] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 402.973840][ T5590] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 405.037982][ T10] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 405.157917][ T5596] Bluetooth: hci1: command tx timeout [ 405.187938][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 405.194273][ T10] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 405.440379][ T10] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 405.440413][ T10] usb 3-1: config 0 has no interface number 0 [ 406.575284][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.575309][ T10] usb 3-1: Product: syz [ 406.597512][ T10] usb 3-1: config 0 descriptor?? [ 406.606230][ T10] usb 3-1: can't set config #0, error -71 [ 406.623352][ T10] usb 3-1: USB disconnect, device number 12 [ 406.878426][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 90 seconds [ 406.878480][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 90 seconds [ 406.878515][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 90 seconds [ 408.648211][ T5596] Bluetooth: hci1: command tx timeout [ 409.454899][ T7802] netlink: 4 bytes leftover after parsing attributes in process `syz.3.490'. [ 409.582876][ T7802] bridge0: port 3(syz_tun) entered disabled state [ 409.924527][ T7802] syz_tun (unregistering): left allmulticast mode [ 409.924568][ T7802] syz_tun (unregistering): left promiscuous mode [ 409.924697][ T7802] bridge0: port 3(syz_tun) entered disabled state [ 411.316287][ T5596] Bluetooth: hci1: command tx timeout [ 411.408169][ T7808] program syz.1.500 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 411.519088][ T7811] FAULT_INJECTION: forcing a failure. [ 411.519088][ T7811] name failslab, interval 1, probability 0, space 0, times 0 [ 411.519156][ T7811] CPU: 1 UID: 0 PID: 7811 Comm: syz.4.494 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 411.519185][ T7811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 411.519206][ T7811] Call Trace: [ 411.519216][ T7811] [ 411.519227][ T7811] dump_stack_lvl+0xe8/0x150 [ 411.519270][ T7811] should_fail_ex+0x46b/0x600 [ 411.519316][ T7811] ? alloc_inode+0xb8/0x1b0 [ 411.519344][ T7811] should_failslab+0xa8/0x100 [ 411.519374][ T7811] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 411.519414][ T7811] ? alloc_inode+0xb8/0x1b0 [ 411.519449][ T7811] alloc_inode+0xb8/0x1b0 [ 411.519479][ T7811] new_inode+0x1f/0x170 [ 411.519513][ T7811] devpts_pty_new+0xd9/0x610 [ 411.519551][ T7811] ? __pfx_devpts_pty_new+0x10/0x10 [ 411.519578][ T7811] ? rt_spin_unlock+0x159/0x200 [ 411.519612][ T7811] ? rt_spin_unlock+0x165/0x200 [ 411.519653][ T7811] ptmx_open+0x1d1/0x2e0 [ 411.519691][ T7811] chrdev_open+0x4dc/0x600 [ 411.519720][ T7811] ? __pfx_chrdev_open+0x10/0x10 [ 411.519745][ T7811] ? fsnotify_open_perm_and_set_mode+0x13b/0x6c0 [ 411.519792][ T7811] ? __pfx_chrdev_open+0x10/0x10 [ 411.519816][ T7811] do_dentry_open+0x849/0x1420 [ 411.519856][ T7811] vfs_open+0x3b/0x350 [ 411.519878][ T7811] ? path_openat+0x142d/0x1d60 [ 411.519917][ T7811] path_openat+0x1448/0x1d60 [ 411.519977][ T7811] do_file_open+0x23e/0x4a0 [ 411.520018][ T7811] ? __pfx_do_file_open+0x10/0x10 [ 411.520083][ T7811] ? alloc_fd+0x654/0x6d0 [ 411.520124][ T7811] do_sys_openat2+0x115/0x200 [ 411.520151][ T7811] ? __se_sys_futex+0x3a8/0x450 [ 411.520178][ T7811] ? __pfx_do_sys_openat2+0x10/0x10 [ 411.520213][ T7811] ? rcu_is_watching+0x16/0xb0 [ 411.520245][ T7811] __x64_sys_openat+0x138/0x170 [ 411.520278][ T7811] do_syscall_64+0x166/0x520 [ 411.520312][ T7811] ? trace_irq_disable+0x3b/0x140 [ 411.520345][ T7811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.520370][ T7811] ? clear_bhb_loop+0x70/0xc0 [ 411.520401][ T7811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.520433][ T7811] RIP: 0033:0x7fe88563e2d9 [ 411.520456][ T7811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.520478][ T7811] RSP: 002b:00007fe883896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 411.520506][ T7811] RAX: ffffffffffffffda RBX: 00007fe8858c5fa0 RCX: 00007fe88563e2d9 [ 411.520525][ T7811] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 411.520542][ T7811] RBP: 00007fe8856d5888 R08: 0000000000000000 R09: 0000000000000000 [ 411.520558][ T7811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 411.520572][ T7811] R13: 00007fe8858c6038 R14: 00007fe8858c5fa0 R15: 00007ffe70980dc8 [ 411.520612][ T7811] [ 413.317896][ T5590] Bluetooth: hci1: command tx timeout [ 413.510369][ T7820] netlink: 104 bytes leftover after parsing attributes in process `syz.3.503'. [ 413.795342][ T7823] netlink: 48 bytes leftover after parsing attributes in process `syz.2.497'. [ 413.812550][ T5588] bridge0: port 3(syz_tun) entered disabled state [ 414.000774][ T5588] syz_tun (unregistering): left allmulticast mode [ 414.000812][ T5588] syz_tun (unregistering): left promiscuous mode [ 414.000939][ T5588] bridge0: port 3(syz_tun) entered disabled state [ 414.369190][ T1238] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 414.744785][ T1238] usb 3-1: Using ep0 maxpacket: 32 [ 414.792999][ T1238] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 415.322153][ T1238] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 415.322254][ T1238] usb 3-1: config 0 has no interface number 0 [ 415.716424][ T1238] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.716455][ T1238] usb 3-1: Product: syz [ 415.716472][ T1238] usb 3-1: Manufacturer: syz [ 415.716488][ T1238] usb 3-1: SerialNumber: syz [ 415.787580][ T1238] usb 3-1: config 0 descriptor?? [ 415.905027][ T7829] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 416.358835][ T1238] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 416.358888][ T1238] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 418.279513][ T1238] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 418.279828][ T1238] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 418.888957][ T1238] usb 3-1: USB disconnect, device number 13 [ 422.691865][ T7852] program syz.1.511 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 423.597636][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.544552][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.733191][ T7877] gfs2: error -5 reading superblock [ 425.841577][ T7877] netlink: 'syz.2.517': attribute type 21 has an invalid length. [ 425.841695][ T7877] IPv6: NLM_F_CREATE should be specified when creating new route [ 429.410707][ T5879] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 429.777906][ T5879] usb 5-1: Using ep0 maxpacket: 32 [ 429.778973][ T5879] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 429.780572][ T5879] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 429.780602][ T5879] usb 5-1: config 0 has no interface number 0 [ 429.783751][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.783779][ T5879] usb 5-1: Product: syz [ 429.783795][ T5879] usb 5-1: Manufacturer: syz [ 429.783812][ T5879] usb 5-1: SerialNumber: syz [ 430.233212][ T5879] usb 5-1: config 0 descriptor?? [ 431.087873][ T7891] program syz.2.522 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 432.156089][ T5879] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 432.156402][ T5879] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 432.192928][ T5879] usb 5-1: USB disconnect, device number 14 [ 432.284176][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.111671][ T7911] loop0: detected capacity change from 0 to 3904 [ 433.299239][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.908281][ T7935] netlink: 'syz.3.532': attribute type 21 has an invalid length. [ 437.002013][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 120 seconds [ 437.009249][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 120 seconds [ 437.009587][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 120 seconds [ 437.690414][ T7927] kAFS: unable to lookup cell '(G' [ 438.905061][ T7772] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.905455][ T7772] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.905619][ T7772] bridge_slave_0: entered allmulticast mode [ 438.909040][ T7772] bridge_slave_0: entered promiscuous mode [ 438.912853][ T7772] bridge0: port 2(bridge_slave_1) entered blocking state [ 438.913087][ T7772] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.913287][ T7772] bridge_slave_1: entered allmulticast mode [ 438.916105][ T7772] bridge_slave_1: entered promiscuous mode [ 438.965370][ T7772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 438.969728][ T7772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.107001][ T7772] team0: Port device team_slave_0 added [ 439.117257][ T7772] team0: Port device team_slave_1 added [ 439.174902][ T7772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 439.174922][ T7772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.174952][ T7772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 439.226118][ T7772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 439.226137][ T7772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 439.226167][ T7772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 440.580724][ T7938] program syz.1.533 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 440.729218][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.729301][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.942980][ T7772] hsr_slave_0: entered promiscuous mode [ 441.950314][ T7772] hsr_slave_1: entered promiscuous mode [ 441.963260][ T7772] debugfs: 'hsr0' already exists in 'hsr' [ 441.963292][ T7772] Cannot create hsr debugfs directory [ 442.759014][ T12] bridge_slave_1: left allmulticast mode [ 442.759058][ T12] bridge_slave_1: left promiscuous mode [ 442.759358][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 442.953408][ T12] bridge_slave_0: left allmulticast mode [ 442.953449][ T12] bridge_slave_0: left promiscuous mode [ 442.953703][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.707960][ T37] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 443.857849][ T37] usb 2-1: Using ep0 maxpacket: 32 [ 443.858794][ T37] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 443.860161][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 443.860192][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 443.860231][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.922655][ T37] usb 2-1: config 0 descriptor?? [ 443.935856][ T37] hub 2-1:0.0: USB hub found [ 444.148217][ T37] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 444.499681][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 444.563571][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 444.573993][ T37] hid_parser_main: 5 callbacks suppressed [ 444.574078][ T37] hid-generic 0003:046D:C31C.0012: unknown main item tag 0x0 [ 444.604595][ T12] bond0 (unregistering): Released all slaves [ 444.640270][ T37] hid-generic 0003:046D:C31C.0012: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.1-1/input0 [ 444.697586][ T5249] 8021q: adding VLAN 0 to HW filter on device eth1 [ 444.861750][ T7980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 444.863980][ T7980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 445.158061][ T37] usb 2-1: USB disconnect, device number 13 [ 445.207913][ T5694] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 445.367859][ T5694] usb 3-1: Using ep0 maxpacket: 8 [ 445.368729][ T5694] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 445.372685][ T5694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.372715][ T5694] usb 3-1: Product: syz [ 445.372726][ T5694] usb 3-1: Manufacturer: syz [ 445.372738][ T5694] usb 3-1: SerialNumber: syz [ 445.377238][ T5694] usb 3-1: config 0 descriptor?? [ 445.453379][ T5694] gspca_main: se401-2.14.0 probing 047d:5003 [ 445.713473][ T10] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 446.935179][ T7988] program syz.1.543 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 447.277983][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 447.278961][ T10] usb 5-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 447.280752][ T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.280809][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.396439][ T10] usb 5-1: config 0 descriptor?? [ 447.410358][ T10] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 447.824619][ T5694] gspca_se401: read req failed req 0x06 error -19 [ 448.130262][ T5694] usb 3-1: USB disconnect, device number 14 [ 448.320506][ T10] gspca_vc032x: reg_w err -110 [ 448.320986][ T10] vc032x 5-1:0.0: probe with driver vc032x failed with error -110 [ 448.703047][ T7998] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 451.324751][ T6004] usb 5-1: USB disconnect, device number 15 [ 451.524364][ T12] hsr_slave_0: left promiscuous mode [ 451.562527][ T12] hsr_slave_1: left promiscuous mode [ 451.563801][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 451.563841][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 453.133040][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 453.133772][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 453.330448][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 453.502747][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 453.505367][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 453.563488][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 453.568762][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 455.051330][ T12] veth1_macvtap: left promiscuous mode [ 455.051431][ T12] veth0_macvtap: left promiscuous mode [ 455.051653][ T12] veth1_vlan: left promiscuous mode [ 455.051821][ T12] veth0_vlan: left promiscuous mode [ 456.372918][ T5590] Bluetooth: hci3: command tx timeout [ 457.077877][ T31] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 457.358423][ T31] usb 5-1: Using ep0 maxpacket: 8 [ 457.771370][ T31] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 457.793316][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.793351][ T31] usb 5-1: Product: syz [ 457.793368][ T31] usb 5-1: Manufacturer: syz [ 457.793386][ T31] usb 5-1: SerialNumber: syz [ 457.809990][ T31] usb 5-1: config 0 descriptor?? [ 457.823549][ T31] gspca_main: se401-2.14.0 probing 047d:5003 [ 458.437887][ T5596] Bluetooth: hci3: command tx timeout [ 458.619526][ T12] team0 (unregistering): Port device team_slave_1 removed [ 458.660192][ T12] team0 (unregistering): Port device team_slave_0 removed [ 458.734771][ T31] gspca_se401: read req failed req 0x06 error -19 [ 458.737468][ T31] usb 5-1: USB disconnect, device number 16 [ 458.897918][ T31] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 458.959445][ T5249] 8021q: adding VLAN 0 to HW filter on device eth2 [ 459.060341][ T31] usb 5-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 459.080870][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.080901][ T31] usb 5-1: Product: syz [ 459.080918][ T31] usb 5-1: Manufacturer: syz [ 459.080934][ T31] usb 5-1: SerialNumber: syz [ 459.152549][ T31] usb 5-1: config 0 descriptor?? [ 459.172262][ T31] gspca_main: se401-2.14.0 probing 047d:5003 [ 459.985562][ T7772] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 460.129128][ T7772] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 460.132542][ T7772] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 460.204364][ T31] gspca_se401: read req failed req 0x06 error -19 [ 460.230352][ T31] usb 5-1: USB disconnect, device number 17 [ 460.262336][ T7772] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 460.294357][ T7772] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 460.437936][ T5596] Bluetooth: hci6: command 0x1003 tx timeout [ 460.438077][ T5590] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 460.517920][ T5590] Bluetooth: hci3: command tx timeout [ 460.525175][ T7772] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 460.611471][ T7772] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 460.787568][ T31] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 460.818543][ T7772] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 460.938872][ T31] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 460.942024][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.942061][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.942088][ T31] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 460.942135][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.024805][ T31] usb 5-1: config 0 descriptor?? [ 461.697354][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697428][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697457][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697485][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697514][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697542][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697570][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697597][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697627][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.697656][ T31] plantronics 0003:047F:FFFF.0013: unknown main item tag 0x0 [ 461.817088][ T31] plantronics 0003:047F:FFFF.0013: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 461.955445][ T12] IPVS: stop unused estimator thread 0... [ 462.320845][ T8092] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 462.601563][ T5590] Bluetooth: hci3: command tx timeout [ 463.378766][ T8106] Zero length message leads to an empty skb [ 463.461547][ T5249] 8021q: adding VLAN 0 to HW filter on device eth3 [ 463.488171][ T31] usb 5-1: reset high-speed USB device number 18 using dummy_hcd [ 464.123288][ T5596] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 464.163882][ T5596] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 464.165343][ T5596] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 464.221542][ T5596] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 464.229250][ T5596] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 464.364433][ T5694] usb 5-1: USB disconnect, device number 18 [ 467.571452][ T5590] Bluetooth: hci6: command tx timeout [ 467.677980][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 150 seconds [ 467.678047][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 150 seconds [ 467.678077][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 150 seconds [ 468.298816][ T8155] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 468.508449][ T5249] 8021q: adding VLAN 0 to HW filter on device eth4 [ 469.956081][ T5590] Bluetooth: hci6: command tx timeout [ 470.763200][ T8016] bridge0: port 1(bridge_slave_0) entered blocking state [ 470.784613][ T8016] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.784833][ T8016] bridge_slave_0: entered allmulticast mode [ 470.810731][ T8016] bridge_slave_0: entered promiscuous mode [ 470.856634][ T8016] bridge0: port 2(bridge_slave_1) entered blocking state [ 470.859044][ T8016] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.859244][ T8016] bridge_slave_1: entered allmulticast mode [ 470.862135][ T8016] bridge_slave_1: entered promiscuous mode [ 471.025230][ T8016] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 471.069448][ T8016] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 471.274947][ T8016] team0: Port device team_slave_0 added [ 471.297221][ T8016] team0: Port device team_slave_1 added [ 471.382195][ T8182] FAULT_INJECTION: forcing a failure. [ 471.382195][ T8182] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 471.382235][ T8182] CPU: 1 UID: 0 PID: 8182 Comm: syz.2.577 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 471.382262][ T8182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 471.382277][ T8182] Call Trace: [ 471.382286][ T8182] [ 471.382297][ T8182] dump_stack_lvl+0xe8/0x150 [ 471.382339][ T8182] should_fail_ex+0x46b/0x600 [ 471.382382][ T8182] _copy_to_user+0x31/0xb0 [ 471.382419][ T8182] bpf_verifier_vlog+0x606/0x900 [ 471.382464][ T8182] __btf_verifier_log+0xe2/0x140 [ 471.382501][ T8182] ? __pfx___btf_verifier_log+0x10/0x10 [ 471.382545][ T8182] btf_datasec_check_meta+0x6f1/0xad0 [ 471.382598][ T8182] btf_check_all_metas+0x344/0xa30 [ 471.382637][ T8182] btf_parse_type_sec+0xfb/0x1950 [ 471.382672][ T8182] ? __pfx___btf_verifier_log+0x10/0x10 [ 471.382704][ T8182] ? __pfx_btf_check_sec_info+0x10/0x10 [ 471.382740][ T8182] ? btf_parse_hdr+0x5f2/0x810 [ 471.382764][ T8182] ? btf_parse_str_sec+0x244/0x2f0 [ 471.382796][ T8182] btf_new_fd+0x3e0/0x8f0 [ 471.382843][ T8182] __sys_bpf+0xd2e/0xd90 [ 471.382889][ T8182] ? __pfx___sys_bpf+0x10/0x10 [ 471.382935][ T8182] ? do_futex+0x3e7/0x4e0 [ 471.382996][ T8182] ? rcu_is_watching+0x16/0xb0 [ 471.383027][ T8182] __x64_sys_bpf+0xba/0xd0 [ 471.383064][ T8182] do_syscall_64+0x166/0x520 [ 471.383100][ T8182] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.383124][ T8182] ? clear_bhb_loop+0x70/0xc0 [ 471.383154][ T8182] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.383179][ T8182] RIP: 0033:0x7fd61985e2d9 [ 471.383201][ T8182] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.383234][ T8182] RSP: 002b:00007fd617ab6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 471.383260][ T8182] RAX: ffffffffffffffda RBX: 00007fd619ae5fa0 RCX: 00007fd61985e2d9 [ 471.383277][ T8182] RDX: 0000000000000028 RSI: 0000200000001380 RDI: 0000000000000012 [ 471.383293][ T8182] RBP: 00007fd6198f5888 R08: 0000000000000000 R09: 0000000000000000 [ 471.383308][ T8182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 471.383323][ T8182] R13: 00007fd619ae6038 R14: 00007fd619ae5fa0 R15: 00007ffe82be9aa8 [ 471.383360][ T8182] [ 471.957987][ T5590] Bluetooth: hci6: command tx timeout [ 474.260281][ T5590] Bluetooth: hci6: command tx timeout [ 474.556799][ T8199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.572'. [ 474.730911][ T8016] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 474.730944][ T8016] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.730964][ T8016] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 474.818462][ T8016] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 474.818478][ T8016] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.818500][ T8016] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 475.866220][ T8016] hsr_slave_0: entered promiscuous mode [ 475.867627][ T8016] hsr_slave_1: entered promiscuous mode [ 475.884930][ T8016] debugfs: 'hsr0' already exists in 'hsr' [ 475.884959][ T8016] Cannot create hsr debugfs directory [ 476.467875][ T5831] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 476.627881][ T5831] usb 5-1: Using ep0 maxpacket: 32 [ 476.628850][ T5831] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 476.629931][ T5831] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.629994][ T5831] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 476.630023][ T5831] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.769154][ T5831] usb 5-1: config 0 descriptor?? [ 476.804405][ T5831] hub 5-1:0.0: USB hub found [ 477.005739][ T5831] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 477.620198][ T8218] netlink: 4 bytes leftover after parsing attributes in process `syz.1.586'. [ 477.626691][ T5831] hid_parser_main: 5 callbacks suppressed [ 477.626718][ T5831] hid-generic 0003:046D:C31C.0014: unknown main item tag 0x0 [ 477.827208][ T8210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.881095][ T8210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.883783][ T5831] hid-generic 0003:046D:C31C.0014: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.4-1/input0 [ 478.031164][ T5831] usb 5-1: USB disconnect, device number 19 [ 478.400653][ T8219] fido_id[8219]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 479.777964][ T8226] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 487.130322][ T1449] bridge_slave_1: left allmulticast mode [ 487.130364][ T1449] bridge_slave_1: left promiscuous mode [ 487.130641][ T1449] bridge0: port 2(bridge_slave_1) entered disabled state [ 487.331046][ T1449] bridge_slave_0: left allmulticast mode [ 487.331089][ T1449] bridge_slave_0: left promiscuous mode [ 487.331371][ T1449] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.782204][ T8255] FAULT_INJECTION: forcing a failure. [ 487.782204][ T8255] name fail_futex, interval 1, probability 0, space 0, times 1 [ 487.782247][ T8255] CPU: 1 UID: 0 PID: 8255 Comm: syz.4.595 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 487.782275][ T8255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.782291][ T8255] Call Trace: [ 487.782300][ T8255] [ 487.782311][ T8255] dump_stack_lvl+0xe8/0x150 [ 487.782354][ T8255] should_fail_ex+0x46b/0x600 [ 487.782400][ T8255] get_futex_key+0x1b4/0x1580 [ 487.782451][ T8255] ? __pfx_get_futex_key+0x10/0x10 [ 487.782491][ T8255] ? update_se+0x90/0xf90 [ 487.782533][ T8255] futex_wait_setup+0x4a/0x590 [ 487.782572][ T8255] ? __futex_wait+0xe1/0x410 [ 487.782610][ T8255] __futex_wait+0x161/0x410 [ 487.782648][ T8255] ? __pfx___futex_wait+0x10/0x10 [ 487.782684][ T8255] ? __pfx_futex_wake_mark+0x10/0x10 [ 487.782721][ T8255] ? try_to_wake_up+0x84b/0x1430 [ 487.782764][ T8255] futex_wait+0x121/0x390 [ 487.782798][ T8255] ? __pfx_futex_wait+0x10/0x10 [ 487.782838][ T8255] ? do_mprotect_pkey+0xb1e/0xd10 [ 487.782886][ T8255] do_futex+0x3e7/0x4e0 [ 487.782919][ T8255] ? __pfx_do_futex+0x10/0x10 [ 487.782956][ T8255] __se_sys_futex+0x3a8/0x450 [ 487.782989][ T8255] ? __pfx___se_sys_futex+0x10/0x10 [ 487.783014][ T8255] ? rcu_is_watching+0x16/0xb0 [ 487.783046][ T8255] ? __x64_sys_futex+0x21/0xf0 [ 487.783075][ T8255] do_syscall_64+0x166/0x520 [ 487.783109][ T8255] ? trace_irq_disable+0x3b/0x140 [ 487.783142][ T8255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.783167][ T8255] ? clear_bhb_loop+0x70/0xc0 [ 487.783197][ T8255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.783221][ T8255] RIP: 0033:0x7fe88563e2d9 [ 487.783242][ T8255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 487.783263][ T8255] RSP: 002b:00007fe8838960e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 487.783290][ T8255] RAX: ffffffffffffffda RBX: 00007fe8858c5fa8 RCX: 00007fe88563e2d9 [ 487.783311][ T8255] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe8858c5fa8 [ 487.783327][ T8255] RBP: 00007fe8858c5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 487.783343][ T8255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 487.783357][ T8255] R13: 00007fe8858c6038 R14: 00007ffe70980ce0 R15: 00007ffe70980dc8 [ 487.783394][ T8255] [ 489.107621][ T8260] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 490.818073][ T1449] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 491.506154][ T1449] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 492.702446][ T1449] bond0 (unregistering): Released all slaves [ 493.973908][ T5590] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 494.014827][ T5590] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 494.016981][ T5590] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 494.030595][ T5590] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 494.034133][ T5590] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 494.172737][ T1449] hsr_slave_0: left promiscuous mode [ 494.218347][ T1449] hsr_slave_1: left promiscuous mode [ 494.221288][ T1449] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 494.267543][ T1449] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 494.972738][ T8297] netlink: 12 bytes leftover after parsing attributes in process `syz.4.606'. [ 497.045703][ T5596] Bluetooth: hci1: command tx timeout [ 497.211555][ T1449] team0 (unregistering): Port device team_slave_1 removed [ 497.349920][ T1449] team0 (unregistering): Port device team_slave_0 removed [ 497.757877][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 180 seconds [ 497.757940][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 180 seconds [ 497.757975][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 180 seconds [ 497.848324][ T4953] udevd[4953]: worker [7133] /devices/virtual/block/nbd3 timeout; kill it [ 497.867815][ T4953] udevd[4953]: seq 12266 '/devices/virtual/block/nbd3' killed [ 498.541956][ T8114] bridge0: port 1(bridge_slave_0) entered blocking state [ 498.542070][ T8114] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.542207][ T8114] bridge_slave_0: entered allmulticast mode [ 498.553336][ T8114] bridge_slave_0: entered promiscuous mode [ 498.579882][ T8114] bridge0: port 2(bridge_slave_1) entered blocking state [ 498.580123][ T8114] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.580293][ T8114] bridge_slave_1: entered allmulticast mode [ 498.600931][ T8114] bridge_slave_1: entered promiscuous mode [ 498.613087][ T8016] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 498.712396][ T8016] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 498.772434][ T8016] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 498.829242][ T8016] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 499.093735][ T5596] Bluetooth: hci1: command tx timeout [ 499.220141][ T8313] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 500.151075][ T8016] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 501.157964][ T5596] Bluetooth: hci1: command tx timeout [ 501.598352][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.598435][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.814654][ T8016] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 501.873480][ T8114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 501.874504][ T8016] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 502.004302][ T8016] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 502.020108][ T8114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.234673][ T8114] team0: Port device team_slave_0 added [ 502.252880][ T8114] team0: Port device team_slave_1 added [ 502.580208][ T8114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 502.580228][ T8114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 502.580254][ T8114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 502.596988][ T8114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 502.597007][ T8114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 502.597037][ T8114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 503.394119][ T5596] Bluetooth: hci1: command tx timeout [ 504.910980][ T8114] hsr_slave_0: entered promiscuous mode [ 504.913112][ T8114] hsr_slave_1: entered promiscuous mode [ 504.917201][ T8114] debugfs: 'hsr0' already exists in 'hsr' [ 504.917221][ T8114] Cannot create hsr debugfs directory [ 505.248081][ T5249] 8021q: adding VLAN 0 to HW filter on device eth5 [ 506.620836][ T8016] 8021q: adding VLAN 0 to HW filter on device bond0 [ 507.403806][ T8016] 8021q: adding VLAN 0 to HW filter on device team0 [ 507.517976][ T10] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 507.667907][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 507.668764][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 507.670884][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 507.674416][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.674444][ T10] usb 5-1: Product: syz [ 507.674461][ T10] usb 5-1: Manufacturer: syz [ 507.674478][ T10] usb 5-1: SerialNumber: syz [ 507.734712][ T10] usb 5-1: config 0 descriptor?? [ 507.771296][ T10] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 507.771339][ T10] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 507.899848][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 507.920051][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 508.363818][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.364241][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 508.461209][ T8285] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.461356][ T8285] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.461545][ T8285] bridge_slave_0: entered allmulticast mode [ 508.494487][ T8285] bridge_slave_0: entered promiscuous mode [ 508.517358][ T8367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.530181][ T8367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.567976][ T10] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 508.572526][ T8285] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.572686][ T8285] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.572919][ T8285] bridge_slave_1: entered allmulticast mode [ 508.607662][ T8285] bridge_slave_1: entered promiscuous mode [ 508.996864][ T8367] netlink: 4 bytes leftover after parsing attributes in process `syz.4.613'. [ 509.360036][ T10] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 509.360064][ T10] em28xx 5-1:0.0: board has no eeprom [ 509.497894][ T10] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 509.498059][ T10] em28xx 5-1:0.0: dvb set to bulk mode. [ 509.500836][ T4965] em28xx 5-1:0.0: Binding DVB extension [ 509.574031][ T10] usb 5-1: USB disconnect, device number 20 [ 509.597593][ T10] em28xx 5-1:0.0: Disconnecting em28xx [ 509.654519][ T8285] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.717359][ T8285] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.849178][ T4965] em28xx 5-1:0.0: Registering input extension [ 509.866008][ T10] em28xx 5-1:0.0: Closing input extension [ 510.135741][ T10] em28xx: Freeing device [ 510.266396][ T8394] netlink: 12 bytes leftover after parsing attributes in process `syz.4.614'. [ 510.314542][ T8285] team0: Port device team_slave_0 added [ 510.422082][ T8285] team0: Port device team_slave_1 added [ 510.801147][ T37] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 510.957918][ T37] usb 3-1: Using ep0 maxpacket: 32 [ 510.958722][ T37] usb 3-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 510.959750][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 510.959773][ T37] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 510.959790][ T37] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 510.959820][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.035988][ T37] usb 3-1: config 0 descriptor?? [ 511.555018][ T37] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0015/input/input20 [ 511.962482][ T37] input: HID 0458:5011 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:0458:5011.0015/input/input21 [ 513.067832][ T37] kye 0003:0458:5011.0015: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.2-1/input0 [ 514.099676][ T10] usb 3-1: USB disconnect, device number 16 [ 514.539567][ T8414] fido_id[8414]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 514.669664][ T8285] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 514.669683][ T8285] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 514.669727][ T8285] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 514.782935][ T5590] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 514.827578][ T5590] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 514.837590][ T5590] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 514.846101][ T5590] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 514.850305][ T5590] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 514.990885][ T8285] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 514.990904][ T8285] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 514.990928][ T8285] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 517.157857][ T5590] Bluetooth: hci7: command tx timeout [ 517.860034][ T8285] hsr_slave_0: entered promiscuous mode [ 517.861520][ T8285] hsr_slave_1: entered promiscuous mode [ 517.862504][ T8285] debugfs: 'hsr0' already exists in 'hsr' [ 517.862530][ T8285] Cannot create hsr debugfs directory [ 518.049203][ T8114] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 518.114758][ T8114] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 518.688201][ T8114] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 518.744460][ T8114] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 518.845158][ T8114] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 518.956135][ T8114] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 519.114763][ T8114] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 519.193653][ T8114] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 519.238248][ T5590] Bluetooth: hci7: command tx timeout [ 519.547857][ T5879] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 519.701364][ T5879] usb 5-1: Using ep0 maxpacket: 16 [ 519.704444][ T5879] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 519.705667][ T5879] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 519.740139][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.740167][ T5879] usb 5-1: Product: syz [ 519.740189][ T5879] usb 5-1: Manufacturer: syz [ 519.740201][ T5879] usb 5-1: SerialNumber: syz [ 519.754989][ T5879] usb 5-1: config 0 descriptor?? [ 519.853704][ T5879] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 519.853744][ T5879] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 520.474141][ T8451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.477366][ T8451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.516063][ T5879] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 520.959758][ T8451] netlink: 4 bytes leftover after parsing attributes in process `syz.4.621'. [ 521.317845][ T5590] Bluetooth: hci7: command tx timeout [ 521.504254][ T5879] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 521.504282][ T5879] em28xx 5-1:0.0: board has no eeprom [ 521.519505][ T8464] netlink: 12 bytes leftover after parsing attributes in process `syz.2.623'. [ 521.607962][ T5879] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 521.607996][ T5879] em28xx 5-1:0.0: dvb set to bulk mode. [ 521.609542][ T6004] em28xx 5-1:0.0: Binding DVB extension [ 521.698844][ T5879] usb 5-1: USB disconnect, device number 21 [ 521.705641][ T5879] em28xx 5-1:0.0: Disconnecting em28xx [ 522.316665][ T6004] em28xx 5-1:0.0: Registering input extension [ 522.326441][ T5879] em28xx 5-1:0.0: Closing input extension [ 523.170596][ T5879] em28xx: Freeing device [ 523.405989][ T5590] Bluetooth: hci7: command tx timeout [ 524.302396][ T5596] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 524.362211][ T5596] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 524.382658][ T5596] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 524.387453][ T5596] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 524.415212][ T5596] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 524.713915][ T8485] netlink: 'syz.2.626': attribute type 8 has an invalid length. [ 525.006360][ T8487] bridge0: port 3(syz_tun) entered blocking state [ 525.006480][ T8487] bridge0: port 3(syz_tun) entered disabled state [ 525.006689][ T8487] syz_tun: entered allmulticast mode [ 525.063943][ T8487] syz_tun: entered promiscuous mode [ 525.064697][ T8487] bridge0: port 3(syz_tun) entered blocking state [ 525.071439][ T8487] bridge0: port 3(syz_tun) entered forwarding state [ 527.978905][ T5596] Bluetooth: hci3: command tx timeout [ 528.098214][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 210 seconds [ 528.100674][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 210 seconds [ 528.100730][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 210 seconds [ 529.153865][ T8285] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 529.320145][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 529.591847][ T8285] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 529.675724][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 529.866652][ T8285] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 529.944757][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 530.037905][ T5590] Bluetooth: hci3: command tx timeout [ 530.069548][ T1479] bridge_slave_1: left allmulticast mode [ 530.069589][ T1479] bridge_slave_1: left promiscuous mode [ 530.069871][ T1479] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.290537][ T1479] bridge_slave_0: left allmulticast mode [ 530.290587][ T1479] bridge_slave_0: left promiscuous mode [ 530.290853][ T1479] bridge0: port 1(bridge_slave_0) entered disabled state [ 531.871330][ T1479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 531.942598][ T1479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 531.988751][ T1479] bond0 (unregistering): Released all slaves [ 532.118928][ T5590] Bluetooth: hci3: command tx timeout [ 532.179650][ T8285] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 532.409976][ T8285] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 533.099037][ T1479] hsr_slave_0: left promiscuous mode [ 533.140598][ T1479] hsr_slave_1: left promiscuous mode [ 533.141869][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 533.176258][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 533.317996][ T10] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 533.478312][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 533.479030][ T10] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 533.480039][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 533.483255][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.483273][ T10] usb 5-1: Product: syz [ 533.483284][ T10] usb 5-1: Manufacturer: syz [ 533.483295][ T10] usb 5-1: SerialNumber: syz [ 533.516618][ T10] usb 5-1: config 0 descriptor?? [ 533.568545][ T10] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 533.568573][ T10] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 534.108071][ T9] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 534.200085][ T5590] Bluetooth: hci3: command tx timeout [ 534.224041][ T8538] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.263201][ T8538] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.287984][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 534.288819][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 534.296126][ T9] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 534.296155][ T9] usb 3-1: config 0 has no interface number 0 [ 534.399075][ T10] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 534.426896][ T1479] team0 (unregistering): Port device team_slave_1 removed [ 534.439542][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.440517][ T9] usb 3-1: Product: syz [ 534.440531][ T9] usb 3-1: Manufacturer: syz [ 534.440542][ T9] usb 3-1: SerialNumber: syz [ 534.536761][ T1479] team0 (unregistering): Port device team_slave_0 removed [ 534.631518][ T9] usb 3-1: config 0 descriptor?? [ 534.898327][ T8541] netlink: 4 bytes leftover after parsing attributes in process `syz.4.631'. [ 535.133654][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 535.133701][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 535.311920][ T10] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 535.311993][ T10] em28xx 5-1:0.0: board has no eeprom [ 535.436015][ T8420] bridge0: port 1(bridge_slave_0) entered blocking state [ 535.436154][ T8420] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.436372][ T8420] bridge_slave_0: entered allmulticast mode [ 535.461361][ T8420] bridge_slave_0: entered promiscuous mode [ 535.591006][ T8420] bridge0: port 2(bridge_slave_1) entered blocking state [ 535.591347][ T8420] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.591737][ T8420] bridge_slave_1: entered allmulticast mode [ 535.620977][ T8420] bridge_slave_1: entered promiscuous mode [ 535.757984][ T10] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 535.758018][ T10] em28xx 5-1:0.0: dvb set to bulk mode. [ 535.758277][ T5831] em28xx 5-1:0.0: Binding DVB extension [ 535.972106][ T10] usb 5-1: USB disconnect, device number 22 [ 536.228952][ T10] em28xx 5-1:0.0: Disconnecting em28xx [ 536.265117][ T5831] em28xx 5-1:0.0: Registering input extension [ 536.268919][ T10] em28xx 5-1:0.0: Closing input extension [ 536.408726][ T8420] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 536.434400][ T8420] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 537.052962][ T8420] team0: Port device team_slave_0 added [ 537.211841][ T10] em28xx: Freeing device [ 538.176865][ T8420] team0: Port device team_slave_1 added [ 538.407811][ T9] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 538.408405][ T9] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -61 [ 540.673196][ T6004] usb 3-1: USB disconnect, device number 17 [ 540.942872][ T8420] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 540.942929][ T8420] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 540.943165][ T8420] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 542.619672][ T8420] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 542.619735][ T8420] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 542.619804][ T8420] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 543.562717][ T8420] hsr_slave_0: entered promiscuous mode [ 543.567184][ T8420] hsr_slave_1: entered promiscuous mode [ 543.575402][ T8420] debugfs: 'hsr0' already exists in 'hsr' [ 543.575463][ T8420] Cannot create hsr debugfs directory [ 543.658057][ T5831] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 543.827817][ T5831] usb 5-1: Using ep0 maxpacket: 16 [ 543.829381][ T5831] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 543.830945][ T5831] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 543.834628][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.834655][ T5831] usb 5-1: Product: syz [ 543.834673][ T5831] usb 5-1: Manufacturer: syz [ 543.834689][ T5831] usb 5-1: SerialNumber: syz [ 543.855762][ T5831] usb 5-1: config 0 descriptor?? [ 543.905714][ T5831] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 543.905751][ T5831] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 544.092187][ T5249] 8021q: adding VLAN 0 to HW filter on device eth5 [ 544.526671][ T8581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.527508][ T8581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.547553][ T5831] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 544.958684][ T8581] netlink: 4 bytes leftover after parsing attributes in process `syz.4.640'. [ 545.177184][ T5831] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 545.177220][ T5831] em28xx 5-1:0.0: board has no eeprom [ 545.292635][ T5831] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 545.292660][ T5831] em28xx 5-1:0.0: dvb set to bulk mode. [ 545.301844][ T9] em28xx 5-1:0.0: Binding DVB extension [ 546.219304][ T5831] usb 5-1: USB disconnect, device number 23 [ 546.299422][ T5831] em28xx 5-1:0.0: Disconnecting em28xx [ 548.472701][ T9] em28xx 5-1:0.0: Registering input extension [ 548.472949][ T5831] em28xx 5-1:0.0: Closing input extension [ 549.729538][ T5831] em28xx: Freeing device [ 550.571159][ T5249] 8021q: adding VLAN 0 to HW filter on device eth6 [ 550.851626][ T8482] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.851760][ T8482] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.855984][ T8482] bridge_slave_0: entered allmulticast mode [ 550.881059][ T8482] bridge_slave_0: entered promiscuous mode [ 550.912411][ T8482] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.912551][ T8482] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.912795][ T8482] bridge_slave_1: entered allmulticast mode [ 550.961856][ T8482] bridge_slave_1: entered promiscuous mode [ 550.966859][ T8285] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.018003][ T5831] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 551.180511][ T5831] usb 5-1: Using ep0 maxpacket: 32 [ 551.181408][ T5831] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 551.182595][ T5831] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 551.182623][ T5831] usb 5-1: config 0 has no interface number 0 [ 551.189073][ T5831] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 551.189106][ T5831] usb 5-1: Product: syz [ 551.189122][ T5831] usb 5-1: Manufacturer: syz [ 551.189139][ T5831] usb 5-1: SerialNumber: syz [ 551.253326][ T5831] usb 5-1: config 0 descriptor?? [ 551.700348][ T5831] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 551.700384][ T5831] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 551.815519][ T8482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 552.582499][ T8482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 553.044393][ T8482] team0: Port device team_slave_0 added [ 553.172751][ T8482] team0: Port device team_slave_1 added [ 553.200553][ T8285] 8021q: adding VLAN 0 to HW filter on device team0 [ 554.008936][ T8626] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 554.013578][ T5831] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 554.013893][ T5831] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -61 [ 554.074364][ T8626] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 554.091238][ T8626] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 554.118366][ T8626] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 554.152234][ T8626] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 554.505749][ T8482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 554.505770][ T8482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 554.505801][ T8482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 554.666487][ T8482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 554.666510][ T8482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 554.666541][ T8482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 555.311289][ T5694] usb 5-1: USB disconnect, device number 24 [ 555.399421][ T1479] bridge_slave_1: left allmulticast mode [ 555.399451][ T1479] bridge_slave_1: left promiscuous mode [ 555.399634][ T1479] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.310830][ T8626] Bluetooth: hci6: command tx timeout [ 557.441394][ T1479] bridge_slave_0: left allmulticast mode [ 557.441437][ T1479] bridge_slave_0: left promiscuous mode [ 557.441723][ T1479] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.919166][ T31] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 558.048010][ T31] usb 3-1: device descriptor read/64, error -71 [ 558.250101][ T1479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 558.288307][ T31] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 558.371759][ T1479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 558.417949][ T31] usb 3-1: device descriptor read/64, error -71 [ 558.450379][ T1479] bond0 (unregistering): Released all slaves [ 558.528278][ T31] usb usb3-port1: attempt power cycle [ 558.590676][ T32] block nbd3: Possible stuck request ffff888028107000: control (read@0,1024B). Runtime 240 seconds [ 558.590727][ T32] block nbd3: Possible stuck request ffff8880281071c0: control (read@1024,1024B). Runtime 240 seconds [ 558.590757][ T32] block nbd3: Possible stuck request ffff888028107380: control (read@2048,2048B). Runtime 240 seconds [ 558.907943][ T31] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 558.929885][ T31] usb 3-1: device descriptor read/8, error -71 [ 559.105620][ T1479] hsr_slave_0: left promiscuous mode [ 559.160397][ T1479] hsr_slave_1: left promiscuous mode [ 559.161684][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 559.180396][ T31] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 559.196339][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 559.205798][ T31] usb 3-1: device descriptor read/8, error -71 [ 559.217810][ T5694] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 559.308316][ T31] usb usb3-port1: unable to enumerate USB device [ 559.324140][ T5590] Bluetooth: hci6: command tx timeout [ 559.367826][ T5694] usb 5-1: Using ep0 maxpacket: 16 [ 559.368705][ T5694] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 559.370046][ T5694] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 559.373869][ T5694] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.373896][ T5694] usb 5-1: Product: syz [ 559.373913][ T5694] usb 5-1: Manufacturer: syz [ 559.373930][ T5694] usb 5-1: SerialNumber: syz [ 559.430363][ T5694] usb 5-1: config 0 descriptor?? [ 559.447244][ T5694] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 559.447279][ T5694] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 559.838885][ T1479] team0 (unregistering): Port device team_slave_1 removed [ 559.890517][ T1479] team0 (unregistering): Port device team_slave_0 removed [ 560.043556][ T8645] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.045998][ T8645] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.067847][ T5694] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 560.299177][ T8482] hsr_slave_0: entered promiscuous mode [ 560.303934][ T8482] hsr_slave_1: entered promiscuous mode [ 560.318434][ T8482] debugfs: 'hsr0' already exists in 'hsr' [ 560.318518][ T8482] Cannot create hsr debugfs directory [ 560.531980][ T8645] netlink: 4 bytes leftover after parsing attributes in process `syz.4.650'. [ 560.862175][ T5694] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 560.862209][ T5694] em28xx 5-1:0.0: board has no eeprom [ 560.957819][ T5694] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 560.957852][ T5694] em28xx 5-1:0.0: dvb set to bulk mode. [ 560.958203][ T6005] em28xx 5-1:0.0: Binding DVB extension [ 561.013073][ T5694] usb 5-1: USB disconnect, device number 25 [ 561.025823][ T5694] em28xx 5-1:0.0: Disconnecting em28xx [ 562.539328][ T5590] Bluetooth: hci6: command tx timeout [ 562.663119][ T6005] em28xx 5-1:0.0: Registering input extension [ 562.679654][ T5694] em28xx 5-1:0.0: Closing input extension [ 562.806201][ T5694] em28xx: Freeing device [ 563.020353][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.020427][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.438246][ T8420] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 563.522967][ T8420] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 563.696776][ T8420] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 563.760488][ T8420] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 563.842503][ T8420] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 563.950604][ T8420] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 564.040003][ T8420] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 564.159598][ T8420] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 564.260517][ T5249] 8021q: adding VLAN 0 to HW filter on device eth7 [ 566.367364][ T5590] Bluetooth: hci6: command tx timeout [ 569.952262][ T5249] 8021q: adding VLAN 0 to HW filter on device eth8 [ 570.223528][ T8420] 8021q: adding VLAN 0 to HW filter on device bond0 [ 570.301346][ T8420] 8021q: adding VLAN 0 to HW filter on device team0 [ 570.344133][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 570.344274][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 571.399703][ T5831] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 571.527872][ T5831] usb 3-1: device descriptor read/64, error -71 [ 571.625737][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 571.625837][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 571.778137][ T5831] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 571.907955][ T5831] usb 3-1: device descriptor read/64, error -71 [ 572.018946][ T5831] usb usb3-port1: attempt power cycle [ 572.169298][ T6004] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 572.207186][ T8626] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 572.266422][ T8626] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 572.283967][ T8626] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 572.291845][ T8626] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 572.293018][ T8626] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 572.349587][ T6004] usb 5-1: Using ep0 maxpacket: 16 [ 572.353893][ T6004] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 572.369848][ T5831] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 572.577486][ T5831] usb 3-1: device descriptor read/8, error -71 [ 572.587526][ T6004] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 572.611283][ T6004] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.611313][ T6004] usb 5-1: Product: syz [ 572.611329][ T6004] usb 5-1: Manufacturer: syz [ 572.611345][ T6004] usb 5-1: SerialNumber: syz [ 572.651623][ T6004] usb 5-1: config 0 descriptor?? [ 572.745455][ T6004] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 572.745486][ T6004] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 572.827890][ T5831] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 572.848616][ T5831] usb 3-1: device descriptor read/8, error -71 [ 572.959281][ T5831] usb usb3-port1: unable to enumerate USB device [ 573.279497][ T8730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.280158][ T8730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.284585][ T6004] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 573.690409][ T8730] netlink: 4 bytes leftover after parsing attributes in process `syz.4.660'. [ 573.895633][ T6004] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 573.895670][ T6004] em28xx 5-1:0.0: board has no eeprom [ 573.977829][ T6004] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 573.977862][ T6004] em28xx 5-1:0.0: dvb set to bulk mode. [ 573.977919][ T6005] em28xx 5-1:0.0: Binding DVB extension [ 574.027605][ T6004] usb 5-1: USB disconnect, device number 26 [ 574.073936][ T6004] em28xx 5-1:0.0: Disconnecting em28xx [ 574.103807][ T6005] em28xx 5-1:0.0: Registering input extension [ 574.127552][ T6004] em28xx 5-1:0.0: Closing input extension [ 574.874404][ T5590] Bluetooth: hci1: command tx timeout [ 576.917828][ T5590] Bluetooth: hci1: command tx timeout [ 577.265908][ T6004] em28xx: Freeing device [ 577.300036][ T8625] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.300147][ T8625] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.300324][ T8625] bridge_slave_0: entered allmulticast mode [ 577.303158][ T8625] bridge_slave_0: entered promiscuous mode [ 577.390933][ T8625] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.391727][ T8625] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.391926][ T8625] bridge_slave_1: entered allmulticast mode [ 577.401695][ T8625] bridge_slave_1: entered promiscuous mode [ 577.689692][ T8625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.717615][ T8625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.976937][ T8625] team0: Port device team_slave_0 added [ 578.024291][ T8625] team0: Port device team_slave_1 added [ 578.270357][ T8625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.270380][ T8625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.270411][ T8625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 578.400909][ T8625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.400931][ T8625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.400962][ T8625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.470125][ T8763] netlink: 'syz.4.666': attribute type 8 has an invalid length. [ 579.077902][ T5590] Bluetooth: hci1: command tx timeout [ 580.589046][ T8625] hsr_slave_0: entered promiscuous mode [ 580.590722][ T8625] hsr_slave_1: entered promiscuous mode [ 580.591953][ T8625] debugfs: 'hsr0' already exists in 'hsr' [ 580.591985][ T8625] Cannot create hsr debugfs directory [ 580.681195][ T1479] bridge_slave_1: left allmulticast mode [ 580.681240][ T1479] bridge_slave_1: left promiscuous mode [ 580.681543][ T1479] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.760382][ T8782] syz.4.668 (8782) used greatest stack depth: 18632 bytes left [ 580.781467][ T1479] bridge_slave_0: left allmulticast mode [ 580.781509][ T1479] bridge_slave_0: left promiscuous mode [ 580.781783][ T1479] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.157821][ T5590] Bluetooth: hci1: command tx timeout [ 581.717894][ T6004] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 581.867877][ T6004] usb 5-1: Using ep0 maxpacket: 16 [ 581.868740][ T6004] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 581.872442][ T6004] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 581.875095][ T6004] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.875125][ T6004] usb 5-1: Product: syz [ 581.875137][ T6004] usb 5-1: Manufacturer: syz [ 581.875149][ T6004] usb 5-1: SerialNumber: syz [ 581.932370][ T6004] usb 5-1: config 0 descriptor?? [ 581.945975][ T6004] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 581.946012][ T6004] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 582.584080][ T8786] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 582.584930][ T8786] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.603292][ T6004] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 582.740719][ T1479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 582.818506][ T1479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 582.879646][ T1479] bond0 (unregistering): Released all slaves [ 583.059496][ T8786] netlink: 4 bytes leftover after parsing attributes in process `syz.4.669'. [ 583.362885][ T6004] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 583.362917][ T6004] em28xx 5-1:0.0: board has no eeprom [ 583.709912][ T6004] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 583.709943][ T6004] em28xx 5-1:0.0: dvb set to bulk mode. [ 584.117981][ T39] INFO: task syz.3.532:7934 blocked for more than 143 seconds. [ 584.118011][ T39] Not tainted syzkaller #0 [ 584.118025][ T39] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 584.118036][ T39] task:syz.3.532 state:D stack:23408 pid:7934 tgid:7929 ppid:5589 task_flags:0x400140 flags:0x00080002 [ 584.118107][ T39] Call Trace: [ 584.118115][ T39] [ 584.118132][ T39] __schedule+0x16d9/0x5700 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 584.118297][ T39] ? trace_irq_disable+0x3b/0x140 [ 584.118338][ T39] ? __pfx___schedule+0x10/0x10 [ 584.118386][ T39] rt_mutex_schedule+0x76/0xf0 [ 584.118417][ T39] rt_mutex_slowlock_block+0x55e/0x690 [ 584.118454][ T39] ? rt_mutex_slowlock_block+0x33c/0x690 [ 584.118485][ T39] rt_mutex_slowlock+0x2d4/0x780 [ 584.118514][ T39] ? rt_mutex_slowlock+0x1f2/0x780 [ 584.118542][ T39] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 584.118582][ T39] ? bdev_open+0xde/0xd00 [ 584.118614][ T39] ? lock_acquire+0x232/0x350 [ 584.118653][ T39] ? bdev_open+0xde/0xd00 [ 584.118676][ T39] mutex_lock_nested+0x168/0x1d0 [ 584.118709][ T39] bdev_open+0xde/0xd00 [ 584.118755][ T39] bdev_file_open_by_dev+0x1be/0x240 [ 584.118788][ T39] setup_bdev_super+0x5a/0x680 [ 584.118826][ T39] get_tree_bdev_flags+0x388/0x4f0 [ 584.118861][ T39] ? __pfx_gfs2_fill_super+0x10/0x10 [ 584.118885][ T39] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 584.118916][ T39] ? vfs_parse_fs_qstr+0x163/0x1e0 [ 584.118953][ T39] ? rcu_is_watching+0x16/0xb0 [ 584.118983][ T39] gfs2_get_tree+0x51/0x1e0 [ 584.119012][ T39] vfs_get_tree+0x92/0x2a0 [ 584.119047][ T39] do_new_mount+0x325/0xb00 [ 584.119075][ T39] ? cap_capable+0x123/0x460 [ 584.119122][ T39] ? __pfx_do_new_mount+0x10/0x10 [ 584.119153][ T39] ? ns_capable+0x89/0xe0 [ 584.119278][ T39] ? path_mount+0x647/0x1050 [ 584.119312][ T39] ? user_path_at+0xd4/0x160 [ 584.119378][ T39] __se_sys_mount+0x31d/0x420 [ 584.119416][ T39] ? __pfx___se_sys_mount+0x10/0x10 [ 584.119451][ T39] ? __x64_sys_mount+0x20/0xc0 [ 584.119481][ T39] do_syscall_64+0x166/0x520 [ 584.119514][ T39] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.119539][ T39] ? clear_bhb_loop+0x70/0xc0 [ 584.119567][ T39] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.119592][ T39] RIP: 0033:0x7f54121ee2d9 [ 584.119614][ T39] RSP: 002b:00007f5410425028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 584.119640][ T39] RAX: ffffffffffffffda RBX: 00007f5412476090 RCX: 00007f54121ee2d9 [ 584.119658][ T39] RDX: 0000200000000240 RSI: 0000200000000100 RDI: 0000200000000180 [ 584.119675][ T39] RBP: 00007f5412285888 R08: 0000000000000000 R09: 0000000000000000 [ 584.119691][ T39] R10: 000000000100801f R11: 0000000000000246 R12: 0000000000000000 [ 584.119706][ T39] R13: 00007f5412476128 R14: 00007f5412476090 R15: 00007ffe0bb8c1e8 [ 584.119753][ T39] [ 584.119806][ T39] [ 584.119806][ T39] Showing all locks held in the system: [ 584.119816][ T39] locks held by kworker/0:1/10: 5, last CPU#0: [ 584.119834][ T39] #0: ffff88805fa4b538 ((wq_completion)wg-kex-wg1#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.119910][ T39] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.119997][ T39] #2: ffff8880614c83f8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x38/0xbe0 [ 584.120171][ T39] #3: ffffffff8f311970 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 584.120360][ T39] #4: ffff88813ffbdd58 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xef/0x2a0 [ 584.120413][ T39] locks held by kworker/u8:1/13: 3, on CPU#0: [ 584.120430][ T39] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.120493][ T39] #1: ffffc90000127c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.120556][ T39] #2: ffff ** replaying previous printk message ** [ 584.120556][ T39] #2: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 584.120695][ T39] locks held by kworker/1:0H/32: 3, last CPU#1: [ 584.120711][ T39] #0: ffff88813ff2b538 ((wq_completion)events_highpri){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.120785][ T39] #1: ffffc90000a6fc40 ((work_completion)(&vmidi->output_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.120853][ T39] #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.184688][ T39] locks held by khungtaskd/39: 1, last CPU#0: [ 584.184713][ T39] #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 584.184950][ T39] locks held by kworker/u8:4/67: 6, last CPU#0: [ 584.184969][ T39] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.185104][ T39] #1: ffffc9000152fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.185266][ T39] #2: ffff888035e9c310 (&devlink->lock_key#10){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 584.185488][ T39] #3: ffff8880354e7d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 584.185658][ T39] #4: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.185807][ T39] #5: ffff88813ffbdd58 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x580 [ 584.185934][ T39] locks held by kworker/u8:14/1475: 3, last CPU#0: [ 584.186002][ T39] #0: ffff888034147138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.186086][ T39] #1: ffffc9000730fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.186261][ T39] #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 584.186328][ T39] locks held by kworker/u8:15/1479: 4, on CPU#1: [ 584.186345][ T39] #0: ffff88801beb0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.186538][ T39] #1: ffffc9000739fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.226484][ T39] #2: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 584.226670][ T39] #3: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x18/0xc0 [ 584.226846][ T39] locks held by klogd/4942: 4, last CPU#0: [ 584.226886][ T39] #0: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 584.227046][ T39] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 584.227154][ T39] #2: ffff8880b84396f8 ((bh_lock)){+...}-{3:3}, at: napi_skb_cache_get+0xbf/0x450 [ 584.227354][ T39] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.227416][ T39] locks held by kworker/0:3/4965: 3, last CPU#0: [ 584.227434][ T39] #0: ffff88813ff2a538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.227546][ T39] #1: ffffc90004387c40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.228237][ T39] #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x18b0 [ 584.228435][ T39] locks held by dhcpcd/5249: 2, on CPU#1: [ 584.228498][ T39] #0: ffff888031e0c928 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xe7/0xee0 [ 584.228676][ T39] #1: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 584.304250][ T39] locks held by getty/5343: 2, on CPU#0: [ 584.304269][ T39] #0: ffff88803744e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 584.304452][ T39] #1: ffffc900044eb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 584.304513][ T39] locks held by syz-executor/5575: 5, last CPU#1: [ 584.304531][ T39] #0: ffff8880331844b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 584.304597][ T39] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 584.304660][ T39] #2: ffff888038bbc418 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 584.304731][ T39] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.304790][ T39] #4: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: lruvec_stat_mod_folio+0x6e/0x3e0 [ 584.304862][ T39] locks held by kworker/1:8/6004: 6, last CPU#1: [ 584.304879][ T39] #0: ffff88801fe96538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.304946][ T39] #1: ffffc9000694fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.305012][ T39] #2: ffff88802adba210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 [ 584.305127][ T39] #3: ffff8880349f6210 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 584.305219][ T39] #4: ffff88803d22d1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 584.305281][ T39] #5: ffff88813ff77238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 584.305350][ T39] locks held by syz-executor/6872: 1, last CPU#1: [ 584.305368][ T39] #0: ffff88803076c3f8 (&sig->wait_chldexit){+.+.}-{3:3}, at: add_wait_queue+0x41/0x170 [ 584.305430][ T39] locks held by udevd/7097: 4, on CPU#0: [ 584.305447][ T39] #0: ffff888041116db0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa5/0xcb0 [ 584.305502][ T39] #1: ffff88801fe8b478 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 584.305566][ T39] #2: ffff88802c90f008 (kn->active#29){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 584.305631][ T39] #3: ffff8880349f6210 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 584.440438][ T39] locks held by udevd/7133: 1, on CPU#0: [ 584.440457][ T39] #0: ffff8880280464c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 [ 584.440525][ T39] locks held by kworker/u8:19/7736: 3, on CPU#0: [ 584.440542][ T39] #0: ffff888033b14938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.440610][ T39] #1: ffffc90005b67c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.440678][ T39] #2: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 [ 584.440796][ T39] locks held by syz.3.532/7934: 2, on CPU#1: [ 584.440813][ T39] #0: ffff888021f960e0 (&type->s_umount_key#61/1){+.+.}-{4:4}, at: sget_fc+0x9d4/0x1a80 [ 584.440887][ T39] #1: ffff8880280464c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd00 [ 584.440948][ T39] locks held by syz-executor/8482: 7, on CPU#0: [ 584.440965][ T39] #0: ffff888036766510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 [ 584.441040][ T39] #1: ffff8880626e8878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 [ 584.441099][ T39] #2: ffff88802a0de968 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 [ 584.441162][ T39] #3: ffffffff8fe46bf8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0 [ 584.441220][ T39] #4: ffff88805ef01160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 584.441281][ T39] #5: ffff888083930310 (&devlink->lock_key#11){+.+.}-{4:4}, at: nsim_drv_probe+0xfb/0xbc0 [ 584.441349][ T39] #6: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: nsim_create+0x87f/0x1160 [ 584.441408][ T39] locks held by syz-executor/8625: 3, on CPU#0: [ 584.441424][ T39] #0: ffffffff8fd35f88 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 584.441494][ T39] #1: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 [ 584.441553][ T39] #2: ffff88813ff77238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 584.441622][ T39] locks held by syz-executor/8733: 2, on CPU#1: [ 584.441639][ T39] #0: ffffffff905c8040 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 [ 584.441697][ T39] #1: ffffffff905d6878 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 [ 584.495550][ T31] em28xx 5-1:0.0: Binding DVB extension [ 584.551507][ T39] locks held by kworker/u8:20/8748: 6, last CPU#0: [ 584.551538][ T39] #0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.551729][ T39] #1: ffffc900046b7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 584.551909][ T39] #2: ffff888062f00938 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 584.552014][ T39] #3: ffffffff8f059580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 584.552170][ T39] #4: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 584.552577][ T39] #5: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.552728][ T39] locks held by syz.4.669/8786: 4, last CPU#0: [ 584.552769][ T39] #0: ffff88802c4f10b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 584.552947][ T39] #1: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 584.553123][ T39] #2: ffff888023688298 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 584.574361][ T39] #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 [ 584.574462][ T39] locks held by syz-executor/8790: 1, last CPU#1: [ 584.574527][ T39] #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 584.574704][ T39] locks held by syz.2.671/8791: 1, last CPU#0: [ 584.574744][ T39] #0: ffff888038c3aab8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 584.574933][ T39] locks held by syz.2.671/8793: 1, on CPU#1: [ 584.574975][ T39] #0: ffff888033769158 (&rmidi->open_mutex){+.+.}-{4:4}, at: snd_rawmidi_release+0x79/0x220 [ 584.580469][ T39] [ 584.580492][ T39] ============================================= [ 584.580492][ T39] [ 584.580550][ T39] NMI backtrace for cpu 1 [ 584.580598][ T39] CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 584.580668][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 584.580706][ T39] Call Trace: [ 584.580746][ T39] [ 584.580762][ T39] dump_stack_lvl+0xe8/0x150 [ 584.580834][ T39] nmi_cpu_backtrace+0x274/0x2d0 [ 584.580862][ T39] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 584.580888][ T39] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 584.580919][ T39] sys_info+0x135/0x170 [ 584.580941][ T39] watchdog+0xfd7/0x1030 [ 584.580982][ T39] ? watchdog+0x1c7/0x1030 [ 584.581021][ T39] kthread+0x38b/0x470 [ 584.581047][ T39] ? __pfx_watchdog+0x10/0x10 [ 584.581076][ T39] ? __pfx_kthread+0x10/0x10 [ 584.581102][ T39] ret_from_fork+0x514/0xb70 [ 584.581129][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 584.581153][ T39] ? __switch_to+0xc89/0x1420 [ 584.581189][ T39] ? __pfx_kthread+0x10/0x10 [ 584.581214][ T39] ret_from_fork_asm+0x1a/0x30 [ 584.581255][ T39] [ 584.581295][ T39] Sending NMI from CPU 1 to CPUs 0: [ 584.581329][ C0] NMI backtrace for cpu 0 [ 584.581344][ C0] CPU: 0 UID: 0 PID: 1460 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 584.581365][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 584.581378][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 584.581399][ C0] RIP: 0010:__lock_acquire+0x70a/0x2de0 [ 584.581427][ C0] Code: 85 c9 74 1a 45 31 f6 48 8b 7c 24 08 48 89 ee 31 d2 e8 fa 46 00 00 85 c0 0f 84 d0 0d 00 00 48 8b 44 24 08 83 b8 f4 0b 00 00 00 <74> 1a 48 8b 7c 24 08 48 89 ee ba 04 00 00 00 e8 d2 46 00 00 85 c0 [ 584.581443][ C0] RSP: 0018:ffffc9000721f5e0 EFLAGS: 00000046 [ 584.581459][ C0] RAX: ffff88802a6abe80 RBX: ffff88802a6acb30 RCX: 0000000000000000 [ 584.581473][ C0] RDX: 0000000000000004 RSI: 0000000000000005 RDI: 8200000000000000 [ 584.581485][ C0] RBP: ffff88802a6acb10 R08: ffffffff84daf291 R09: 0000000000000001 [ 584.581498][ C0] R10: dffffc0000000000 R11: fffffbfff2164730 R12: 0000000000000004 [ 584.581511][ C0] R13: 0000000000000000 R14: ffff88802a6abe80 R15: 0000000000000003 [ 584.581524][ C0] FS: 0000000000000000(0000) GS:ffff8881249bb000(0000) knlGS:0000000000000000 [ 584.581539][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 584.581552][ C0] CR2: 00007fd6198ab9c0 CR3: 00000000373ee000 CR4: 00000000003526f0 [ 584.581569][ C0] Call Trace: [ 584.581575][ C0] [ 584.581588][ C0] ? __lock_acquire+0x747/0x2de0 [ 584.581620][ C0] lock_acquire+0x115/0x350 [ 584.581644][ C0] ? debug_object_assert_init+0xa1/0x310 [ 584.581669][ C0] ? rcu_is_watching+0x16/0xb0 [ 584.581688][ C0] _raw_spin_lock_irqsave+0x40/0x60 [ 584.581713][ C0] ? debug_object_assert_init+0xa1/0x310 [ 584.581733][ C0] debug_object_assert_init+0xa1/0x310 [ 584.581758][ C0] __mod_timer+0x4b/0xf10 [ 584.581784][ C0] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 584.581814][ C0] ieee80211_ibss_work+0x5dc/0x10c0 [ 584.581842][ C0] ? rt_spin_unlock+0x159/0x200 [ 584.581874][ C0] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 584.581898][ C0] ? rt_spin_unlock+0x165/0x200 [ 584.581918][ C0] ? skb_dequeue+0x11a/0x150 [ 584.581986][ C0] ? ieee80211_iface_work+0xf67/0x1010 [ 584.582023][ C0] cfg80211_wiphy_work+0x29e/0x420 [ 584.582041][ C0] ? process_scheduled_works+0x97a/0x1630 [ 584.582067][ C0] process_scheduled_works+0xc3d/0x1630 [ 584.582106][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 584.582134][ C0] ? assign_work+0x3cf/0x5d0 [ 584.582178][ C0] worker_thread+0xa47/0xfb0 [ 584.582217][ C0] kthread+0x38b/0x470 [ 584.582235][ C0] ? __pfx_worker_thread+0x10/0x10 [ 584.582259][ C0] ? __pfx_kthread+0x10/0x10 [ 584.582289][ C0] ret_from_fork+0x514/0xb70 [ 584.582308][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 584.582325][ C0] ? __switch_to+0xc89/0x1420 [ 584.582352][ C0] ? __pfx_kthread+0x10/0x10 [ 584.582373][ C0] ret_from_fork_asm+0x1a/0x30 [ 584.582398][ C0] [ 584.609590][ T39] Kernel panic - not syncing: hung_task: blocked tasks [ 585.939561][ T39] CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 585.949185][ T39] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 585.959236][ T39] Call Trace: [ 585.962513][ T39] [ 585.965446][ T39] vpanic+0x56d/0xa60 [ 585.969437][ T39] ? __pfx___schedule+0x10/0x10 [ 585.974333][ T39] ? __pfx_vpanic+0x10/0x10 [ 585.978899][ T39] panic+0xc5/0xd0 [ 585.982644][ T39] ? __pfx_panic+0x10/0x10 [ 585.987061][ T39] ? preempt_schedule_common+0x7f/0xd0 [ 585.992528][ T39] ? preempt_schedule_thunk+0x16/0x40 [ 585.997908][ T39] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 586.004068][ T39] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 586.010250][ T39] watchdog+0x1030/0x1030 [ 586.014602][ T39] ? watchdog+0x1c7/0x1030 [ 586.019033][ T39] kthread+0x38b/0x470 [ 586.023113][ T39] ? __pfx_watchdog+0x10/0x10 [ 586.027800][ T39] ? __pfx_kthread+0x10/0x10 [ 586.032394][ T39] ret_from_fork+0x514/0xb70 [ 586.036988][ T39] ? __pfx_ret_from_fork+0x10/0x10 [ 586.042101][ T39] ? __switch_to+0xc89/0x1420 [ 586.046791][ T39] ? __pfx_kthread+0x10/0x10 [ 586.051389][ T39] ret_from_fork_asm+0x1a/0x30 [ 586.056180][ T39] [ 586.059838][ T39] Kernel Offset: disabled [ 586.064186][ T39] Rebooting in 86400 seconds..