last executing test programs: 3m38.312524244s ago: executing program 0 (id=27): socket$kcm(0x29, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(0xffffffffffffffff, 0x80049370, &(0x7f0000000080)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}}}, &(0x7f0000000040)=0x59) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000080)) 3m35.824283894s ago: executing program 1 (id=33): socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000008b00)={0x0, 0x0, &(0x7f0000008ac0)={&(0x7f0000008a00)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="6b7a25bd7000fcdbdf259200000008000300", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x4040001}, 0x10) 3m34.837813788s ago: executing program 1 (id=36): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000140)=0x1) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 3m34.313220037s ago: executing program 1 (id=37): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000012c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_128={{0x304}, "ed197fbfb5c342b6", "28852cbbbeba35380ee5190047169f9d", "5f2307e0", "2ce6f8da8e55c427"}, 0x28) r1 = syz_io_uring_setup(0xb5c, &(0x7f0000000640)={0x0, 0x9916, 0x0, 0x0, 0x164}, &(0x7f0000000040)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, &(0x7f0000000580)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0xf23, 0x0, 0xc, 0x0, 0x0) 3m31.733772077s ago: executing program 1 (id=41): socket$nl_route(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f0000000040)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='name', 0x0, 0x0) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x2}, 0x20, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r1 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x80, 0x0) kexec_load(0xff0e, 0x1, &(0x7f0000000100)=[{0x0, 0x0, 0x7ffe0000, 0x3e0000}], 0x0) 3m22.907482729s ago: executing program 32 (id=27): socket$kcm(0x29, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(0xffffffffffffffff, 0x80049370, &(0x7f0000000080)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}}}, &(0x7f0000000040)=0x59) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000080)) 3m15.969865841s ago: executing program 33 (id=41): socket$nl_route(0x10, 0x3, 0x0) r0 = fsopen(&(0x7f0000000040)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='name', 0x0, 0x0) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x2}, 0x20, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r1 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x80, 0x0) kexec_load(0xff0e, 0x1, &(0x7f0000000100)=[{0x0, 0x0, 0x7ffe0000, 0x3e0000}], 0x0) 3m6.188463059s ago: executing program 3 (id=82): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='cmdline\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000300)={&(0x7f0000ff7000/0x7000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f000000f000/0x3000)=nil, &(0x7f000000d000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) preadv(r2, &(0x7f0000001200)=[{&(0x7f0000000080)=""/4097, 0xffffff51}], 0x1, 0x3f, 0x6a76) 2m59.791033942s ago: executing program 3 (id=94): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'ip6gre0\x00', 0x0}) 2m59.104128321s ago: executing program 3 (id=96): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@redirect_dir_nofollow}]}) 2m58.534048849s ago: executing program 3 (id=97): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x8) connect$bt_sco(r0, &(0x7f00000000c0)={0x1f, @none}, 0x8) 2m57.778008357s ago: executing program 3 (id=99): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000089c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000008b00)={0x0, 0x0, &(0x7f0000008ac0)={&(0x7f0000008a00)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="6b7a25bd7000fcdbdf259200000008000300", @ANYRES32=r2], 0x5c}, 0x1, 0x0, 0x0, 0x4040001}, 0x10) 2m57.034979821s ago: executing program 3 (id=101): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/fib_trie\x00') fcntl$notify(r0, 0x402, 0x80000032) ioctl$VT_RELDISP(r2, 0x5605) pread64(r2, 0x0, 0x0, 0x1c) read$FUSE(r1, &(0x7f0000002480)={0x2020}, 0x2020) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x10040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x700}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x98}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x9, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2m41.647448749s ago: executing program 34 (id=101): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/fib_trie\x00') fcntl$notify(r0, 0x402, 0x80000032) ioctl$VT_RELDISP(r2, 0x5605) pread64(r2, 0x0, 0x0, 0x1c) read$FUSE(r1, &(0x7f0000002480)={0x2020}, 0x2020) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x10040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0x1c, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x700}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x98}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x9}, {0x7, 0x0, 0xc}, {0x18, 0x9, 0x2, 0x0, r4}, {}, {0x46, 0x8, 0xfff1, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2m18.401332615s ago: executing program 2 (id=141): openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) syz_usb_connect(0x2, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000980)={'filter\x00', 0x7, 0x4, 0x3f0, 0x1f8, 0x1f8, 0x0, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x1c}, 0x2, 0x1}}}, {{@arp={@empty, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000, 0xffffff00, 0x3, 0x3, {@mac=@broadcast, {[0x1fe, 0x0, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="a5cddc490123", {[0x0, 0xff, 0xff, 0xff, 0x0, 0xff]}}, 0x3, 0x2, 0xd9e7, 0x1, 0x2, 0x1000, 'vxcan1\x00', 'macvlan0\x00', {}, {0xff}, 0x0, 0xd0a9a00a8d77fbbc}, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x0, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @private=0xa010102, @empty, 0x2}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x10) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='./file1\x00') 2m15.793419169s ago: executing program 2 (id=143): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@redirect_dir_nofollow}]}) 2m14.578213505s ago: executing program 2 (id=144): getsockopt$packet_int(0xffffffffffffffff, 0x107, 0x7, 0x0, &(0x7f0000000040)) 2m13.549376592s ago: executing program 2 (id=147): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400000000000700", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300000003000000050007"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 2m12.521413825s ago: executing program 2 (id=150): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) 2m10.345899815s ago: executing program 2 (id=153): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2e}}, 0x1c) syz_emit_ethernet(0x4a, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r1, &(0x7f0000048040)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)={0x14, 0x16, 0x301, 0x274bd24, 0x25dfdbf8, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000000) 1m55.016951932s ago: executing program 35 (id=153): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2e}}, 0x1c) syz_emit_ethernet(0x4a, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) read$msr(r1, &(0x7f0000048040)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001080)={0x14, 0x16, 0x301, 0x274bd24, 0x25dfdbf8, {0x1}}, 0x14}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000000) 1m47.480883368s ago: executing program 5 (id=186): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, 0x0, 0x10) syz_usb_connect(0x5, 0x34, 0x0, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r2, 0xf501, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknod(&(0x7f0000001b40)='./file0\x00', 0x400, 0xffffffff) mount$nfs(0x0, &(0x7f0000001c40)='./file0\x00', &(0x7f0000001c80), 0x0, &(0x7f0000000040)={[{'lock'}]}) 1m39.76723149s ago: executing program 5 (id=194): openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 1m37.374274207s ago: executing program 5 (id=196): openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) syz_usb_connect(0x2, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x10) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='./file1\x00') 1m36.854872066s ago: executing program 4 (id=197): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118f7, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0/../file0/file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000c40)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000012c0)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000280)=@gcm_128={{0x304}, "ed197fbfb5c342b6", "28852cbbbeba35380ee5190047169f9d", "5f2307e0", "2ce6f8da8e55c427"}, 0x28) r3 = syz_io_uring_setup(0xb5c, &(0x7f0000000640)={0x0, 0x9916, 0x0, 0x0, 0x164}, &(0x7f0000000040)=0x0, &(0x7f0000000480)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4d, &(0x7f00000005c0)=0xe, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x10102, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000001000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff5000/0x9000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) syz_emit_ethernet(0x42, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa"], 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_uring_enter(r3, 0xf23, 0x0, 0xc, 0x0, 0x0) 1m32.2795806s ago: executing program 5 (id=200): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d"], 0x24}, 0x1, 0x5502000000000000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000180)={0x12}) write(r3, &(0x7f0000000340), 0x11000) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000003080102ecffffffffffffff00000020040004fc050003000100000002818fa52a1de9e403ec73208ee3e0d22c62495578d197c2fcfd6ec37169cd0567afe0e6fd4a27c3e67ba7d55e9fea09eebe5a72f01cf7aa78097e2823518579dfbc8d3a2de4dfcbd48ecc9b76473d8037fbc03380ed5ba20db0a43c36fcd7beb95427dee9a08e83c7fe9e6e499fb82338185b5e85bbc66832c98b09c571e899291d861a72caea6259277061bb5c17cea60409b96b3047b57cc816ed9ba5ea87e8c1601072a542c515aab0d9ed40fee9154f8cf5e6a0a136722c5ed473ecafa525ecb5ee6c836ed238dce109b59d3aa9b30bf6faefb0904c2299084982a28821caee11f0d9fddb967ef722394f1d43005ecc9a1d082d31e8c28e507576fc2229a61fa446d0bf2ab3f1c7ebf6c106c5e19c58f66737828788fc192998776ec8b23c52fe7e026b55c67bc0502768489a9fedd34274"], 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x801, 0x84) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) 1m30.19124277s ago: executing program 5 (id=203): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x9, 0x4, 0x0, 0x7, 0x3c5b, 0x1, 0x28, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8c, 0x1000, 0xffff, 0x0, 0x8000, 0x4, 0x8008, 0x400, 0x80, 0x3, 0x5, 0x6, 0x8, 0x4, 0x3, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e5, 0xc488, 0xf9, 0xe, 0x2c0, 0x6c7, 0x9, 0xffffffff, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0xd, 0x4e2, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xf, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa5, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x93a, 0x5, 0x7, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0x6, 0x226, 0x5, 0x4, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb3e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) pipe2(&(0x7f00000000c0), 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) timer_create(0x1, 0x0, &(0x7f0000bbdffc)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r4 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x1539, 0x0, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x0, 0x1}, 0x20) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r3, 0x0) setns(r5, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, &(0x7f0000001dc0)={0x8c, 0x0, 0x20000}, 0x20) r6 = syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r6, 0x0) mount(0x0, 0x0, 0x0, 0x2186a, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20008080) 1m25.53000614s ago: executing program 4 (id=210): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = syz_io_uring_setup(0x10e, &(0x7f00000000c0)={0x0, 0x8d2dc, 0x0, 0xfffeffff}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r4, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r5, 0x47f5, 0x0, 0x0, 0x0, 0x0) 1m24.871277302s ago: executing program 6 (id=212): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d"], 0x24}, 0x1, 0x5502000000000000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000180)={0x12}) write(r3, &(0x7f0000000340), 0x11000) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000003080102ecffffffffffffff00000020040004fc050003000100000002818fa52a1de9e403ec73208ee3e0d22c62495578d197c2fcfd6ec37169cd0567afe0e6fd4a27c3e67ba7d55e9fea09eebe5a72f01cf7aa78097e2823518579dfbc8d3a2de4dfcbd48ecc9b76473d8037fbc03380ed5ba20db0a43c36fcd7beb95427dee9a08e83c7fe9e6e499fb82338185b5e85bbc66832c98b09c571e899291d861a72caea6259277061bb5c17cea60409b96b3047b57cc816ed9ba5ea87e8c1601072a542c515aab0d9ed40fee9154f8cf5e6a0a136722c5ed473ecafa525ecb5ee6c836ed238dce109b59d3aa9b30bf6faefb0904c2299084982a28821caee11f0d9fddb967ef722394f1d43005ecc9a1d082d31e8c28e507576fc2229a61fa446d0bf2ab3f1c7ebf6c106c5e19c58f66737828788fc192998776ec8b23c52fe7e026b55c67bc0502768489a9fedd34274"], 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) 1m22.607334963s ago: executing program 6 (id=214): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000001080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000089c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_STATION(r1, 0x0, 0x10) 1m21.295234603s ago: executing program 6 (id=217): gettid() r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) read(r0, &(0x7f0000000080)=""/201, 0xc9) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) 1m20.694122446s ago: executing program 5 (id=218): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) mkdir(0x0, 0x0) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x1}, &(0x7f0000000080)={&(0x7f0000000100)}) sigaltstack(0x0, 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r3, 0x80000300, 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x0, 0x1, 0xa000200000a958, 0x4276, 0x3, 0x8, 0xfd, 0xfffffffffffffffc, 0x900fff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r4, 0x3b87, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x100000000}) r5 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x397}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r5, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) dup(r0) 1m19.708365278s ago: executing program 6 (id=220): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001040000000000070000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300000003000000050007"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1m18.788040958s ago: executing program 6 (id=221): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@redirect_dir_nofollow}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f00000002c0)='./file1\x00', 0x10, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r0, &(0x7f0000000100)='./file1\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x2) 1m17.221611712s ago: executing program 6 (id=222): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008008b}, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setsig(0x4203, r1, 0x5, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x28002) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r4, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/crypto\x00', 0x0, 0x0) sendfile(r3, r5, 0x0, 0x20000023896) 1m16.378475173s ago: executing program 4 (id=223): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d"], 0x24}, 0x1, 0x5502000000000000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000180)={0x12}) write(r3, &(0x7f0000000340), 0x11000) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000003080102ecffffffffffffff00000020040004fc050003000100000002818fa52a1de9e403ec73208ee3e0d22c62495578d197c2fcfd6ec37169cd0567afe0e6fd4a27c3e67ba7d55e9fea09eebe5a72f01cf7aa78097e2823518579dfbc8d3a2de4dfcbd48ecc9b76473d8037fbc03380ed5ba20db0a43c36fcd7beb95427dee9a08e83c7fe9e6e499fb82338185b5e85bbc66832c98b09c571e899291d861a72caea6259277061bb5c17cea60409b96b3047b57cc816ed9ba5ea87e8c1601072a542c515aab0d9ed40fee9154f8cf5e6a0a136722c5ed473ecafa525ecb5ee6c836ed238dce109b59d3aa9b30bf6faefb0904c2299084982a28821caee11f0d9fddb967ef722394f1d43005ecc9a1d082d31e8c28e507576fc2229a61fa446d0bf2ab3f1c7ebf6c106c5e19c58f66737828788fc192998776ec8b23c52fe7e026b55c67bc0502768489a9fedd34274"], 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) 1m13.651081861s ago: executing program 4 (id=224): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d"], 0x24}, 0x1, 0x5502000000000000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000180)={0x12}) write(r3, &(0x7f0000000340), 0x11000) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000003080102ecffffffffffffff00000020040004fc050003000100000002818fa52a1de9e403ec73208ee3e0d22c62495578d197c2fcfd6ec37169cd0567afe0e6fd4a27c3e67ba7d55e9fea09eebe5a72f01cf7aa78097e2823518579dfbc8d3a2de4dfcbd48ecc9b76473d8037fbc03380ed5ba20db0a43c36fcd7beb95427dee9a08e83c7fe9e6e499fb82338185b5e85bbc66832c98b09c571e899291d861a72caea6259277061bb5c17cea60409b96b3047b57cc816ed9ba5ea87e8c1601072a542c515aab0d9ed40fee9154f8cf5e6a0a136722c5ed473ecafa525ecb5ee6c836ed238dce109b59d3aa9b30bf6faefb0904c2299084982a28821caee11f0d9fddb967ef722394f1d43005ecc9a1d082d31e8c28e507576fc2229a61fa446d0bf2ab3f1c7ebf6c106c5e19c58f66737828788fc192998776ec8b23c52fe7e026b55c67bc0502768489a9fedd34274"], 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x83, &(0x7f0000000480)={0x0, 0x2}, 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f0000000140)={0x4, 0x8, 0x5, 0x2}, 0x8) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1m10.667088161s ago: executing program 4 (id=225): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000240)=0x2, 0x4) 1m9.945379994s ago: executing program 4 (id=227): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$dupfd(r0, 0x406, r1) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback, 0x6}}, 0x3, 0x81}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) syz_emit_ethernet(0x0, 0x0, 0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) pipe2(0x0, 0x0) r6 = syz_io_uring_setup(0x10d, &(0x7f00000006c0)={0x0, 0x5885, 0x0, 0x2}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) unshare(0x20000400) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x40, 0x0, 0x0, 0x6, &(0x7f00000000c0), 0x1, 0x40, 0x1}) io_uring_enter(r6, 0x3516, 0xc2de, 0x8, 0x0, 0x0) 1m5.233561605s ago: executing program 36 (id=218): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) mkdir(0x0, 0x0) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff, 0x1}, &(0x7f0000000080)={&(0x7f0000000100)}) sigaltstack(0x0, 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r3, 0x80000300, 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r2, 0xffffffff80000800, 0x0, &(0x7f0000000340)={0x0, 0x1, 0xa000200000a958, 0x4276, 0x3, 0x8, 0xfd, 0xfffffffffffffffc, 0x900fff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r4, 0x3b87, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x100000000}) r5 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x397}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(r5, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) dup(r0) 1m1.466382478s ago: executing program 37 (id=222): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008008b}, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setsig(0x4203, r1, 0x5, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x28002) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) recvmmsg(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$TCSBRKP(0xffffffffffffffff, 0x5425, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r4, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/crypto\x00', 0x0, 0x0) sendfile(r3, r5, 0x0, 0x20000023896) 54.153288965s ago: executing program 38 (id=227): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) fcntl$dupfd(r0, 0x406, r1) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback, 0x6}}, 0x3, 0x81}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) syz_emit_ethernet(0x0, 0x0, 0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r5, 0xc0189373, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7}}, './file0\x00'}) pipe2(0x0, 0x0) r6 = syz_io_uring_setup(0x10d, &(0x7f00000006c0)={0x0, 0x5885, 0x0, 0x2}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) unshare(0x20000400) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x40, 0x0, 0x0, 0x6, &(0x7f00000000c0), 0x1, 0x40, 0x1}) io_uring_enter(r6, 0x3516, 0xc2de, 0x8, 0x0, 0x0) 27.638752691s ago: executing program 7 (id=259): socket$packet(0x11, 0x3, 0x300) r0 = socket$netlink(0x10, 0x3, 0x4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) write(r0, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f7508", 0x25) 26.932575229s ago: executing program 7 (id=260): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000010c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r3, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) 16.78099984s ago: executing program 7 (id=263): openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 14.660388156s ago: executing program 7 (id=264): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@redirect_dir_nofollow}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f00000002c0)='./file1\x00', 0x10, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r0, &(0x7f0000000100)='./file1\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x2) 13.728824809s ago: executing program 7 (id=265): r0 = gettid() r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) read(r1, &(0x7f0000000080)=""/201, 0xc9) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, 0x0, 0x0) 12.042529789s ago: executing program 7 (id=266): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, 0x0, 0x0) sched_setscheduler(0x0, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x28) socket(0x10, 0x3, 0x0) r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) close(r0) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x60900, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x10000000000, 0x3, 0xfffffffffffffffd, 0x2, 0x80, 0x1, 0x9}, 0x0, &(0x7f00000002c0)={0x3fd, 0xfffffffffffffffe, 0x8, 0x7, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) lseek(r2, 0x4, 0x3) fsopen(&(0x7f0000000280)='incremental-fs\x00', 0x1) landlock_create_ruleset(&(0x7f0000000140)={0x0, 0x2, 0x3}, 0x18, 0x0) r3 = fanotify_init(0x40, 0x80000) readv(r3, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/175, 0xaf}], 0x1) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x97) fanotify_mark(r3, 0x1, 0x40001019, r4, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) getdents64(r4, &(0x7f0000000100)=""/156, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x53, 0x7, 0x7fffffff}]}) 9.686853491s ago: executing program 8 (id=268): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) sysinfo(&(0x7f0000000080)=""/98) 9.124620533s ago: executing program 8 (id=269): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="202301"], 0x0, 0x0, 0x0}, 0x0) 7.309056423s ago: executing program 0 (id=234): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r0, 0x0) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd86) 6.504819543s ago: executing program 9 (id=230): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48000000100001040000000000070000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300000003000000050007"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) 6.044122399s ago: executing program 1 (id=235): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d"], 0x24}, 0x1, 0x5502000000000000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xa, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000180)={0x12}) write(r3, &(0x7f0000000340), 0x11000) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000003080102ecffffffffffffff00000020040004fc050003000100000002818fa52a1de9e403ec73208ee3e0d22c62495578d197c2fcfd6ec37169cd0567afe0e6fd4a27c3e67ba7d55e9fea09eebe5a72f01cf7aa78097e2823518579dfbc8d3a2de4dfcbd48ecc9b76473d8037fbc03380ed5ba20db0a43c36fcd7beb95427dee9a08e83c7fe9e6e499fb82338185b5e85bbc66832c98b09c571e899291d861a72caea6259277061bb5c17cea60409b96b3047b57cc816ed9ba5ea87e8c1601072a542c515aab0d9ed40fee9154f8cf5e6a0a136722c5ed473ecafa525ecb5ee6c836ed238dce109b59d3aa9b30bf6faefb0904c2299084982a28821caee11f0d9fddb967ef722394f1d43005ecc9a1d082d31e8c28e507576fc2229a61fa446d0bf2ab3f1c7ebf6c106c5e19c58f66737828788fc192998776ec8b23c52fe7e026b55c67bc0502768489a9fedd34274"], 0x20}, 0x1, 0x0, 0x0, 0x44}, 0x4000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x83, &(0x7f0000000480)={0x0, 0x2}, 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="800002010800000008001b000000000008000d00"], 0x38}}, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f0000000140)={0x4, 0x8, 0x5, 0x2}, 0x8) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, &(0x7f0000000080)=0x2, 0x4) socket(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) 5.537150168s ago: executing program 9 (id=270): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') preadv(r0, &(0x7f0000001240), 0x0, 0x0, 0x3) 5.502005971s ago: executing program 8 (id=271): openat$vcsu(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) r0 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1]) 5.081238351s ago: executing program 0 (id=272): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(0x0, 0x8) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@redirect_dir_nofollow}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f00000002c0)='./file1\x00', 0x10, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r0, &(0x7f0000000100)='./file1\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x2) 4.512971452s ago: executing program 9 (id=273): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r0, 0x40045402, &(0x7f0000000140)=0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x1, 0x1, 0x400}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) 3.962086809s ago: executing program 0 (id=274): modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) 3.756742399s ago: executing program 9 (id=275): socket$packet(0x11, 0x3, 0x300) r0 = socket$netlink(0x10, 0x3, 0x4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) write(r0, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f750800", 0x26) 3.478135171s ago: executing program 8 (id=276): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x5}, [@TCA_NETEM_RATE={0x14, 0x6, {0xd0, 0x18000, 0x80000001, 0x4}}]}}}]}, 0x60}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xfff1, 0xb}, {0x5, 0x7}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r3 = socket$unix(0x1, 0x1, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8, r6, 0x2a}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x10) 2.999477898s ago: executing program 9 (id=277): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x48200, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000841, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x20}}, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x1c9, 0x12) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r3, 0x800452d2, &(0x7f0000000100)) 2.897536073s ago: executing program 0 (id=278): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)={0x20, 0x15, 0x3, "ec6d7e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f00000001c0)={0x40, 0x7, 0x8, "119f8a48b285ec9b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCRSSL2CALL(0xffffffffffffffff, 0x89e2, 0x0) 2.442643988s ago: executing program 1 (id=279): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}, @TCA_INGRESS_BLOCK={0x8}]}, 0x38}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000012c0)={0xe, 0xe, 0x0, &(0x7f0000000200)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x44}, 0x94) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x0, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x220, 0x20a, 0x278, 0x220, 0x278, 0x3, 0x0, {[{{@ipv6={@private2, @loopback, [], [], 'bond_slave_1\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x0, 0x100, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0x5}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@private2, @loopback, [0xff, 0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0xff, 0xffffff00, 0xff], 'veth1_to_hsr\x00', 'ipvlan1\x00', {}, {}, 0x3a, 0x79, 0x5, 0x4d}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) r5 = syz_open_dev$dri(&(0x7f0000000300), 0x1ff, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x40100001, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x3d}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000002c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r5, 0xc06864a2, &(0x7f00000011c0)={0x0, 0x0, r8, r9, 0x5, 0x1800, 0x2, 0x805, {0xac7c, 0x1, 0x7, 0x69, 0xf4b, 0x2, 0x2, 0x45, 0x412f, 0xe154, 0x1000, 0x43, 0xb2bf, 0x3, "fe0014000000000c00000000000000000000000000000000000700"}}) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) accept4(r0, 0x0, 0x0, 0x0) 2.018678197s ago: executing program 8 (id=280): syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RENAMEAT={0x23, 0x1a, 0x0, 0xffffffffffffffff, 0x0, 0x0}) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5393, &(0x7f0000000000)) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 1.076248259s ago: executing program 8 (id=281): r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="202301"], 0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 0 (id=282): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="301129"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000040)={0x1, 0x6, 0x2, &(0x7f0000000080)={0x11, "cc9856ff6b9b702f08a7f77dfd0b000000d00e59a70000000010000000000200"}}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4041880) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.79' (ED25519) to the list of known hosts. [ 155.228030][ T5758] cgroup: Unknown subsys name 'net' [ 155.371037][ T5758] cgroup: Unknown subsys name 'cpuset' [ 155.384984][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 160.977846][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 164.948408][ T5072] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 164.965491][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 164.974487][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 164.983575][ T5783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 164.996252][ T5783] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 164.997760][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 165.007431][ T5783] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 165.012397][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 165.030399][ T5784] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 165.030613][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 165.041188][ T5784] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 165.063955][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 165.078935][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 165.102886][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 165.114479][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 165.237595][ T49] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 165.248002][ T5784] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 165.260853][ T5784] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 165.272124][ T5784] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 165.279832][ T49] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 165.295148][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 165.308583][ T49] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 165.319726][ T49] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 165.332491][ T49] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 165.350263][ T5783] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 166.336600][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 166.736844][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 166.861877][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 167.047622][ T5789] chnl_net:caif_netlink_parms(): no params data found [ 167.121867][ T5777] Bluetooth: hci1: command tx timeout [ 167.127471][ T5777] Bluetooth: hci0: command tx timeout [ 167.158219][ T5788] chnl_net:caif_netlink_parms(): no params data found [ 167.201540][ T5777] Bluetooth: hci2: command tx timeout [ 167.370103][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.391938][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.399575][ T5776] bridge_slave_0: entered allmulticast mode [ 167.425654][ T5776] bridge_slave_0: entered promiscuous mode [ 167.441719][ T49] Bluetooth: hci4: command tx timeout [ 167.447629][ T5777] Bluetooth: hci3: command tx timeout [ 167.460858][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.494324][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.502555][ T5776] bridge_slave_1: entered allmulticast mode [ 167.522176][ T5776] bridge_slave_1: entered promiscuous mode [ 167.825413][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 167.868791][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.878969][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.887892][ T5779] bridge_slave_0: entered allmulticast mode [ 167.898263][ T5779] bridge_slave_0: entered promiscuous mode [ 167.922487][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 167.932649][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.940083][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 167.950566][ T5781] bridge_slave_0: entered allmulticast mode [ 167.960795][ T5781] bridge_slave_0: entered promiscuous mode [ 167.974109][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.984326][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.992036][ T5779] bridge_slave_1: entered allmulticast mode [ 168.000987][ T5779] bridge_slave_1: entered promiscuous mode [ 168.060970][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.068983][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.076583][ T5781] bridge_slave_1: entered allmulticast mode [ 168.085353][ T5781] bridge_slave_1: entered promiscuous mode [ 168.143570][ T5789] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.150992][ T5789] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.158643][ T5789] bridge_slave_0: entered allmulticast mode [ 168.166866][ T5789] bridge_slave_0: entered promiscuous mode [ 168.267619][ T5789] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.275568][ T5789] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.283233][ T5789] bridge_slave_1: entered allmulticast mode [ 168.291994][ T5789] bridge_slave_1: entered promiscuous mode [ 168.307089][ T5776] team0: Port device team_slave_0 added [ 168.370741][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.409751][ T5776] team0: Port device team_slave_1 added [ 168.416075][ T5788] bridge0: port 1(bridge_slave_0) entered blocking state [ 168.423892][ T5788] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.431801][ T5788] bridge_slave_0: entered allmulticast mode [ 168.439813][ T5788] bridge_slave_0: entered promiscuous mode [ 168.458192][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.475309][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 168.532808][ T5788] bridge0: port 2(bridge_slave_1) entered blocking state [ 168.540409][ T5788] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.548261][ T5788] bridge_slave_1: entered allmulticast mode [ 168.556664][ T5788] bridge_slave_1: entered promiscuous mode [ 168.574039][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 168.614737][ T5789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.722884][ T5789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 168.734403][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 168.752512][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 168.798685][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 168.824042][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 168.832276][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 168.859589][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 168.928105][ T5779] team0: Port device team_slave_0 added [ 168.985247][ T5788] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 169.002995][ T5781] team0: Port device team_slave_0 added [ 169.015561][ T5779] team0: Port device team_slave_1 added [ 169.085103][ T5789] team0: Port device team_slave_0 added [ 169.097944][ T5788] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 169.144538][ T5781] team0: Port device team_slave_1 added [ 169.175991][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.183424][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.209960][ T49] Bluetooth: hci1: command tx timeout [ 169.212306][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.215993][ T5777] Bluetooth: hci0: command tx timeout [ 169.237456][ T5789] team0: Port device team_slave_1 added [ 169.282019][ T5777] Bluetooth: hci2: command tx timeout [ 169.314196][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.321240][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.347609][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 169.389458][ T5788] team0: Port device team_slave_0 added [ 169.502632][ T5788] team0: Port device team_slave_1 added [ 169.510414][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.517597][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.544110][ T5777] Bluetooth: hci3: command tx timeout [ 169.545295][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.549640][ T5777] Bluetooth: hci4: command tx timeout [ 169.567439][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.574712][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.601257][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 169.625899][ T5776] hsr_slave_0: entered promiscuous mode [ 169.634358][ T5776] hsr_slave_1: entered promiscuous mode [ 169.650533][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.657715][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.684119][ T5789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 169.748477][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 169.755921][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.782386][ T5789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 169.903207][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 169.910302][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 169.936862][ T5788] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 170.024758][ T5781] hsr_slave_0: entered promiscuous mode [ 170.033468][ T5781] hsr_slave_1: entered promiscuous mode [ 170.040862][ T5781] debugfs: 'hsr0' already exists in 'hsr' [ 170.047088][ T5781] Cannot create hsr debugfs directory [ 170.055377][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 170.062729][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 170.089070][ T5788] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 170.114793][ T5779] hsr_slave_0: entered promiscuous mode [ 170.123699][ T5779] hsr_slave_1: entered promiscuous mode [ 170.131255][ T5779] debugfs: 'hsr0' already exists in 'hsr' [ 170.137551][ T5779] Cannot create hsr debugfs directory [ 170.329914][ T5789] hsr_slave_0: entered promiscuous mode [ 170.338530][ T5789] hsr_slave_1: entered promiscuous mode [ 170.346605][ T5789] debugfs: 'hsr0' already exists in 'hsr' [ 170.352599][ T5789] Cannot create hsr debugfs directory [ 170.658558][ T5788] hsr_slave_0: entered promiscuous mode [ 170.667217][ T5788] hsr_slave_1: entered promiscuous mode [ 170.675429][ T5788] debugfs: 'hsr0' already exists in 'hsr' [ 170.681232][ T5788] Cannot create hsr debugfs directory [ 171.281916][ T49] Bluetooth: hci1: command tx timeout [ 171.287853][ T5777] Bluetooth: hci0: command tx timeout [ 171.361692][ T5777] Bluetooth: hci2: command tx timeout [ 171.539747][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 171.570790][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 171.590145][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 171.601802][ T49] Bluetooth: hci3: command tx timeout [ 171.607724][ T5777] Bluetooth: hci4: command tx timeout [ 171.626935][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 171.737645][ T5781] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 171.780999][ T5781] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 171.818275][ T5781] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 171.856555][ T5781] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 171.969070][ T5779] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 172.060592][ T5779] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 172.081161][ T5779] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 172.125663][ T5779] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 172.351977][ T5789] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 172.370981][ T5789] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 172.418499][ T5789] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 172.459471][ T5789] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 172.680214][ T5788] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 172.730142][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.747037][ T5788] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 172.775551][ T5788] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 172.795876][ T5788] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 172.960878][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.054566][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.062000][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.136065][ T1136] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.143449][ T1136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.190736][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.356890][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.373438][ T49] Bluetooth: hci1: command tx timeout [ 173.379117][ T5777] Bluetooth: hci0: command tx timeout [ 173.443036][ T5777] Bluetooth: hci2: command tx timeout [ 173.464666][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.558678][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.566067][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.603597][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 173.634247][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.641768][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.664095][ T5789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 173.682389][ T5777] Bluetooth: hci4: command tx timeout [ 173.687965][ T5777] Bluetooth: hci3: command tx timeout [ 173.736055][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.743614][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 173.916587][ T1136] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.924144][ T1136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 173.957149][ T5789] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.079653][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.087198][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.179883][ T3473] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.187408][ T3473] bridge0: port 2(bridge_slave_1) entered forwarding state [ 174.226914][ T5788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 174.486094][ T5788] 8021q: adding VLAN 0 to HW filter on device team0 [ 174.630631][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 174.651003][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 174.658731][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 174.781295][ T1136] bridge0: port 2(bridge_slave_1) entered blocking state [ 174.788865][ T1136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.196930][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 175.489904][ T5776] veth0_vlan: entered promiscuous mode [ 175.728265][ T5776] veth1_vlan: entered promiscuous mode [ 176.049662][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.125494][ T5789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 176.273507][ T5776] veth0_macvtap: entered promiscuous mode [ 176.311186][ T5776] veth1_macvtap: entered promiscuous mode [ 176.605844][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 176.692560][ T5779] veth0_vlan: entered promiscuous mode [ 176.714740][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 176.757168][ T5789] veth0_vlan: entered promiscuous mode [ 176.817562][ T5779] veth1_vlan: entered promiscuous mode [ 176.836849][ T3473] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.863716][ T3473] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.873469][ T3473] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.889148][ T3473] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 176.927730][ T5789] veth1_vlan: entered promiscuous mode [ 177.099715][ T5788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 177.219462][ T5781] veth0_vlan: entered promiscuous mode [ 177.314900][ T5781] veth1_vlan: entered promiscuous mode [ 177.431416][ T5779] veth0_macvtap: entered promiscuous mode [ 177.447700][ T5789] veth0_macvtap: entered promiscuous mode [ 177.506952][ T5779] veth1_macvtap: entered promiscuous mode [ 177.532955][ T5789] veth1_macvtap: entered promiscuous mode [ 177.660192][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.757723][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 177.806352][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.865529][ T5788] veth0_vlan: entered promiscuous mode [ 177.890600][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 177.924648][ T5781] veth0_macvtap: entered promiscuous mode [ 177.993834][ T1136] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.029248][ T5788] veth1_vlan: entered promiscuous mode [ 178.048057][ T5781] veth1_macvtap: entered promiscuous mode [ 178.078569][ T1136] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.179261][ T1136] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.283772][ T57] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.314303][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.361973][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.371029][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.430978][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 178.474859][ T1136] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.553766][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 178.633159][ T5788] veth0_macvtap: entered promiscuous mode [ 178.703655][ T5788] veth1_macvtap: entered promiscuous mode [ 178.730888][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.811288][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.820466][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 178.896859][ T35] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.073107][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 179.219151][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 179.340554][ T68] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.375546][ T68] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.443009][ T3473] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 179.485264][ T35] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.369018][ T3473] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 181.427872][ T3473] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 181.652334][ T4157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 181.660797][ T4157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 182.138158][ T5776] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 183.854551][ T3473] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 183.882194][ T3473] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.036625][ T5834] kernel write not supported for file /vcsu (pid: 5834 comm: kworker/1:5) [ 184.192116][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.203280][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.388323][ T1136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.415818][ T1136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.543267][ T1136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.551255][ T1136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 184.787365][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 184.846679][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.058794][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.084269][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.482127][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.490134][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.740509][ T3473] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.753930][ T3473] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 186.163057][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 186.324702][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 187.138976][ T5994] netlink: 'syz.3.4': attribute type 1 has an invalid length. [ 187.172816][ T5994] netlink: 'syz.3.4': attribute type 2 has an invalid length. [ 187.495061][ T0] NOHZ tick-stop error: local softirq work is pending, handler #2c2!!! [ 187.762692][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 187.772027][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 187.780973][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 187.838297][ T5977] netlink: 'syz.3.4': attribute type 1 has an invalid length. [ 187.904119][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 188.198683][ T5977] netlink: 'syz.3.4': attribute type 2 has an invalid length. [ 188.522469][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 189.603103][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 190.362432][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 190.498302][ T6008] netlink: 'syz.4.9': attribute type 13 has an invalid length. [ 190.807785][ T6009] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9'. [ 191.942712][ T6017] netlink: 64 bytes leftover after parsing attributes in process `syz.0.11'. [ 195.023365][ T6024] 9p: Bad value for 'wfdno' [ 195.951825][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 196.186090][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 196.292547][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 196.345505][ T10] usb 2-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 196.378303][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 196.460579][ T10] usb 2-1: config 0 descriptor?? [ 197.152634][ T10] steelseries 0003:1038:12B6.0001: report_id 0 is invalid [ 197.160000][ T10] steelseries 0003:1038:12B6.0001: item 0 4 1 8 parsing failed [ 197.253157][ T10] steelseries 0003:1038:12B6.0001: probe with driver steelseries failed with error -22 [ 197.360709][ T10] usb 2-1: USB disconnect, device number 2 [ 199.351705][ T5836] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 199.546278][ T5836] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 199.630386][ T5836] usb 2-1: config 0 has no interface number 0 [ 199.666410][ T5836] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 199.751541][ T5836] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 199.808860][ T5836] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 199.860393][ T5836] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 199.892516][ T6048] netlink: 64 bytes leftover after parsing attributes in process `syz.3.22'. [ 199.921539][ T5836] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 199.961752][ T5836] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 200.008057][ T5836] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 200.050335][ T5836] usb 2-1: config 0 descriptor?? [ 200.144631][ T6046] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 200.262048][ T5836] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 200.609125][ T5836] usb 2-1: USB disconnect, device number 3 [ 200.720981][ T5836] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 201.168997][ T6052] netlink: 'syz.3.23': attribute type 13 has an invalid length. [ 201.648906][ T6053] netlink: 8 bytes leftover after parsing attributes in process `syz.3.23'. [ 203.045346][ T6062] 9p: Bad value for 'wfdno' [ 203.973165][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 203.991794][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 205.781683][ T5836] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 205.963792][ T5836] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 206.007326][ T5836] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 206.065700][ T5836] usb 4-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 206.097088][ T5836] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.169109][ T5836] usb 4-1: config 0 descriptor?? [ 206.370675][ T6079] netlink: 64 bytes leftover after parsing attributes in process `syz.1.33'. [ 206.730183][ T5836] steelseries 0003:1038:12B6.0002: report_id 0 is invalid [ 206.776724][ T5836] steelseries 0003:1038:12B6.0002: item 0 4 1 8 parsing failed [ 206.817027][ T5836] steelseries 0003:1038:12B6.0002: probe with driver steelseries failed with error -22 [ 206.894614][ T5836] usb 4-1: USB disconnect, device number 2 [ 206.931781][ T5833] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 207.134309][ T5833] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 207.160560][ T5833] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 207.173557][ T24] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 207.194107][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.234571][ T5833] usb 5-1: config 0 descriptor?? [ 207.298252][ T5833] pwc: Askey VC010 type 2 USB webcam detected. [ 207.352202][ T24] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 207.370980][ T24] usb 3-1: config 0 has no interface number 0 [ 207.382410][ T24] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 207.451906][ T24] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 207.514341][ T24] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 207.576168][ T24] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 207.634572][ T24] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 207.703487][ T24] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 207.722857][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 207.733413][ T5833] pwc: recv_control_msg error -32 req 02 val 2b00 [ 207.779397][ T24] usb 3-1: config 0 descriptor?? [ 207.816937][ T5833] pwc: recv_control_msg error -32 req 02 val 2700 [ 207.826949][ T6085] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 207.892036][ T5833] pwc: recv_control_msg error -32 req 02 val 2c00 [ 207.932062][ T5833] pwc: recv_control_msg error -32 req 04 val 1000 [ 207.944845][ T24] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 207.954529][ T5833] pwc: recv_control_msg error -32 req 04 val 1300 [ 208.018956][ T5833] pwc: recv_control_msg error -32 req 04 val 1400 [ 208.048930][ T5833] pwc: recv_control_msg error -32 req 02 val 2000 [ 208.084006][ T5833] pwc: recv_control_msg error -32 req 02 val 2100 [ 208.139083][ T5833] pwc: recv_control_msg error -32 req 04 val 1500 [ 208.266902][ T5833] pwc: recv_control_msg error -32 req 02 val 2500 [ 208.365995][ T5833] pwc: recv_control_msg error -32 req 02 val 2400 [ 208.441240][ T5836] usb 3-1: USB disconnect, device number 2 [ 208.517348][ T5836] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 208.679066][ T5833] pwc: recv_control_msg error -71 req 02 val 2900 [ 208.720117][ T5833] pwc: recv_control_msg error -71 req 02 val 2800 [ 208.750771][ T5833] pwc: recv_control_msg error -71 req 04 val 1100 [ 208.799220][ T5833] pwc: recv_control_msg error -71 req 04 val 1200 [ 208.836290][ T5833] pwc: Registered as video103. [ 208.872952][ T6098] netlink: 'syz.3.38': attribute type 13 has an invalid length. [ 208.884689][ T5833] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input5 [ 209.032302][ T5833] usb 5-1: USB disconnect, device number 2 [ 209.293000][ T6095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.38'. [ 209.839291][ T6103] 9p: Bad value for 'wfdno' [ 210.058212][ T6105] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 211.519516][ T6113] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 212.022826][ T6116] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 214.781722][ T5833] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 214.901943][ T5836] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 214.969605][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 215.015440][ T5833] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 215.062585][ T5833] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 215.108638][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.171020][ T5833] usb 5-1: config 0 descriptor?? [ 215.180498][ T5836] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 215.214448][ T5836] usb 3-1: config 0 has no interface number 0 [ 215.237355][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 215.279302][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 215.309219][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 215.363207][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 215.411866][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 215.472280][ T5836] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 215.530851][ T5836] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 215.588783][ T5836] usb 3-1: config 0 descriptor?? [ 215.620108][ T6132] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 215.715199][ T5836] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 215.789915][ T5833] steelseries 0003:1038:12B6.0003: report_id 0 is invalid [ 215.819930][ T5833] steelseries 0003:1038:12B6.0003: item 0 4 1 8 parsing failed [ 215.906389][ T5833] steelseries 0003:1038:12B6.0003: probe with driver steelseries failed with error -22 [ 216.040630][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-1) [ 216.048708][ T5836] usb 3-1: USB disconnect, device number 3 [ 216.126375][ T5833] usb 5-1: USB disconnect, device number 3 [ 216.143391][ T5836] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 218.145304][ T6142] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 218.749669][ T6145] 9p: Bad value for 'rfdno' [ 220.663179][ T5836] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 220.863148][ T5836] usb 3-1: Using ep0 maxpacket: 16 [ 220.912074][ T5836] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 220.920386][ T5836] usb 3-1: config 0 has no interface number 0 [ 220.995997][ T5836] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 221.047221][ T5836] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 221.084661][ T5836] usb 3-1: Product: syz [ 221.088944][ T5836] usb 3-1: Manufacturer: syz [ 221.137276][ T5836] usb 3-1: SerialNumber: syz [ 221.172356][ T5836] usb 3-1: config 0 descriptor?? [ 221.213949][ T5836] hub 3-1:0.132: bad descriptor, ignoring hub [ 221.246235][ T5836] hub 3-1:0.132: probe with driver hub failed with error -5 [ 221.334383][ T5836] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input6 [ 222.321058][ T49] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 222.334282][ T49] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 222.347749][ T49] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 222.369938][ T49] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 222.386213][ T49] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 223.342847][ T5833] usb 3-1: USB disconnect, device number 4 [ 223.644320][ T5833] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 223.860287][ T5833] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 223.880880][ T5833] usb 5-1: config 0 has no interface number 0 [ 223.904648][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 223.939628][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 223.989325][ T5833] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 224.072393][ T5833] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 224.128441][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 224.202621][ T5833] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 224.247323][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.379692][ T5833] usb 5-1: config 0 descriptor?? [ 224.422072][ T6168] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 224.481979][ T5777] Bluetooth: hci5: command tx timeout [ 224.578014][ T5833] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 224.992951][ T5836] usb 5-1: USB disconnect, device number 4 [ 225.047783][ T5836] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 226.219865][ T6180] 9p: Bad value for 'rfdno' [ 226.238210][ T6160] chnl_net:caif_netlink_parms(): no params data found [ 226.416193][ T6181] overlayfs: missing 'workdir' [ 226.580741][ T5777] Bluetooth: hci5: command tx timeout [ 227.506512][ T49] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 227.536787][ T49] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 227.556775][ T49] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 227.571124][ T49] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 227.584763][ T49] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 228.651874][ T49] Bluetooth: hci5: command tx timeout [ 229.167020][ T6160] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.242632][ T6160] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.250337][ T6160] bridge_slave_0: entered allmulticast mode [ 229.453708][ T6160] bridge_slave_0: entered promiscuous mode [ 229.642350][ T6160] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.649803][ T6160] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.711708][ T49] Bluetooth: hci6: command tx timeout [ 229.745752][ T6160] bridge_slave_1: entered allmulticast mode [ 229.785841][ T6160] bridge_slave_1: entered promiscuous mode [ 230.100671][ T6160] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 230.538428][ T6160] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 230.721625][ T49] Bluetooth: hci5: command tx timeout [ 230.877900][ T53] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.168333][ T6160] team0: Port device team_slave_0 added [ 231.278037][ T6160] team0: Port device team_slave_1 added [ 231.498109][ T53] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.651886][ T5836] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 231.762897][ T49] Bluetooth: hci6: command tx timeout [ 231.844550][ T53] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.877015][ T5836] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 231.898807][ T5836] usb 3-1: config 0 has no interface number 0 [ 231.921738][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 231.971743][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 232.031762][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 232.115860][ T6160] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 232.131939][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 232.162023][ T6160] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 232.205426][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 232.267763][ T5836] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 232.298546][ T5836] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.301490][ T6160] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 232.382142][ T5836] usb 3-1: config 0 descriptor?? [ 232.413726][ T6204] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 232.476267][ T53] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 232.520981][ T5836] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 232.774779][ T5836] usb 3-1: USB disconnect, device number 5 [ 232.825222][ T6160] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 232.861861][ T6160] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 232.902179][ T6160] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 232.924080][ T5836] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 233.173416][ T6208] 9p: Bad value for 'rfdno' [ 233.273554][ T6186] chnl_net:caif_netlink_parms(): no params data found [ 233.719586][ T6160] hsr_slave_0: entered promiscuous mode [ 233.739688][ T6160] hsr_slave_1: entered promiscuous mode [ 233.749933][ T6160] debugfs: 'hsr0' already exists in 'hsr' [ 233.753630][ T6210] overlayfs: missing 'workdir' [ 233.756045][ T6160] Cannot create hsr debugfs directory [ 233.844759][ T49] Bluetooth: hci6: command tx timeout [ 234.452966][ T53] bridge_slave_1: left allmulticast mode [ 234.458916][ T53] bridge_slave_1: left promiscuous mode [ 234.592818][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 234.688009][ T53] bridge_slave_0: left allmulticast mode [ 234.758199][ T53] bridge_slave_0: left promiscuous mode [ 234.822592][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.952875][ T49] Bluetooth: hci6: command tx timeout [ 236.160344][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 236.196151][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 236.226934][ T53] bond0 (unregistering): Released all slaves [ 236.803393][ T24] kernel write not supported for file /dsp1 (pid: 24 comm: kworker/1:0) [ 236.954882][ T5836] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 237.147334][ T5836] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 237.189988][ T5836] usb 3-1: config 0 has no interface number 0 [ 237.220831][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 237.245848][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 237.293903][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 237.326719][ T5836] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 237.358378][ T5836] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 237.389977][ T5836] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 237.400434][ T5836] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.434859][ T5836] usb 3-1: config 0 descriptor?? [ 237.453982][ T6237] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 237.506682][ T5836] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 237.544424][ T6186] bridge0: port 1(bridge_slave_0) entered blocking state [ 237.578857][ T6186] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.623594][ T6186] bridge_slave_0: entered allmulticast mode [ 237.654372][ T6186] bridge_slave_0: entered promiscuous mode [ 237.746127][ T24] usb 3-1: USB disconnect, device number 6 [ 237.793501][ T24] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 237.866099][ T6186] bridge0: port 2(bridge_slave_1) entered blocking state [ 237.900386][ T6186] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.953579][ T6186] bridge_slave_1: entered allmulticast mode [ 237.987132][ T6186] bridge_slave_1: entered promiscuous mode [ 238.103996][ T53] hsr_slave_0: left promiscuous mode [ 238.139059][ T53] hsr_slave_1: left promiscuous mode [ 238.165666][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 238.183742][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 238.226124][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 238.271740][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 238.372923][ T53] veth1_macvtap: left promiscuous mode [ 238.411601][ T53] veth0_macvtap: left promiscuous mode [ 238.417506][ T53] veth1_vlan: left promiscuous mode [ 238.459410][ T53] veth0_vlan: left promiscuous mode [ 238.624092][ T6243] overlayfs: missing 'workdir' [ 240.881891][ T53] team0 (unregistering): Port device team_slave_1 removed [ 240.968815][ T53] team0 (unregistering): Port device team_slave_0 removed [ 242.290057][ T6186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 242.437310][ T6186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 242.565893][ T24] kernel write not supported for file /dsp1 (pid: 24 comm: kworker/1:0) [ 242.879329][ T6186] team0: Port device team_slave_0 added [ 243.028494][ T6186] team0: Port device team_slave_1 added [ 243.037154][ T6284] overlayfs: missing 'lowerdir' [ 243.210857][ T5830] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 243.213276][ T6186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 243.246324][ T6186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 243.280613][ T6186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 243.334595][ T6160] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 243.386749][ T6186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 243.409239][ T5830] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 243.418301][ T6186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 243.444928][ T5830] usb 5-1: config 0 has no interface number 0 [ 243.451194][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 243.478294][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 243.491102][ T6186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 243.513232][ T5830] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 243.532673][ T5830] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 243.565118][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 243.604353][ T6160] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 243.614547][ T5830] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 243.614687][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.633049][ T5830] usb 5-1: config 0 descriptor?? [ 243.645272][ T6283] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 243.702885][ T5830] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 243.754412][ T53] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.860122][ T6160] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 243.895276][ T6160] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 243.990568][ T24] usb 5-1: USB disconnect, device number 5 [ 244.023042][ T24] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 244.337318][ T53] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.592269][ T6186] hsr_slave_0: entered promiscuous mode [ 244.626362][ T6186] hsr_slave_1: entered promiscuous mode [ 244.685110][ T6186] debugfs: 'hsr0' already exists in 'hsr' [ 244.718457][ T6186] Cannot create hsr debugfs directory [ 244.803936][ T53] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 245.264081][ T53] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 247.944095][ T53] bridge_slave_1: left allmulticast mode [ 247.965765][ T53] bridge_slave_1: left promiscuous mode [ 247.998870][ T53] bridge0: port 2(bridge_slave_1) entered disabled state [ 248.052124][ T53] bridge_slave_0: left allmulticast mode [ 248.057956][ T53] bridge_slave_0: left promiscuous mode [ 248.097930][ T53] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.684012][ T53] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 249.732657][ T53] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 249.792486][ T53] bond0 (unregistering): Released all slaves [ 250.839023][ T6186] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 251.194519][ T6186] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 251.314969][ T6334] overlayfs: missing 'lowerdir' [ 251.360640][ T6186] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 251.488113][ T6186] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 251.792119][ T53] hsr_slave_0: left promiscuous mode [ 251.867407][ T53] hsr_slave_1: left promiscuous mode [ 251.907215][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 251.931854][ T53] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 251.961742][ T53] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 251.976827][ T53] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 252.099231][ T53] veth1_macvtap: left promiscuous mode [ 252.112792][ T53] veth0_macvtap: left promiscuous mode [ 252.125273][ T53] veth1_vlan: left promiscuous mode [ 252.130904][ T53] veth0_vlan: left promiscuous mode [ 252.355738][ T5830] kernel write not supported for file /dsp1 (pid: 5830 comm: kworker/0:3) [ 252.833820][ T6339] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 253.671584][ T5830] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 253.741716][ T6346] netlink: 40 bytes leftover after parsing attributes in process `syz.2.110'. [ 253.885609][ T5830] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 253.899791][ T5830] usb 5-1: config 0 has no interface number 0 [ 253.916118][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 253.928522][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 253.944128][ T5830] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 253.960120][ T5830] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 253.978380][ T5830] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 253.994376][ T5830] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 254.011882][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.045452][ T5830] usb 5-1: config 0 descriptor?? [ 254.073404][ T6344] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 254.146233][ T5830] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 254.635005][ T53] team0 (unregistering): Port device team_slave_1 removed [ 254.750622][ T53] team0 (unregistering): Port device team_slave_0 removed [ 255.448444][ C1] ldusb 5-1:0.55: usb_submit_urb failed (-1) [ 255.458888][ T5830] usb 5-1: USB disconnect, device number 6 [ 255.539811][ T5830] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 255.863017][ T6160] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.456142][ T6160] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.721008][ T3473] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.728625][ T3473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.764162][ T5836] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 256.914654][ T4151] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.922379][ T4151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.961808][ T5836] usb 5-1: Using ep0 maxpacket: 16 [ 256.985002][ T5836] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 257.010363][ T5836] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 257.068122][ T5836] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 257.088481][ T5836] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.107514][ T5836] usb 5-1: Product: syz [ 257.121607][ T5836] usb 5-1: Manufacturer: syz [ 257.140086][ T5836] usb 5-1: SerialNumber: syz [ 257.191008][ T5836] usb 5-1: config 0 descriptor?? [ 257.264362][ T5836] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 257.293811][ T5836] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 257.770549][ T6186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 257.873891][ T5836] em28xx 5-1:0.0: chip ID is em2874 [ 258.117962][ T5830] usb 5-1: USB disconnect, device number 7 [ 258.164075][ T5830] em28xx 5-1:0.0: Disconnecting em28xx [ 258.212001][ T5830] em28xx 5-1:0.0: Freeing device [ 258.215872][ T6186] 8021q: adding VLAN 0 to HW filter on device team0 [ 258.358923][ T4151] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.366459][ T4151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 258.551083][ T4151] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.558696][ T4151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 259.320375][ T6374] overlayfs: missing 'lowerdir' [ 260.028051][ T6160] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 260.678186][ T5830] kernel write not supported for file /dsp1 (pid: 5830 comm: kworker/0:3) [ 262.070297][ T5777] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 262.094535][ T5777] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 262.106192][ T6186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 262.129448][ T5777] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 262.148120][ T5777] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 262.166588][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 263.476736][ T6160] veth0_vlan: entered promiscuous mode [ 263.758790][ T6160] veth1_vlan: entered promiscuous mode [ 263.766002][ T6409] netlink: 64 bytes leftover after parsing attributes in process `syz.2.118'. [ 263.819860][ T6412] netlink: 40 bytes leftover after parsing attributes in process `syz.4.119'. [ 264.296125][ T49] Bluetooth: hci0: command tx timeout [ 264.712633][ T6160] veth0_macvtap: entered promiscuous mode [ 265.318865][ T6424] lo: Caught tx_queue_len zero misconfig [ 265.341853][ T6424] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 265.393251][ T6160] veth1_macvtap: entered promiscuous mode [ 265.427059][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 265.433793][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.583196][ T24] usb 3-1: new full-speed USB device number 7 using dummy_hcd [ 265.707411][ T6160] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 265.763955][ T6394] chnl_net:caif_netlink_parms(): no params data found [ 265.831153][ T24] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 265.839876][ T24] usb 3-1: config 0 has no interface number 0 [ 265.891872][ T24] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 265.927393][ T24] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 266.081774][ T24] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 266.083359][ T6160] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 266.151689][ T24] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 266.315463][ T24] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 266.433246][ T49] Bluetooth: hci0: command tx timeout [ 266.508512][ T24] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 266.518373][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.550892][ T24] usb 3-1: config 0 descriptor?? [ 266.562818][ T6420] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 266.625279][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.711206][ T24] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 266.863290][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 266.952326][ T68] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.204542][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.275591][ T68] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.324917][ T24] usb 3-1: USB disconnect, device number 7 [ 267.392370][ T24] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 267.500067][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.666751][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.867517][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 267.973755][ T6441] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 268.039778][ T6441] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 268.217343][ T6394] bridge0: port 1(bridge_slave_0) entered blocking state [ 268.239891][ T6394] bridge0: port 1(bridge_slave_0) entered disabled state [ 268.282359][ T6394] bridge_slave_0: entered allmulticast mode [ 268.310549][ T6394] bridge_slave_0: entered promiscuous mode [ 268.417451][ T6394] bridge0: port 2(bridge_slave_1) entered blocking state [ 268.512182][ T6394] bridge0: port 2(bridge_slave_1) entered disabled state [ 268.519880][ T6394] bridge_slave_1: entered allmulticast mode [ 268.541906][ T49] Bluetooth: hci0: command tx timeout [ 268.546869][ T6394] bridge_slave_1: entered promiscuous mode [ 268.920460][ T6394] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 268.945778][ T6186] veth0_vlan: entered promiscuous mode [ 269.010739][ T6394] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 269.433568][ T6186] veth1_vlan: entered promiscuous mode [ 269.596038][ T6394] team0: Port device team_slave_0 added [ 269.650184][ T6394] team0: Port device team_slave_1 added [ 270.119134][ T13] bridge_slave_1: left allmulticast mode [ 270.149661][ T13] bridge_slave_1: left promiscuous mode [ 270.194293][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.242153][ T13] bridge_slave_0: left allmulticast mode [ 270.247989][ T13] bridge_slave_0: left promiscuous mode [ 270.327254][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.561596][ T49] Bluetooth: hci0: command tx timeout [ 271.380591][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 271.444263][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 271.501882][ T13] bond0 (unregistering): Released all slaves [ 271.888736][ T6394] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 271.928015][ T6394] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 272.011561][ T6394] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 272.048064][ T6394] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 272.099941][ T6394] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 272.231519][ T6394] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 272.907332][ T6394] hsr_slave_0: entered promiscuous mode [ 272.954565][ T6394] hsr_slave_1: entered promiscuous mode [ 273.353022][ T13] hsr_slave_0: left promiscuous mode [ 273.403276][ T13] hsr_slave_1: left promiscuous mode [ 273.411074][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 273.442099][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 273.483778][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 273.512652][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 273.576318][ T13] veth1_macvtap: left promiscuous mode [ 273.584846][ T13] veth0_macvtap: left promiscuous mode [ 273.590578][ T13] veth1_vlan: left promiscuous mode [ 273.640774][ T13] veth0_vlan: left promiscuous mode [ 274.972354][ T6480] netlink: 64 bytes leftover after parsing attributes in process `syz.2.127'. [ 274.997419][ T6481] netlink: 40 bytes leftover after parsing attributes in process `syz.4.128'. [ 275.035434][ T13] team0 (unregistering): Port device team_slave_1 removed [ 275.082237][ T13] team0 (unregistering): Port device team_slave_0 removed [ 275.549942][ T6186] veth0_macvtap: entered promiscuous mode [ 275.800885][ T6186] veth1_macvtap: entered promiscuous mode [ 276.132092][ T24] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 276.259987][ T6186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 276.302093][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 276.329020][ T24] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 276.361581][ T24] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 276.370406][ T24] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 276.407082][ T24] usb 3-1: config 1 has no interface number 0 [ 276.431482][ T24] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 276.463120][ T24] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 276.495862][ T6186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 276.528607][ T24] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 276.541795][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.610870][ T24] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 276.655190][ T4157] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.701108][ T4157] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.785107][ T4157] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.815314][ T4157] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 276.836165][ T24] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 277.057000][ T10] usb 3-1: USB disconnect, device number 8 [ 277.105077][ T10] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 277.129301][ T4157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 277.175297][ T4157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 277.422886][ T6394] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 277.487710][ T6394] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 277.545101][ T6394] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 277.612064][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 277.617486][ T6394] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 277.621474][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 278.299052][ T6488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.130'. [ 278.415340][ T10] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 278.602770][ T6511] netlink: 8 bytes leftover after parsing attributes in process `syz.5.54'. [ 278.625228][ T10] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 278.656765][ T10] usb 3-1: config 0 has no interface number 0 [ 278.669169][ T10] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 278.686442][ T10] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 278.699041][ T10] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 278.726376][ T10] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 278.743112][ T10] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 278.782938][ T10] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 278.809816][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.836709][ T10] usb 3-1: config 0 descriptor?? [ 278.861965][ T6504] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 278.916626][ T10] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 279.380227][ T5834] usb 3-1: USB disconnect, device number 9 [ 279.425880][ T5834] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 279.779719][ T6394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 279.993761][ T6394] 8021q: adding VLAN 0 to HW filter on device team0 [ 280.066830][ T6521] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 280.080707][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.088273][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 280.103779][ T6521] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 280.192762][ T4151] bridge0: port 2(bridge_slave_1) entered blocking state [ 280.200226][ T4151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 280.782603][ T5834] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 280.990053][ T5834] usb 3-1: Using ep0 maxpacket: 16 [ 281.008994][ T5834] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 281.045066][ T5834] usb 3-1: config 0 has no interface number 0 [ 281.110687][ T5834] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 281.145458][ T5834] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.176180][ T5834] usb 3-1: Product: syz [ 281.180561][ T5834] usb 3-1: Manufacturer: syz [ 281.212098][ T5834] usb 3-1: SerialNumber: syz [ 281.254825][ T5834] usb 3-1: config 0 descriptor?? [ 281.302349][ T5834] hub 3-1:0.132: bad descriptor, ignoring hub [ 281.308641][ T5834] hub 3-1:0.132: probe with driver hub failed with error -5 [ 281.436536][ T5834] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input7 [ 281.462568][ T6537] netlink: 64 bytes leftover after parsing attributes in process `syz.5.136'. [ 281.592868][ T6539] netlink: 40 bytes leftover after parsing attributes in process `syz.4.137'. [ 282.807460][ T6394] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 282.899425][ T6558] netlink: 8 bytes leftover after parsing attributes in process `syz.5.140'. [ 283.240879][ T5833] usb 3-1: USB disconnect, device number 10 [ 284.022019][ T5833] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 284.239898][ T5833] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 284.274853][ T5833] usb 3-1: config 0 has no interface number 0 [ 284.281164][ T5833] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 284.358071][ T5833] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 284.400264][ T5833] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 284.435688][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 284.461493][ T5833] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 284.483157][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 284.492448][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 284.526364][ T5833] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 284.596134][ T5833] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 284.621043][ T5833] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.678242][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 284.680232][ T5833] usb 3-1: config 0 descriptor?? [ 284.706950][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 284.715539][ T6566] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 284.753698][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 284.757354][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 284.801885][ T5833] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 284.802402][ T10] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 284.861923][ T10] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 284.916814][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 284.998818][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 285.044626][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 285.111987][ T10] usb 6-1: SerialNumber: syz [ 285.163643][ T795] usb 3-1: USB disconnect, device number 11 [ 285.174244][ T10] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 285.272346][ T795] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 285.857041][ T6394] veth0_vlan: entered promiscuous mode [ 286.136445][ T6394] veth1_vlan: entered promiscuous mode [ 286.318930][ T6589] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 286.363282][ T6589] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 286.664758][ T6394] veth0_macvtap: entered promiscuous mode [ 286.906704][ T6394] veth1_macvtap: entered promiscuous mode [ 287.444892][ T5833] usb 6-1: USB disconnect, device number 2 [ 287.859765][ T6394] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 287.921725][ T5784] Bluetooth: hci1: command 0x0406 tx timeout [ 287.924709][ T5777] Bluetooth: hci2: command 0x0406 tx timeout [ 288.069942][ T6394] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 288.343657][ T12] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.493282][ T12] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.591631][ T12] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.634323][ T12] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 288.666944][ T6607] netlink: 40 bytes leftover after parsing attributes in process `syz.2.147'. [ 289.579367][ T6617] netlink: 8 bytes leftover after parsing attributes in process `syz.2.150'. [ 289.874126][ T795] kernel write not supported for file /dsp1 (pid: 795 comm: kworker/0:2) [ 291.181614][ T795] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 291.383320][ T795] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 291.441537][ T795] usb 5-1: config 0 has no interface number 0 [ 291.447868][ T795] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 291.549560][ T795] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 291.628340][ T795] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 291.691537][ T795] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 291.770388][ T795] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 291.838776][ T795] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 291.886003][ T795] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.967587][ T795] usb 5-1: config 0 descriptor?? [ 292.019733][ T6627] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 292.085511][ T795] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 292.459691][ C0] ldusb 5-1:0.55: usb_submit_urb failed (-1) [ 292.481065][ T5833] usb 5-1: USB disconnect, device number 8 [ 292.566283][ T5833] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 297.849720][ T6674] netlink: 40 bytes leftover after parsing attributes in process `syz.6.159'. [ 299.252938][ T6688] netlink: 'syz.4.162': attribute type 13 has an invalid length. [ 300.462311][ T665] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 300.470334][ T665] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 300.989695][ T6692] 9p: Bad value for 'rfdno' [ 301.039779][ T665] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.101684][ T665] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.977554][ T6696] Illegal XDP return value 128 on prog (id 5) dev syz_tun, expect packet loss! [ 303.115141][ T5833] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 303.320476][ T6709] netlink: 'syz.5.166': attribute type 13 has an invalid length. [ 303.401184][ T5833] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 303.463556][ T5833] usb 5-1: config 0 has no interface number 0 [ 303.484723][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 303.566929][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 303.672307][ T5833] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 303.747623][ T5833] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 303.815827][ T5833] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 303.906782][ T5833] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 303.950015][ T6705] netlink: 8 bytes leftover after parsing attributes in process `syz.5.166'. [ 303.959420][ T5833] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.036424][ T5833] usb 5-1: config 0 descriptor?? [ 304.062479][ T6703] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 304.189175][ T5833] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 305.107468][ T795] usb 5-1: USB disconnect, device number 9 [ 305.202853][ T795] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 305.489683][ T6724] netlink: 40 bytes leftover after parsing attributes in process `syz.7.170'. [ 306.784503][ T6735] 9p: Bad value for 'rfdno' [ 306.785163][ T6732] netlink: 'syz.4.172': attribute type 13 has an invalid length. [ 307.909810][ T6742] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 308.097855][ T5427] netdevsim netdevsim3 eth10: default qdisc (pfifo_fast) fail, fallback to noqueue [ 308.922814][ T49] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 308.945266][ T49] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 308.993653][ T49] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 309.026335][ T49] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 309.066602][ T49] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 311.121605][ T49] Bluetooth: hci3: command tx timeout [ 311.712261][ T6769] netlink: 40 bytes leftover after parsing attributes in process `syz.7.181'. [ 312.927964][ T795] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 312.930338][ T6781] netlink: 'syz.7.183': attribute type 13 has an invalid length. [ 312.984575][ T6747] chnl_net:caif_netlink_parms(): no params data found [ 313.202495][ T49] Bluetooth: hci3: command tx timeout [ 313.228561][ T665] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 313.237331][ T6780] netlink: 8 bytes leftover after parsing attributes in process `syz.7.183'. [ 313.243429][ T795] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 313.243551][ T795] usb 5-1: config 0 has no interface number 0 [ 313.243662][ T795] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 313.243783][ T795] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 313.243927][ T795] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 313.244068][ T795] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 313.244209][ T795] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 313.244426][ T795] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 313.366941][ T6786] 9p: Bad value for 'rfdno' [ 313.637253][ T795] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 313.698650][ T795] usb 5-1: config 0 descriptor?? [ 313.824959][ T6776] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 313.887516][ T795] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 314.112262][ T795] usb 5-1: USB disconnect, device number 10 [ 314.203455][ T795] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 315.253911][ T6802] netlink: 'syz.4.187': attribute type 13 has an invalid length. [ 315.282751][ T49] Bluetooth: hci3: command tx timeout [ 315.768224][ T665] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.264028][ T6810] Zero length message leads to an empty skb [ 317.328602][ T665] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.803098][ T49] Bluetooth: hci3: command tx timeout [ 319.586391][ T665] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.296661][ T6819] netlink: 64 bytes leftover after parsing attributes in process `syz.4.191'. [ 321.419892][ T665] bridge_slave_1: left allmulticast mode [ 321.506872][ T665] bridge_slave_1: left promiscuous mode [ 321.580599][ T665] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.611835][ T6823] netlink: 40 bytes leftover after parsing attributes in process `syz.7.192'. [ 321.867029][ T665] bridge_slave_0: left allmulticast mode [ 321.903979][ T665] bridge_slave_0: left promiscuous mode [ 321.982429][ T665] bridge0: port 1(bridge_slave_0) entered disabled state [ 322.737104][ T6829] 9p: Bad value for 'wfdno' [ 324.350672][ T665] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 324.536814][ T665] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 324.705076][ T665] bond0 (unregistering): Released all slaves [ 325.569234][ T6747] bridge0: port 1(bridge_slave_0) entered blocking state [ 325.602553][ T24] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 325.637604][ T6747] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.834213][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 326.840806][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 327.245707][ T24] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 327.262423][ T6747] bridge_slave_0: entered allmulticast mode [ 328.288643][ T24] usb 6-1: config 0 has no interface number 0 [ 328.313502][ T6747] bridge_slave_0: entered promiscuous mode [ 328.921719][ T24] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 328.951462][ T24] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 328.960072][ T6747] bridge0: port 2(bridge_slave_1) entered blocking state [ 328.986362][ T24] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 329.030537][ T24] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 329.071470][ T24] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 329.182306][ T6747] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.208087][ T6747] bridge_slave_1: entered allmulticast mode [ 329.279194][ T6747] bridge_slave_1: entered promiscuous mode [ 329.285765][ T24] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 329.453587][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.541213][ T24] usb 6-1: config 0 descriptor?? [ 329.561922][ T24] usb 6-1: can't set config #0, error -71 [ 329.615800][ T24] usb 6-1: USB disconnect, device number 3 [ 329.678542][ T6852] usb usb8: usbfs: process 6852 (syz.6.199) did not claim interface 0 before use [ 329.798695][ T6855] netlink: 'syz.7.198': attribute type 13 has an invalid length. [ 329.975910][ T6860] netlink: 'syz.5.200': attribute type 13 has an invalid length. [ 330.169487][ T6856] netlink: 8 bytes leftover after parsing attributes in process `syz.5.200'. [ 330.199832][ T6747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 330.209372][ T6850] netlink: 8 bytes leftover after parsing attributes in process `syz.7.198'. [ 331.329674][ T6747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 331.343186][ T6866] netlink: 64 bytes leftover after parsing attributes in process `syz.6.202'. [ 331.633983][ T5427] netdevsim netdevsim3 eth11: default qdisc (pfifo_fast) fail, fallback to noqueue [ 332.231540][ T665] hsr_slave_0: left promiscuous mode [ 332.277285][ T665] hsr_slave_1: left promiscuous mode [ 332.303844][ T665] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 332.361616][ T665] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 332.383543][ T665] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 332.411906][ T6874] capability: warning: `syz.7.204' uses deprecated v2 capabilities in a way that may be insecure [ 332.441581][ T665] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 332.551007][ T665] veth1_macvtap: left promiscuous mode [ 332.589429][ T665] veth0_macvtap: left promiscuous mode [ 332.621863][ T665] veth1_vlan: left promiscuous mode [ 332.656206][ T665] veth0_vlan: left promiscuous mode [ 332.699266][ T6877] 9p: Bad value for 'wfdno' [ 333.829087][ T6883] netlink: 40 bytes leftover after parsing attributes in process `syz.6.207'. [ 334.815568][ T665] team0 (unregistering): Port device team_slave_1 removed [ 334.912390][ T665] team0 (unregistering): Port device team_slave_0 removed [ 335.142154][ T795] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 335.337695][ T795] usb 8-1: config 0 has an invalid interface number: 55 but max is 0 [ 335.395628][ T795] usb 8-1: config 0 has no interface number 0 [ 335.415632][ T795] usb 8-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 335.464366][ T795] usb 8-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 335.514647][ T795] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 335.546893][ T795] usb 8-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 64 [ 335.576528][ T6747] team0: Port device team_slave_0 added [ 335.611807][ T795] usb 8-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 335.652415][ T6747] team0: Port device team_slave_1 added [ 335.680330][ T795] usb 8-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 335.704712][ T795] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 335.756544][ T795] usb 8-1: config 0 descriptor?? [ 335.805071][ T6887] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 335.884631][ T795] ldusb 8-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 335.997307][ T6747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.019793][ T6747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.071835][ T6747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.157129][ T795] usb 8-1: USB disconnect, device number 2 [ 336.180201][ T795] ldusb 8-1:0.55: LD USB Device #0 now disconnected [ 336.194214][ T6747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.250703][ T6747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.355695][ T6747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 336.780573][ T6747] hsr_slave_0: entered promiscuous mode [ 336.819239][ T6747] hsr_slave_1: entered promiscuous mode [ 336.884598][ T6747] debugfs: 'hsr0' already exists in 'hsr' [ 336.890501][ T6747] Cannot create hsr debugfs directory [ 337.250877][ T6897] netlink: 'syz.6.212': attribute type 13 has an invalid length. [ 337.366269][ T6901] netlink: 'syz.7.213': attribute type 13 has an invalid length. [ 337.558092][ T6893] netlink: 8 bytes leftover after parsing attributes in process `syz.6.212'. [ 337.673361][ T6896] netlink: 8 bytes leftover after parsing attributes in process `syz.7.213'. [ 340.468995][ T6913] 9p: Bad value for 'wfdno' [ 340.695320][ T6747] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 340.811483][ T6747] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 340.907308][ T6747] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 340.997422][ T6747] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 342.168733][ T6920] capability: warning: `syz.5.218' uses 32-bit capabilities (legacy support in use) [ 342.508385][ T6927] netlink: 40 bytes leftover after parsing attributes in process `syz.6.220'. [ 343.024956][ T6747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.363258][ T6747] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.455808][ T665] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.463340][ T665] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.966743][ T665] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.974756][ T665] bridge0: port 2(bridge_slave_1) entered forwarding state [ 345.989727][ T6943] netlink: 'syz.4.223': attribute type 13 has an invalid length. [ 346.578644][ T6945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.223'. [ 348.296566][ T6747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 349.000925][ T6949] netlink: 'syz.4.224': attribute type 13 has an invalid length. [ 349.337345][ T6951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.224'. [ 349.363270][ T5783] Bluetooth: hci5: command 0x0406 tx timeout [ 352.024805][ T795] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 352.215074][ T795] usb 8-1: Using ep0 maxpacket: 32 [ 352.334960][ T795] usb 8-1: unable to get BOS descriptor or descriptor too short [ 352.379696][ T6747] veth0_vlan: entered promiscuous mode [ 352.425237][ T795] usb 8-1: config 0 has no interfaces? [ 352.503237][ T795] usb 8-1: language id specifier not provided by device, defaulting to English [ 352.595717][ T6747] veth1_vlan: entered promiscuous mode [ 352.618467][ T795] usb 8-1: New USB device found, idVendor=0bb4, idProduct=0a83, bcdDevice= d.65 [ 352.639528][ T795] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.660457][ T795] usb 8-1: Product: syz [ 352.675402][ T795] usb 8-1: Manufacturer: 龷鑏橂㔬ᑇ혹괢 [ 352.703729][ T795] usb 8-1: SerialNumber: syz [ 352.736322][ T795] usb 8-1: config 0 descriptor?? [ 352.994862][ T795] usb 8-1: USB disconnect, device number 3 [ 353.323042][ T6747] veth0_macvtap: entered promiscuous mode [ 353.431099][ T6747] veth1_macvtap: entered promiscuous mode [ 353.869524][ T6747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 354.070183][ T6747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 354.317611][ T4157] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.347986][ T4157] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.410931][ T4157] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.446123][ T4157] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 354.481672][ T5783] Bluetooth: hci6: command 0x0406 tx timeout [ 355.010330][ T5427] netdevsim netdevsim3 eth12: default qdisc (pfifo_fast) fail, fallback to noqueue [ 359.462559][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 359.493824][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 359.504952][ T5783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 359.518013][ T5783] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 359.537670][ T5783] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 361.694834][ T5783] Bluetooth: hci1: command tx timeout [ 361.915816][ T7004] chnl_net:caif_netlink_parms(): no params data found [ 363.116538][ T49] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 363.153923][ T49] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 363.164492][ T49] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 363.177383][ T49] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 363.187159][ T49] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 363.736647][ T665] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 363.786058][ T5783] Bluetooth: hci1: command tx timeout [ 363.821427][ T665] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 364.283781][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 364.334376][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 365.237628][ T7004] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.292875][ T5783] Bluetooth: hci4: command tx timeout [ 365.322802][ T7004] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.330329][ T7004] bridge_slave_0: entered allmulticast mode [ 365.374818][ T7004] bridge_slave_0: entered promiscuous mode [ 365.673372][ T7004] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.810859][ T7004] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.851686][ T5783] Bluetooth: hci1: command tx timeout [ 365.937930][ T7004] bridge_slave_1: entered allmulticast mode [ 365.982688][ T7004] bridge_slave_1: entered promiscuous mode [ 367.049261][ T7004] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 367.378444][ T5783] Bluetooth: hci4: command tx timeout [ 367.500755][ T3473] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.677501][ T7004] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 367.931708][ T5783] Bluetooth: hci1: command tx timeout [ 368.415129][ T3473] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.610314][ T7025] chnl_net:caif_netlink_parms(): no params data found [ 368.767659][ T7004] team0: Port device team_slave_0 added [ 368.996174][ T3473] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.282750][ T7004] team0: Port device team_slave_1 added [ 369.441848][ T5783] Bluetooth: hci4: command tx timeout [ 369.614275][ T3473] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.146081][ T7004] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 370.248738][ T49] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 370.259873][ T49] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 370.268927][ T49] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 370.286253][ T7004] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.332640][ T49] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 370.351486][ T49] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 370.359048][ T7004] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 370.425212][ T7004] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 370.440991][ T7004] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 370.505455][ T7004] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 371.533108][ T49] Bluetooth: hci4: command tx timeout [ 372.040062][ T7004] hsr_slave_0: entered promiscuous mode [ 372.104322][ T7004] hsr_slave_1: entered promiscuous mode [ 372.162537][ T7004] debugfs: 'hsr0' already exists in 'hsr' [ 372.168380][ T7004] Cannot create hsr debugfs directory [ 372.482690][ T49] Bluetooth: hci5: command tx timeout [ 373.484607][ T3473] bridge_slave_1: left allmulticast mode [ 373.490437][ T3473] bridge_slave_1: left promiscuous mode [ 373.579192][ T3473] bridge0: port 2(bridge_slave_1) entered disabled state [ 373.650453][ T3473] bridge_slave_0: left allmulticast mode [ 373.664599][ T3473] bridge_slave_0: left promiscuous mode [ 373.677165][ T3473] bridge0: port 1(bridge_slave_0) entered disabled state [ 374.561560][ T49] Bluetooth: hci5: command tx timeout [ 374.918808][ T3473] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 375.003195][ T3473] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 375.131834][ T3473] bond0 (unregistering): Released all slaves [ 375.580594][ T5427] netdevsim netdevsim2 eth13: default qdisc (pfifo_fast) fail, fallback to noqueue [ 376.117066][ T7025] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.150951][ T7025] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.171880][ T7025] bridge_slave_0: entered allmulticast mode [ 376.195307][ T7025] bridge_slave_0: entered promiscuous mode [ 376.613873][ T7025] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.641748][ T49] Bluetooth: hci5: command tx timeout [ 376.646956][ T7025] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.707187][ T7025] bridge_slave_1: entered allmulticast mode [ 376.756560][ T7025] bridge_slave_1: entered promiscuous mode [ 377.764890][ T7025] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 377.913114][ T3473] hsr_slave_0: left promiscuous mode [ 377.945345][ T3473] hsr_slave_1: left promiscuous mode [ 377.972971][ T3473] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 377.989725][ T3473] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 378.035003][ T3473] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 378.090847][ T3473] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 378.130506][ T3473] veth1_macvtap: left promiscuous mode [ 378.137049][ T3473] veth0_macvtap: left promiscuous mode [ 378.156112][ T3473] veth1_vlan: left promiscuous mode [ 378.182606][ T3473] veth0_vlan: left promiscuous mode [ 378.721893][ T49] Bluetooth: hci5: command tx timeout [ 379.788371][ T3473] team0 (unregistering): Port device team_slave_1 removed [ 379.824422][ T3473] team0 (unregistering): Port device team_slave_0 removed [ 380.137562][ T7025] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 380.194500][ T5427] netdevsim netdevsim2 eth14: default qdisc (pfifo_fast) fail, fallback to noqueue [ 380.909486][ T7025] team0: Port device team_slave_0 added [ 380.977789][ T7025] team0: Port device team_slave_1 added [ 381.388161][ T7004] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 381.435566][ T7055] chnl_net:caif_netlink_parms(): no params data found [ 381.500022][ T7025] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 381.521876][ T7025] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.581736][ T7025] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 381.672964][ T7025] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 381.680075][ T7025] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 381.781526][ T7025] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 381.878660][ T7004] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 382.009223][ T35] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.066639][ T7004] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 382.249124][ T35] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.347207][ T7004] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 382.603834][ T7138] overlayfs: failed to resolve './file1': -2 [ 382.810761][ T35] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.948916][ T7025] hsr_slave_0: entered promiscuous mode [ 382.994318][ T7025] hsr_slave_1: entered promiscuous mode [ 383.023500][ T7025] debugfs: 'hsr0' already exists in 'hsr' [ 383.029398][ T7025] Cannot create hsr debugfs directory [ 383.258718][ T5427] netdevsim netdevsim2 eth15: default qdisc (pfifo_fast) fail, fallback to noqueue [ 383.353778][ T35] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.215871][ T5783] Bluetooth: hci0: command 0x0406 tx timeout [ 385.544207][ T7055] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.557198][ T7055] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.569682][ T7055] bridge_slave_0: entered allmulticast mode [ 385.594851][ T7055] bridge_slave_0: entered promiscuous mode [ 385.653048][ T7055] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.679950][ T7055] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.721097][ T7055] bridge_slave_1: entered allmulticast mode [ 385.768604][ T7055] bridge_slave_1: entered promiscuous mode [ 385.817000][ T7164] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 386.398542][ T35] bridge_slave_1: left allmulticast mode [ 386.426974][ T35] bridge_slave_1: left promiscuous mode [ 386.438358][ T35] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.473543][ T35] bridge_slave_0: left allmulticast mode [ 386.479301][ T35] bridge_slave_0: left promiscuous mode [ 386.496639][ T35] bridge0: port 1(bridge_slave_0) entered disabled state [ 387.619917][ T35] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 387.695542][ T35] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 387.740951][ T35] bond0 (unregistering): Released all slaves [ 388.045777][ T7055] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 388.266865][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 388.273617][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 388.888313][ T7055] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 389.096019][ T5427] netdevsim netdevsim2 eth16: default qdisc (pfifo_fast) fail, fallback to noqueue [ 390.149276][ T7055] team0: Port device team_slave_0 added [ 390.213336][ T7055] team0: Port device team_slave_1 added [ 390.474655][ T35] hsr_slave_0: left promiscuous mode [ 390.488001][ T35] hsr_slave_1: left promiscuous mode [ 390.499145][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 390.532110][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 390.559569][ T35] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 390.581589][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 390.658957][ T35] veth1_macvtap: left promiscuous mode [ 390.678156][ T35] veth0_macvtap: left promiscuous mode [ 390.702436][ T35] veth1_vlan: left promiscuous mode [ 390.707971][ T35] veth0_vlan: left promiscuous mode [ 392.089742][ T7189] overlayfs: failed to resolve './file1': -2 [ 392.121730][ T35] team0 (unregistering): Port device team_slave_1 removed [ 392.224508][ T35] team0 (unregistering): Port device team_slave_0 removed [ 392.806844][ T7055] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 392.836602][ T7055] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 392.925222][ T7055] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 392.997903][ T7055] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 393.019402][ T7055] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 393.065010][ T7055] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 393.655622][ T7025] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 393.738888][ T7025] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 393.869628][ T7055] hsr_slave_0: entered promiscuous mode [ 393.912863][ T7055] hsr_slave_1: entered promiscuous mode [ 393.944469][ T7055] debugfs: 'hsr0' already exists in 'hsr' [ 393.950361][ T7055] Cannot create hsr debugfs directory [ 394.000706][ T7004] 8021q: adding VLAN 0 to HW filter on device bond0 [ 394.025046][ T7025] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 394.093591][ T7025] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 394.526190][ T7004] 8021q: adding VLAN 0 to HW filter on device team0 [ 394.682834][ T53] bridge0: port 1(bridge_slave_0) entered blocking state [ 394.690146][ T53] bridge0: port 1(bridge_slave_0) entered forwarding state [ 394.871068][ T53] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.878531][ T53] bridge0: port 2(bridge_slave_1) entered forwarding state [ 396.623851][ T7025] 8021q: adding VLAN 0 to HW filter on device bond0 [ 396.969510][ T7025] 8021q: adding VLAN 0 to HW filter on device team0 [ 397.018878][ T7055] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 397.084815][ T7055] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 397.188305][ T6812] bridge0: port 1(bridge_slave_0) entered blocking state [ 397.195984][ T6812] bridge0: port 1(bridge_slave_0) entered forwarding state [ 397.252304][ T7055] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 397.327819][ T7055] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 397.504459][ T6812] bridge0: port 2(bridge_slave_1) entered blocking state [ 397.511927][ T6812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 398.990339][ T7004] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 399.404613][ T7055] 8021q: adding VLAN 0 to HW filter on device bond0 [ 399.779980][ T7055] 8021q: adding VLAN 0 to HW filter on device team0 [ 399.896741][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.904336][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.046399][ T6812] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.053981][ T6812] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.421560][ T10] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 400.617441][ T10] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.638743][ T7025] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.661447][ T10] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 400.670754][ T10] usb 9-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 400.730768][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.768625][ T10] usb 9-1: config 0 descriptor?? [ 401.385111][ T7025] veth0_vlan: entered promiscuous mode [ 401.489792][ T7004] veth0_vlan: entered promiscuous mode [ 401.608374][ T7025] veth1_vlan: entered promiscuous mode [ 401.770242][ T7004] veth1_vlan: entered promiscuous mode [ 402.120164][ T7055] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.175734][ T7025] veth0_macvtap: entered promiscuous mode [ 402.267826][ T7025] veth1_macvtap: entered promiscuous mode [ 402.317248][ T7004] veth0_macvtap: entered promiscuous mode [ 402.367873][ T7004] veth1_macvtap: entered promiscuous mode [ 402.615557][ T7025] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 402.766792][ T7025] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 402.860136][ T7004] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 402.898970][ T7055] veth0_vlan: entered promiscuous mode [ 402.906611][ T57] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.957613][ T57] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.979943][ T57] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.028235][ T57] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.105352][ T7055] veth1_vlan: entered promiscuous mode [ 403.166996][ T7004] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 403.285263][ T9] usb 9-1: USB disconnect, device number 2 [ 403.331578][ T4157] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.405157][ T4157] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.563874][ T4157] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.627577][ T4157] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.979239][ T7055] veth0_macvtap: entered promiscuous mode [ 404.106545][ T7055] veth1_macvtap: entered promiscuous mode [ 404.666659][ T7055] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 405.019402][ T7055] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 405.189256][ T4157] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.272167][ T4157] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.308733][ T4157] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 405.370205][ T4157] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 407.563358][ T7257] overlayfs: failed to resolve './file1': -2 [ 413.316669][ T5833] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 413.445493][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.458533][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.538541][ T5833] usb 9-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 413.559875][ T5833] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.652298][ T5833] usb 9-1: config 0 descriptor?? [ 413.759316][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.801658][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 413.933863][ T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 413.966707][ T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.225284][ T4157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.271840][ T4157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.628065][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 414.687625][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 414.979794][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.016406][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.707551][ T7334] netlink: 40 bytes leftover after parsing attributes in process `syz.9.230'. [ 416.102117][ T10] usb 9-1: USB disconnect, device number 3 [ 416.272602][ T7340] netlink: 'syz.1.235': attribute type 13 has an invalid length. [ 416.824533][ T7337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.235'. [ 418.846112][ T7364] syzkaller0: entered promiscuous mode [ 418.897185][ T7364] syzkaller0: entered allmulticast mode [ 419.521622][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 419.799339][ T9] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 419.839979][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.893265][ T9] usb 1-1: Product: syz [ 419.914705][ T9] usb 1-1: Manufacturer: syz [ 419.941972][ T9] usb 1-1: SerialNumber: syz [ 419.977882][ T9] usb 1-1: config 0 descriptor?? [ 420.454280][ T9] usb 1-1: Firmware: major: 236, minor: 109, hardware type: UNKNOWN (126) [ 420.708203][ T9] usb 1-1: no permanent extended address found, random address set [ 421.078565][ T9] usb 1-1: atusb_probe: initialization failed, error = -524 [ 421.106731][ T9] atusb 1-1:0.0: probe with driver atusb failed with error -524 [ 421.263538][ T9] usb 1-1: USB disconnect, device number 2 [ 421.554187][ T5833] usb 9-1: new full-speed USB device number 4 using dummy_hcd [ 421.815833][ T5833] usb 9-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 421.891005][ T5833] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.974066][ T5833] usb 9-1: config 0 descriptor?? [ 422.469406][ T5833] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 422.692556][ T5833] usb 1-1: Using ep0 maxpacket: 32 [ 422.732865][ T5833] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 422.781680][ T5833] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.874210][ T5833] usb 1-1: config 0 descriptor?? [ 423.125281][ T5833] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 423.214004][ T5833] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 423.308988][ T5833] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 423.332881][ T7392] ===================================================== [ 423.345260][ T7392] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 [ 423.352793][ T7392] _copy_to_user+0xcc/0x120 [ 423.357452][ T7392] i2cdev_ioctl_smbus+0x586/0x660 [ 423.362882][ T7392] compat_i2cdev_ioctl+0x48f/0xb40 [ 423.368151][ T7392] __ia32_compat_sys_ioctl+0x7f9/0x1270 [ 423.374446][ T7392] ia32_sys_call+0x2854/0x4360 [ 423.379390][ T7392] __do_fast_syscall_32+0x17f/0x3f0 [ 423.385012][ T7392] do_fast_syscall_32+0x37/0x80 [ 423.389941][ T7392] do_SYSENTER_32+0x1f/0x30 [ 423.394623][ T7392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 423.401063][ T7392] [ 423.403766][ T7392] Uninit was stored to memory at: [ 423.408920][ T7392] __i2c_smbus_xfer+0x25b3/0x3120 [ 423.414245][ T7392] i2c_smbus_xfer+0x2d8/0x480 [ 423.419043][ T7392] i2cdev_ioctl_smbus+0x4a1/0x660 [ 423.425376][ T7392] compat_i2cdev_ioctl+0x48f/0xb40 [ 423.430570][ T7392] __ia32_compat_sys_ioctl+0x7f9/0x1270 [ 423.436767][ T7392] ia32_sys_call+0x2854/0x4360 [ 423.442456][ T7392] __do_fast_syscall_32+0x17f/0x3f0 [ 423.447745][ T7392] do_fast_syscall_32+0x37/0x80 [ 423.452845][ T7392] do_SYSENTER_32+0x1f/0x30 [ 423.457486][ T7392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 423.464096][ T7392] [ 423.466480][ T7392] Local variable msgbuf1.i created at: [ 423.472124][ T7392] __i2c_smbus_xfer+0x853/0x3120 [ 423.477225][ T7392] i2c_smbus_xfer+0x2d8/0x480 [ 423.482220][ T7392] [ 423.484602][ T7392] Byte 0 of 1 is uninitialized [ 423.489445][ T7392] Memory access of size 1 starts at ffff8880500cbc76 [ 423.496376][ T7392] Data copied to user address 0000000080000080 [ 423.502762][ T7392] [ 423.505148][ T7392] CPU: 0 UID: 0 PID: 7392 Comm: syz.0.282 Not tainted syzkaller #0 PREEMPT(full) [ 423.514558][ T7392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 423.525995][ T7392] ===================================================== [ 423.533646][ T7392] Disabling lock debugging due to kernel taint SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 423.614097][ T5833] usb 1-1: media controller created [ 423.870405][ T7392] Kernel panic - not syncing: kmsan.panic set ... [ 423.876994][ T7392] CPU: 0 UID: 0 PID: 7392 Comm: syz.0.282 Tainted: G B syzkaller #0 PREEMPT(full) [ 423.887923][ T7392] Tainted: [B]=BAD_PAGE [ 423.892146][ T7392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 423.902309][ T7392] Call Trace: [ 423.905676][ T7392] [ 423.908674][ T7392] __dump_stack+0x26/0x30 [ 423.913155][ T7392] dump_stack_lvl+0x50/0x1c0 [ 423.917893][ T7392] ? dump_stack+0x12/0x25 [ 423.922373][ T7392] dump_stack+0x1e/0x25 [ 423.926663][ T7392] vpanic+0x7b4/0x1430 [ 423.930908][ T7392] panic+0x15d/0x160 [ 423.935002][ T7392] kmsan_report+0x31a/0x320 [ 423.939691][ T7392] ? kmsan_internal_check_memory+0x1e8/0x240 [ 423.945871][ T7392] ? kmsan_copy_to_user+0xef/0x190 [ 423.951154][ T7392] ? _copy_to_user+0xcc/0x120 [ 423.955957][ T7392] ? i2cdev_ioctl_smbus+0x586/0x660 [ 423.961297][ T7392] ? compat_i2cdev_ioctl+0x48f/0xb40 [ 423.966730][ T7392] ? __ia32_compat_sys_ioctl+0x7f9/0x1270 [ 423.972619][ T7392] ? ia32_sys_call+0x2854/0x4360 [ 423.977676][ T7392] ? __do_fast_syscall_32+0x17f/0x3f0 [ 423.983184][ T7392] ? do_fast_syscall_32+0x37/0x80 [ 423.988349][ T7392] ? do_SYSENTER_32+0x1f/0x30 [ 423.993151][ T7392] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 423.999815][ T7392] ? __pfx_az6027_i2c_xfer+0x10/0x10 [ 424.005339][ T7392] ? __pfx_az6027_i2c_xfer+0x10/0x10 [ 424.010751][ T7392] ? __i2c_transfer+0x1179/0x3280 [ 424.015909][ T7392] ? kmsan_get_metadata+0xf1/0x160 [ 424.021196][ T7392] ? kmsan_internal_set_shadow_origin+0x7a/0x110 [ 424.027705][ T7392] ? kmsan_get_metadata+0xf1/0x160 [ 424.032985][ T7392] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 424.038975][ T7392] ? __i2c_smbus_xfer+0x1f6c/0x3120 [ 424.044350][ T7392] ? kmsan_get_metadata+0xf1/0x160 [ 424.049636][ T7392] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 424.055634][ T7392] kmsan_internal_check_memory+0x1e8/0x240 [ 424.061625][ T7392] kmsan_copy_to_user+0xef/0x190 [ 424.066735][ T7392] _copy_to_user+0xcc/0x120 [ 424.071380][ T7392] i2cdev_ioctl_smbus+0x586/0x660 [ 424.076569][ T7392] compat_i2cdev_ioctl+0x48f/0xb40 [ 424.081843][ T7392] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 424.087619][ T7392] __ia32_compat_sys_ioctl+0x7f9/0x1270 [ 424.093341][ T7392] ? fpregs_restore_userregs+0x213/0x3e0 [ 424.099234][ T7392] ? kmsan_get_metadata+0xf1/0x160 [ 424.104529][ T7392] ? kmsan_get_metadata+0xf1/0x160 [ 424.109826][ T7392] ia32_sys_call+0x2854/0x4360 [ 424.114717][ T7392] __do_fast_syscall_32+0x17f/0x3f0 [ 424.120079][ T7392] do_fast_syscall_32+0x37/0x80 [ 424.125082][ T7392] do_SYSENTER_32+0x1f/0x30 [ 424.129744][ T7392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 424.136266][ T7392] RIP: 0023:0xf707ef6c [ 424.140480][ T7392] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 424.160251][ T7392] RSP: 002b:00000000f546d50c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 424.168838][ T7392] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000720 [ 424.176909][ T7392] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 424.184971][ T7392] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 424.193032][ T7392] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 424.201089][ T7392] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 424.209184][ T7392] [ 424.212575][ T7392] Kernel Offset: disabled [ 424.216944][ T7392] Rebooting in 86400 seconds..