last executing test programs: 11m15.168417956s ago: executing program 1 (id=246): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) syz_emit_ethernet(0x4c, &(0x7f0000000b00)={@link_local, @random="ece61fbcee55", @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0x0, @remote, @local, {[], {0x3, 0xe22, 0x16, 0x0, @gue={{0x2, 0x0, 0x2, 0x7}, "2844e6dfbfc1"}}}}}}}, 0x0) 11m14.804074136s ago: executing program 1 (id=252): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) close(0x3) 11m14.63389209s ago: executing program 1 (id=255): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0x0, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty, 0x101}, 0x1c) 11m14.457826601s ago: executing program 1 (id=257): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000340)=@abs={0x1, 0x0, 0x104e22}, 0x6e) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000002c0)=0x20) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 11m14.346322123s ago: executing program 1 (id=258): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) setgid(0x0) chmod(0x0, 0x0) 11m13.472650106s ago: executing program 1 (id=266): syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x60004400, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = getpgid(0x0) r1 = syz_pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x11, 0x0, 0x4) 11m12.907309631s ago: executing program 32 (id=266): syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x60004400, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = getpgid(0x0) r1 = syz_pidfd_open(r0, 0x0) pidfd_send_signal(r1, 0x11, 0x0, 0x4) 10m38.112300046s ago: executing program 5 (id=611): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000fedbdf2531000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 10m37.926779052s ago: executing program 5 (id=614): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000019080)='./file0\x00', 0x0, 0x23010, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)={[&(0x7f0000000100)=' ']}, 0x0) 10m37.234039277s ago: executing program 5 (id=616): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000001c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x7ffffffe, 0x0, 0x0) 10m37.100812858s ago: executing program 5 (id=618): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'sit0\x00', 0x0}) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 10m35.160062368s ago: executing program 5 (id=633): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x10, 0xffffffff) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./file7\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file3\x00', 0x0) 10m34.87155161s ago: executing program 5 (id=644): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x1, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) tkill(r0, 0x18) 10m19.592153653s ago: executing program 33 (id=644): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x1, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x0) tkill(r0, 0x18) 9m52.837842888s ago: executing program 6 (id=884): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) execve(&(0x7f00000190c0)='./file0\x00', 0x0, 0x0) mount(0x0, &(0x7f0000019080)='./file0\x00', 0x0, 0x23010, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)={[&(0x7f0000000100)=' ']}, 0x0) 9m52.689436357s ago: executing program 6 (id=885): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x38, r1, 0x5, 0x70bd2b, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x38}}, 0x0) 9m52.204317195s ago: executing program 6 (id=890): recvmmsg(0xffffffffffffffff, &(0x7f000000ab40)=[{{&(0x7f00000003c0)=@l2={0x1f, 0x0, @none}, 0x80, 0x0}, 0x8}, {{&(0x7f0000000a00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, 0x0}, 0x7}], 0x2, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x1, @rand_addr=0x64010101}, 0xa, 0x0, 0x800}}, 0x26) sendmmsg$inet(r1, &(0x7f0000005f80)=[{{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000010c0)="7d5107673289eeae3f806c5c62db497a0299399ab6101c3b", 0x1}], 0x1}}], 0x4000000000001ce, 0x8040) 9m51.704580024s ago: executing program 6 (id=894): r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x183822, 0x0) r1 = syz_io_uring_setup(0xcd, &(0x7f0000000480)={0x0, 0x0, 0x800, 0x0, 0xd9}, &(0x7f0000000000)=0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0x0, &(0x7f0000000100)=[{0x0}, {&(0x7f0000000280)=""/173, 0xad}], 0x2}) io_uring_enter(r1, 0x47ba, 0x0, 0x0, 0x0, 0x0) 9m51.320245748s ago: executing program 6 (id=898): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x10, 0xffffffff) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./file7\x00', 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8}) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file3\x00', 0x0) 9m51.131983608s ago: executing program 6 (id=900): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) close(r0) 9m35.960465221s ago: executing program 34 (id=900): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)) close(r0) 7m16.172503898s ago: executing program 0 (id=2286): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000080)=',\xea\x00', 0x4) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000180)={0x3, 0x10, 0xd39, 0x800}) ftruncate(r0, 0x7000000) r1 = dup(r0) preadv2(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/83, 0x200000}], 0x1000000000000146, 0x3700, 0x0, 0x0) 7m15.764680776s ago: executing program 0 (id=2293): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000005b00000000000000", @ANYRES32, @ANYBLOB="04"], 0x50) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000026000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r2}, &(0x7f00000000c0), &(0x7f0000000240)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f0000000380)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000740)={r3, &(0x7f00000006c0)}, 0x20) 7m15.569304069s ago: executing program 0 (id=2297): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000080009000200000008000b"], 0x24}}, 0x0) 7m15.341348645s ago: executing program 3 (id=2301): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x300, {{@in=@multicast1=0xe0000002, @in, 0x0, 0xb, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffe}}}, 0xb8}}, 0x90) 7m15.313330106s ago: executing program 0 (id=2302): mkdir(&(0x7f0000000280)='./file0\x00', 0x324) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000001340)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00') 7m15.113762725s ago: executing program 0 (id=2305): ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af"}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000600)=[@text16={0x10, 0x0}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="040000000000000085040000000000000500"]) 7m15.082910856s ago: executing program 3 (id=2306): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000540)=@gcm_256={{0x303}, "9d11b04b95df2000", "2c9e910757c2725daf795f705aff0000000000000093a0c9001c5c65f7107d0d", "ddfb5900", "633e2c1b40238e79"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "54164ace030000f5", "faad50724acb18aba4e3bc654d684ad9c694f3e96ca4b72643dd3689727968e9", "5cb6d03a", "29a78ab9b0a4e8ae"}, 0x38) 7m14.90454818s ago: executing program 3 (id=2307): r0 = socket$rds(0x15, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) read(r0, &(0x7f0000000040)=""/80, 0x50) 7m13.772413303s ago: executing program 0 (id=2313): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x9, 0x0, 0x407}}}, 0x7) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0x0) r0 = userfaultfd(0x80001) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) io_setup(0x6bc2, 0x0) 7m13.067463395s ago: executing program 35 (id=2313): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x9, 0x0, 0x407}}}, 0x7) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0x0) r0 = userfaultfd(0x80001) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x749}) io_setup(0x6bc2, 0x0) 7m13.039923535s ago: executing program 3 (id=2320): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000000), 0x81, 0x0) 7m12.899589086s ago: executing program 3 (id=2321): r0 = socket$kcm(0xa, 0x3, 0x3a) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c010000190001000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000aa4e220000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000104000000000000feffffffffffffff030000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000008400050020010000000000000000000000000000000000002b00000000000000000000000000000000000000000500000000000002000700000000000000000000000000e00000020000000000000000000000004000000033"], 0x13c}, 0x1, 0x0, 0x0, 0x1}, 0x20040880) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x4, @loopback={0x0, 0xac14140c}, 0xff000003}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000140)="8bcd", 0x2}, {&(0x7f0000000600)="1609", 0x2}], 0x2, 0x0, 0x0, 0x900}, 0x62) 7m11.768389392s ago: executing program 3 (id=2328): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd600a2a29d6d3067b"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) 7m11.314875135s ago: executing program 36 (id=2328): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x43}, 0x94) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd600a2a29d6d3067b"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) 4.678384474s ago: executing program 2 (id=5995): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x81) r1 = socket$caif_stream(0x25, 0x1, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) close(0x3) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x58) accept4(r2, 0x0, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 4.212375276s ago: executing program 7 (id=6000): close(0x3) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @default]}, 0x48) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r1, 0x80) accept$netrom(r1, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f}, 0x0, 0x0) 3.69598462s ago: executing program 2 (id=6007): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000000000000004b64ffed850000006d000000a50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x4d, 0x1, 0x3, 0x80000000}, {0x60, 0x8}, {}, {0x2}]}) 3.249710823s ago: executing program 7 (id=6010): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="020000000400000008"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x2, 0x11, 0x4, 0x8, 0xa, 0x0, 0x70bd27, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@loopback, 0x28, 0x8, 0x18}, @sadb_address={0x3, 0x7, 0xff, 0x20, 0x0, @in={0x2, 0x4e22, @multicast1}}]}, 0x50}}, 0x10) syz_usb_connect(0x0, 0x5d, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000551b8920b822276080c20102030109024b0001000000000904000000020a0000052406000005241d00000d240f01000200000000000200072414003824d0062413"], 0x0) close(0xffffffffffffffff) syz_clone(0x4081480, 0x0, 0x0, 0x0, 0x0, 0x0) 3.016629863s ago: executing program 2 (id=6012): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_io_uring_setup(0x460, &(0x7f0000000480)={0x0, 0x40000020, 0x10, 0x2, 0x1ef}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x2f, 0x1, 0x0, 0x4}]}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0xffffffffffffff8a) 2.114790437s ago: executing program 2 (id=6017): r0 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x40}, 0x10) bind$tipc(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f00000004c0)={0x2040, 0x0, 0x1}, 0x10) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000036004b63d25a59ce0630fc60105d52d9", 0x14}], 0x1}, 0x20000040) 1.888478825s ago: executing program 8 (id=6018): setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000000000)={0x12, {{0x29, 0x0, 0xb000000, @empty}}}, 0x88) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\'\x00\x00\x00\a'], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.83049068s ago: executing program 2 (id=6019): ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x1, 0x3, 0xfffffffe, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x6, 0x2}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000020c0), 0x60081, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r0, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0xf9) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000280)=0xb3) 1.69300424s ago: executing program 9 (id=6020): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050020010000000000000000000000000000000000022b"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) 1.596011657s ago: executing program 8 (id=6021): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r2, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000004540)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @private2={0xfc, 0x2, '\x00', 0x9}, 0xa01}, 0x1c, &(0x7f0000000600)=[{0x0, 0x11}, {&(0x7f0000000d80)='Y', 0xfcd9}, {0x0}], 0x3}}], 0x1, 0x40) 1.516397103s ago: executing program 4 (id=6022): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2200890, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r1, &(0x7f0000002780)={0x2020}, 0x5ecfb203) 1.400850146s ago: executing program 8 (id=6023): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x0, 0x0, 0x0, 0x5}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000000000000000000002"]) ioctl$KVM_CAP_X2APIC_API(r1, 0x4068aea3, &(0x7f0000000100)={0x81, 0x0, 0x1}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x0, 0x9}) 1.28430662s ago: executing program 4 (id=6024): r0 = socket(0x1, 0x5, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) r1 = epoll_create1(0x80000) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000500)={0xe000200c}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f00000001c0)={0x80000002}) epoll_pwait2(r1, &(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) 1.270772665s ago: executing program 7 (id=6025): openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = syz_io_uring_setup(0x239, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x2def, 0x0, 0x0, 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x401, 0x2}, 0x2c, [0x0, 0x101, 0x0, 0xfffffffd, 0x6, 0x2, 0xfffffffc, 0x3, 0x0, 0x7fffffff, 0xfffffffe, 0xc0, 0x0, 0x0, 0x8, 0x0, 0x4000, 0x10, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x84fd, 0x0, 0x7, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x6, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5f1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x4, 0x0, 0x7ff, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0xe, 0x0, 0x2, 0x20, 0x0, 0xeae2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x400, 0x40000000, 0x80000, 0x0, 0xfffffffd, 0x0, 0xfffffffc, 0x2, 0x3, 0x7, 0x0, 0x0, 0x80000000, 0xffff], [0x4, 0x20e4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x80, 0x100, 0x0, 0x0, 0x0, 0x2, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x800, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfff, 0x71f, 0x0, 0x0, 0xffffffff, 0x20, 0x8], [0x40000000, 0x4, 0x74e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x0, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40caa, 0x6, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) 966.057084ms ago: executing program 9 (id=6026): sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="10"], 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x8086) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x5000, 0xc000}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000040)={0x4000}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000080)={0x10000, 0x9019baff90eebf70}) 938.124469ms ago: executing program 8 (id=6027): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) 934.786174ms ago: executing program 4 (id=6028): r0 = syz_io_uring_setup(0x24fa, &(0x7f0000000180)={0x0, 0xd5f1, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='5'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FADVISE) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 815.345157ms ago: executing program 7 (id=6029): r0 = syz_io_uring_setup(0x7fbc, &(0x7f0000000340)={0x0, 0x0, 0x10100, 0x1ffffff}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x8, 0x0, 0x0, 0x0, {0x2}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x10, 0x2007, @fd, 0x8, 0x0, 0x0, 0x2}) io_uring_enter(r0, 0x2d3e, 0x0, 0x0, 0x0, 0x0) 738.686631ms ago: executing program 9 (id=6030): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000004c0)={0x79, 0x0, 0x3}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000540)=ANY=[@ANYBLOB="01000000000000000100000002000000000000000000007f00ec97630000f1ffffff"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000580)={"23bb9087089ec967c720692e604edc6a204d197a997bd36b84482bfd89029aec05fefeeee99d2e837e3d8562cf2c8fe897b39d6bd75ecb99a54f6bae1fc603af47b0b88f8b36d232a8a41913e5923ec99c5bb483c52f266b9269336651b6a20beb6004d52fa3b98c1cb54895204e6b71ade50458966b76841182920332a4ac456f49cfcad2aade5e8527a4b27679358afcd99ab5c533f5772765800bee15a8c82e35b61db233526915ab57e617203ff53e001337611de119886a6b92976e27c2a0882a7c0211484dbbfbe8b8dc13e9f859a156a14d2a368a405dd31b8f90ec095820595a41bc5787f171973fd72f9c6f8296965dda9bed35c1ca48bf12631189824c8ac43e36ac53acdeab6a51321fd8fe7d09b2118b0a95fe36781a9f2b336a557c25853a5280cd5e72a08ffe6fb7b1e0a4ee981a4ab61d9df21187bf4fbe0d7b7186259b772d4d9d7ee1090497a8b3f2a6afc25e177fd276d44de6cf9367c958170fa4f04f1e467c423a3916d588b281d60fb94520d7e6b3d058f927ff49b4a7c571679fb04289f0a30aa97c3dc83064a3c197a0acf4fc58e2e981bd41eb473c031144636ace100d256cd1124089a2495a3b076df5bc570e901afcf9a3fb9062a77070813d3c46f96b9bb3224e8db946e5251ad4827f16e132427fe1edfc2b93f38edb783c2b72f4db4bbd5fa7f031786e4b509fcb338c439271a6f6232649d1fac8264bfd9da411d296fcdfd2ebd20a8daf36deb43afc1b671ec31ea3ea46cff98cb145707364bdff4243e70dc620b19f038da8d1c8f1b384603e50f1489bb56d61f1576f2cf190fefe9cd8ec76d6fd94712302bbff71afc7132c0c423dcc6f822db760287e47f3df03ad35abfe87167192a91fc3bba38ea840c43bb1c28db080c5f95774a4552438332726b6e8e167443049c66a4ae8d95c51296f7fec10e01c334cce72de9da171f5ce13fc0a88a2f087d67489d5607a418bbd88b54c75034e306bab2681d90c56253a4b6515a87667ff07dcf7c14ec88c6fcd57cf93fc0315b0f7c4b3e0043e85e4b9f81677f9042da8540f6db353d874e739d3086f1f672f8cfe84f23548379b7888c735196449e53129442c16260e7c652d6a07958c5a3409b1482601f5f80420fbd6089c44e7259bd9dc7bfab3c2901bd2d4d3171f410bf9444a0058ba624ac4386eed61cb314cca3b8c44a4eebbd9be10ffea75f9228759af59ae0fac4f5a32655e2c1a3b4979353f436abe7d7d6cfaa3d9691654033bf7ccfc9f9119162f373e34f362a2329e19df440e91424736c0f277e5c46352ee6acbc0f3b8e866ba6656c11833deb68fdf91634d455471ef57c4627bc5639fb295772693d052a3b57aa2931067ce4b1208768b820d35a965504d3a9419bd6ee7ce9fb71f81b2f1d336eb0a2000f8a0c4ad50a3b9af39e72706a2fae45db3"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 640.502217ms ago: executing program 8 (id=6031): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32=r1, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4001}, 0x4000004) 640.185233ms ago: executing program 4 (id=6032): sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x54) r0 = syz_io_uring_setup(0x53f, &(0x7f0000000000)={0x0, 0x807734, 0x400, 0xfffffff8, 0xfe}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x36, 0x0, 0x0, 0x202}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 592.810011ms ago: executing program 4 (id=6033): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000a700000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='page_pool_release\x00', r1}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000000082295"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x1f4, 0xd50, 0x1000000, &(0x7f0000000100)="ff412f66b0833efc8864968781", 0x0, 0x300, 0x300, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x2}, 0x50) 586.847477ms ago: executing program 9 (id=6034): r0 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000040)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_RESET(r2, 0x4141, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(r2, 0xc06c4124, &(0x7f0000006500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) 520.388323ms ago: executing program 8 (id=6035): r0 = mq_open(&(0x7f0000000080)='$@\x00', 0x40, 0xb4, 0x0) fcntl$setlease(r0, 0x400, 0x0) mq_open(&(0x7f0000000140)='$@\x00', 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}, {0x77359400}}, 0x0) 460.640502ms ago: executing program 7 (id=6036): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r4 = socket(0x2, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'team_slave_0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x60, r2, 0x1, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xd2}}, {0x8, 0x6, r5}}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20008400}, 0xc8014) 459.577881ms ago: executing program 9 (id=6037): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000008300), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) syz_fuse_handle_req(r0, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x2100039, 0x0, 0x0, 0x1, 0x57, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f0000004300)="d5c2280baf4e05cfa1d1112770cf43a123827586f0f2675b130041ff58ba6533ea7947f2f65b1d458fe88a96133ea3927f41fa6976fad8c967c88679769ee674b80debcd1ec6ce1eb490888bd66a52141fa82f51882b22a8e36ff462b51560307cd0048156800ad137f359719a9c5d6ad6a8c999984f22461c4ca6614ca4cbbd5e9103a3459228e3bd35e3c1cd5f2a83fbefafe7c5a39617ba1d856f37977da077ffcf4d52f5bb3feffa9e100b0279cb635a61ae9f5f4491bb1c9f04c041818a1ae9a25cbca38c4b4754a8be4f52db20ca464b3b4faf0ea8ff193b414e7b7a4ec8aec2e77adc43d09c62d37fc0aa6296a56a9445f264a245d41e77de43c2694cc5885ebd454a3b78b60172e3e6a2fd79efa8b5fbbe827512aa0656920858da51616244ad32e53ed039a270c042662bc966a8fa05e23a51c76585a6f753e57c63b5a1dd11c4ce8773702c5c759471b79ee9bed600d99853afda9b675f071bdf6ff4eb99cb1ae0128ac1f8132f9b7bef82221276395e59f1323c9f9f6bb937a9db0bc2088670ffc3e6233ba73d4e324df7bc866e84e82ab707ab8aadd593913dd3533cddb396e804a63155ad6911962bc49bad21faba90b5570b62d98eb5328214a7198b36ea6df9a72dc248311040e01539112e1d6bcb4ed9d7fb70d22768ec6603e4727b6ed2616eb9108524985ccd70f1361f68b1fb7088829acdd59ec5af9e84409737f0d852a3c55993cb7398b5640c458bc036115b86de7b8e68f1cff882ee5707040571c3e5c9602c773459cfecad4917d8ba2902bd64a676e2c6e507d06dbc806c13c0fd18175087440ce7d7300dfe745b8e98ac63b400e449a3f2518c6112c9864fde68f580ebc2d72e4bbd03f16a7289be813c258b02f76ce901afdafc69046c947c9e801ac635b2a95cca291c052c7f8149c92aaeaab41edb34a70604a7538c4bb6486b983416843fe6a65d7b828d66deb991e71526b7627e71c6a795a02e787bc561ec4b65d4742a129c59bc71b323850cb416f3d32494d6dbfe3ea73cb473b093ae0b0ebbbd3e3251ece756b3cc381f05ea1b8c3f7fbcbb16fc446fc084725e6c3a608221aad8d8179112f9e5ee3697346a0dc0645e530df523cf4daea14764c25da2da863adebaccefc2c83a9257b3131ac2fe04a27bf3aea8979b6f3091b4fef99e203725368d297bad3b020273d0b606d2368e2ecb0776349cb86bbcbaa5c910636527e3cbeca06b4135170d8808c5f113fcd77ecb2f099d1e663617a46ffc5275c8fcc339d315ca1583f66fe7a7e6430405c0be889826c07fcafa17f04e08bc39570a1f499092d390c5dba82d259f652307ff941e9f1f569a48144da846f14452df295553de6ef4e9ba0cd98dd16cf89d8bead08eacd4eea71cc5f8232349f2d8519b1172c724d3bbc415c19c9e679b5a96bc9051cf6f243f243366622023ab1b7039a89152e7db97f291bb3f0213c445c25caf5f0a5a2b382c841cd8a490dc97d008966e94ed0b5ce07bcc0c13b39c349e4b596147a633f3a73ab6012a1582d3d283293bd7c01f99cdbad8e18d24867c39ed0dc3fc3cc800edd23af24b225acb2cca5aa264bcda40e1432cf2cc0050efdff48fd49ae4225a983d1b12facbaaba73294eb225fff64a677d0ed2cd71bab61b3fde8a1fdae638d2036283a8a4ff5a548d05cb706f56ce7e3f55a688fa6c70393c53c33be11f34a38f61f80c8e94e50fc9d7c3695d234705bb9e0b2a8316cf54d7963f548d49f153bf796d0970ed1264c19d79eb77fd0aad4844796cec73a08206b9eca76f2ad76318a20d52e7d3338eac40d03775cca0c2b29a451cb10bc141289c2703198e7137200a360463000fab97d0da72a7b4e8aadfa8a2e559a7d06bf49d6d4a932cb29994ef7ca0c1beabf05b898bb2338e89a67373d50614300f13523fe451d4058e5a522d364ec884099ee3c6e6db8d4ec1e5dc08d127b6301a308a1d6798878c28ef828b91b529a22b7519d249a189a7eb942b94ce26148ea8bf16a44261cd9691ba980ec2d0c710dbee41756cb39b88213ad5763239ae7636e983580c41a40b0f3a3af9fa6f995ed1981d073f63a623554bb01869bdfda190bc8d9507cc067b897e1c5f0d087cf8dfcb171169541fa3cce7c3a620544c74f2d3234935a0acf6c804c43992812925cbaaa24f497e7a00efb20c45c7acb80adb3322cbe0f08d1015b40f5ae1366003ebea977b7b95f803487d10aedca3fd018cfa7b267dae604ed0ada202cbebd731f86b7c6764911d4ff0c75a318ee43b1b556781ac58fbd773b2bd0dd693f9b12fa149bbe392cb2d6bf72015912f4a120e47654d42d14107c67b4502b5ad62044d0022c7f8b255a3e46da4bb8f9e44515e4076ce7b1aefd57c4e264b2cbee4a9e8612ce8517b028067644c927a9ce7564449c8fb0471a87b9b76f374c7c2559379a3004326bdc91be5ec52672dc5fac0883ec527f2a1248601bb9267c3123568b815b90b40ba06c250e3068dee2d7fc232141eaaa130443a5775d049464ec454a7c980d9eebaa4f67a75075a6bc28ded9a5f07fe658a2b9eafa37f14055155409d1aa50be6343d13d515d0531b84644d2f58c280d6d008dee95607f67eb74c900f664d97f411f4ac6afc18f11b6fb75e78b3ff25680ed3bbf5b20969678475b86faa02a751e4cec87735645753f245047371c9e6e2e7ab5a9ea3182b4c96934a21b9df3628b478f5ef705aeda49a0609d4b8f5bf34424581557d029438306002fd4e9cff5a2d4e7d5e23c2992032d314b8fbb46ccda250070fc1b679c9c8646c5fe22d8fe2e0fff73d8153fc46ef7885aeaa2d1eabbe455544d46fdef8e3ef9debfe589870942bcc7196e62736e927c311782b5e4da2889d530a7c1550bff4909d2055941655cbcc5c924a477c80fc3b8a904cd9e62f5fb005b5b00154db5becbe327c0f3ec8314ef3fb5397b99c5332306023005d2dfb70d3ea2aefababd019ae16d304c083e38997cc94bdeb746fc151849c98dc2a23554e6fe789d3aba8bf4e31133c7f93a3cdcd884271dfdd2c45be398a5349ef5d08456178dfafa31cb4c607f09394d71b3405b3d615c7c59c125db88f72380140345d24c56094711dd833221d6b7c5864d049585605c1301c31982d19e403b601b797fe99d0bbfe30d647a913da72b4c5306f6123e7c572828308a9a8f4c686d07125d0006229c2e890ff7d3c354dde61ccd3b26069a81a98e112e61a930f253d607cda5023f002a09df6b1371638d9661c5a06bed166434f07120ad21476de8ad47296af4b449d581cddc74f9be42a84596fb0634f330a856216a9b32b080c8b66e9f51a758b9ca2e1215ddfe633714ca512032f6547217b1a60fcdb27ac8a04bc7851718b38607bc92c13118a323c3221bad99a8639762abcc4a08654da9938aeb301c55546f5ae7f61439dd883a1b2dede156a57c805ab12337d5381a2fb25b32916a8827fc4de8e2ecc70eeebeb01659d6bf88055477b863fb897d5db275a0c222d261e7df79474858b721e57747fe8997faaf36f5f175b23dd3c5efb2b93fb5824da18d635cd7027a3b0b1c87e7c90a5681682b8a7c47dc82fdd3f329c7b60270100dec8ccdd310245b92f4b0bd9a92e1f2a5733b1b91966be15a4761b06f6fe3b05b60ee7964b4d028257c2210ca88031db0590190d3714c1b6ec86e2821dca03db2fc0c9f0ad9800d1773c8037e9b38c7eb7c99618b731e0526f8453c7e1bb67cffcc2d96cc297e1f917b13dd7dda2a8b12191ed107c1e076ffd4965b9415f830be97935cac23a87f07e26354273c2663c7ef19a27dfe08543fa057e1285c909051602981f5929078214058684bc80bed493f6ef853012cb654d180e414fd484f5cb2cfd06c9b753f417697ff42794649e05fcaa3d53ad0fdfbb0db57dc549115e59978b14dd621370d136176098af2f39a2de72482a29b616e8b308b3d9b46ac9abf3d57ff89fe59b5a97966cc4b97d06c20ee4fd765e1c2abce54dc271a7c7efe656648800c27a9988583b4b76572222cb28916b9ff5f6f649de93923179809405c879a90cb450f604cbe8af55cf2a6d844a59ab0393b394e09c79e1b3c403af6eba69330f6969f78a49eb7022e77a39363f11e07fcc69f670f63c11497352f3f5bfea0aee446da35428cebe28f1c2d23ef3ff97e16ceeb2f88ab19b2b69dcdcc81b947b483cc06c776c52232489f86f4c377eb38056042e2e9e0943fc0ef1490df472b9b244235598894a2ffc296f0a2e4257baca6a3ea8cfb1a22ea8295ab9e5faaa2a9e964ae7625dbf945cdbb369265f429d475ab69413cc5bcb89af57b1b966bd0076f799a401d4b46e5045aceb1ef36e5bbfb037bb7681f2a38ef1df9b84baa3598201d13a813165355bf052bb5e456dc0abdefed995b4eb37a39b313af800f6029243a6a7bec75a23389a90034cac8df6713b919028a14649d756d0093550278aad494de2dfeb76220fd3ee5be31f73839ace7f0d6da650e26f5ded30471ed55d2e814fc1b89102e5917b4e58840ecc211eaffa5a2937abeb882ccdf29308e3ac30e23d66ee79c29b4fb7e793a55e344cac298e30f1ca3333df8b58f43126a3404aa4bf13dbfb05efd7b9b4219efd428c8f7f345884640d19f5515abcce05f315f00e65d9aa8022890a23da45ede06f455d66e0c96bbf7e9cc74eddca999a51174b4784eba8a9ebed13415de6bd0f160443d43b78181cfa381313a54e25f6751a38f290e5972ff7f70692e18c4737af2a7f6d4eac52ea594a22be4fd00fac1484e6d2d4d3196b49212b49598f5bc77b34d8a3633cf7212c869557d6eb27bf0d0a02555d9318194e9de9c9730ac72daee7cad6c2d4b248a8744515670766a8f1c739917fb859d98974532477989f4c24345f120f5320fdb8d8d56fa6ff2511e701bab399513cecb3e740e3761d02685a765f5267554d0f9243b51620197adc3b561b59c58f334307220db357c1121d7dbf593898b5d2c505f333445c084a6cbc6a7e5252724c83fcee85e304534780a01e7ecceb2ef53ffb6bc6cb9051b1400493ce55d62c01e972fff3cc7d0b68a2dd4d263c9191df1b629e323797f570083f122db3df6abb6fd6c4a351bb7500c7241e4392ac76e04259968e517a43e907cb0b0533d6750b9587a1a5d852639c6b789d333e848e3ad66cbf19c5ee5a641036cb7a858f822f657dec36cc134d6c1a629cfce1f1e24dbb73d09fba04f53b2c6309d71d92211a1f08535244eefcbb52e095626bcc78b950db1cb8facc3660fa705dceef155b00aef3291367ffcea06b5abe588bbdcea2637761308dc65509798b6a494dae4a75c1922c1234248dbfcabfaab3088a0dad09a135a45d75105314020f3ba8901dc39ee624a32e9f863ff55844974b44e57b30302cd0c349f3cc091befd5665f918c298ba89454fb811ce573e41f27490853a52abd6144e85d77de88c3f2e5506c8de40a3957e65936f3b294ce92610b63cec888cb16fe0e8a7af3dd142da96b57f602cc64ba69966724584c2872e5fc42348a324ff082a3ecfded82c3e5b7292d3726c4800176acab6a7a1479a0b5fea79f299e90ffdb1b3843e2349b8f8dc7881145b3796380474c2ceb57e27726c9e50b746a2b12a214fea9cfd6c668363fe6e402710665118928fedb2f4900322b0c7d2c348881ea52278dae765c14b51fd5e8f000602aa3978d83b76056410c2260931e35d841793c8a36b191f93c33c0e4e6367ef45a1cf5145d774861224afbb11a7b77bb94492ec49827f713f8309d80d22e17701046e04c5b277f7b423cbbada01e6d40beb56e755e583b8f3de4b67c4b5ac83771b805fa7af49de2fc8b9a223293d83e7eb4eea3a3af1d1221e5d458e7cab60eaf1b51550a1b125ce018d76096f16d922f4aba48a728ec1b7d4812fe2ca789261b6d8e0c8edb3ba9007649084899c4f6b7986c1cb4a98d412c801fb91675ee42e2bb511bff6700772d3c03a7cb6adb41cbddc33053f8f65c164e9bd47b931510046506b169216d0a04edc479bc51c28acc536ced3834a7a9ce8fb55b72fa186a559437bf41f04b733e05986c915bc19f1b2f99d3bae6c13873d32e3c809b71881c3075f8dd1746f36409ac7934c25236ee2752560fcdd5175037a6fc5f0da58a229418ce30f3e64f9eb6ff3fe4498f47fdd69ceac5e792c8c9f087316f334b7f75e3432d3f1d03ee97c8f16485ec906c94e6c9580f7d03d98a8da85ec118b77c6c1d3b2e99fbf4b45e66cb4f8817f786d1f90e1e5e250be8c240a9648a219a02e62acbd72d1b0c0b42c75065a35664ea6a03cb05ea179f2e8e50e3d7ed53d31cdc10cf5fce48781fa338e3ee819f410540f045cb0edd7b2d219993faaa97cf95aa6144e889a02069421291d05eade30693a751039fece452c22d1afba081d1c40178fed7684cae475fcc365484118a184670cd7aa2758bdb01058ea9b244d5241f627bc5be11c9395e3cb839b0eac7842a312e1fc8b4ddae2aa4ef907ca5c9b847785051323e16d5497c4424289496277475bba67da750fa05bd8be730e4aabaeb94641fa2263dd3d4eb511b4fa40b8cf8b16d7aded1163f2258add79b04e1eb888afa27d057de2523863fc2da38d44cc69ae2d455900eede5fce69d7e9f8707cdb2456a45dda14d257eee4982f86259b855a0293068aa4aeff9439bc06c8ed5a370fe46fa88fa9bb92872166ac69152d1cbb4720eec5b9a057890cbb838aef12091454fe721395b46f9fa29ec1829fedf65aaec1176bb9eb15511bd77e7d4fe7321b3e0dfda95e5c90c3663956477885d6d94b280f58edbc77e864dca73536cd4988bcde2a3edb91704ad59148d85a001e393cebdb56ee088fa1033cdc6fbcbea30e2974035bfe29cee1eace13e30950bb4658886dae7e565ffd7b71e41feecbcac35fd97c81a8fff9d2a1d43f183c6e984671e06645eb0a60228d1b6c12c28bc6eaa4b9125c57b48ced2e199ed3acf12dbe10af4a56f2f5dca829fd07fc3f7e0de6913c73be0ada3e43bcbe70de784de699d0b51d7a56a3eacaf5d7dcd77d73cfb82e04633574213e05dc98850d822bc6dc90dc3fd6184296287342e2243fe6f0cf94e6d02a1b900d0c718e2afbe7fea2fafa375f209fb9cef5d844b861a1029aa3dd7081e81fe6501bbb413dcd23e013f279ef87e082335ade324b7688054992ccc63fbf9153213ab6d07ed0b79945d19639aaa5dd10e53aafe57f1e323300246cb1d6ede1eb1f319ca6fe1b0cc8e733b34818425888110b6eabe2db302310d0a8bcdd5342146b29c535cc9a95a455c8926d77323a31b948d47dc611815a329654a252fd09dbcec5f3cd8bc7e465759eb8e72ff6fd4ef1f375e4e8762a58148622d14480b7bb9aca2eeab3367a7376c9c85e6ba1735e56a2fcc6baf92c8d21942883f318eab7a568fc7ff01885a7089aa7661b15d73799bc0b8f8ce6a3b61adb6949965a223850b6825616c036e099952e04fde7cf086b5e76d45b86ab78b322f9af580173f2e798a39df7cade0d365c9d46d3fb36970f8a99d7b20a1b275afff852126f21ac24ca8c34deb49ba511f4d9edb4f56941aaaa477253f9bfc9a25a2694bbbe3b917074dd4eb6f1be20395ac33dd932a7ccf0604d64257b5af3faf271c145c190a528e471a7f23a53b5f9ea1bd0cc36410e9c538e91dd01d162edde856087b60dcba2042e65b6ae7b81787bd3308db9eb025b6fd930a9eb74a30883b83cfa8be5270dd3ee3408db7f7b136adebb3ee30f0e0b8835a0ded325363e4a2991cafd4a73483954c0f5d3358b25780608fa48f3f527c7e617ec12eb017df33f5088676d8bc476da251e608394e3d8fc0883fd4d1804f8e07f5e12ffa4ee80365a88abf29936bf1b255539fef95f5cf3bebcd26817edb28e7b6adf4851dcfe8aa1aa097f67c51557326ccf9c46ee2780d491e87774324d4dcf26f2e472a5e199b0cdef01094ea72bd5ad5fe1be6c9d545df3dc5de550665d220718a2c0baed2833cfb1428e2d1c2b9ea1e29f4b07fd6c51492643d4000716cd1e8a4f9d58b6b04b805d8962495323fd62949b17348418201664c6f2f651f99d73f8d17bb5e52dba2e6f94fa33f816d74bb6a45bd6cbdbd07f530406227c8fd11f390e805bbc17bc0e81076a27c0be023b64777afec0a7a0c3f53f03bc2ca72ae2873d68217a1a6905f414c2cb1b9561dfd07850a026da5f5775a66f8f3a6bc29b48c8a81b06ba30994ba8e7e233e3a3a5d886767ea6de91fbfc0a594c2375d62e71c7209d87d0f6c7a79a0d80da328e93f08650ec745495c771410913d094e4190075b7225761172eb420c82ab493548f6de38e17d3e687a89ce77c67c58b875c48c8a4d1664cbc6f67df357e040444fcd515d92d5823fc3ef6485208b6f3eda8cd09ea3b004f7eb06ac268ae8c3bf571aa3f619222a47540f9af340c80c587f7226e3d715b18c3ee41f64777d3a0a09f32190ad67922f6ecc63c956a715c3c42a6aaaf5e588d119210083ceaa414820b62fef87a678cd3f24f8fa3cdb6629b041cd7555974313f56d1b0e117ea925dc95e18b5d3f4ba9812f1067022945c3f5d547370d45853c4db3c9ca4436d7e649e1ac3ec02f9c1e9139849b46027d4b276cb0eb4b09848999f466f528290e47ba9540ceca89390db3fcbacb1d566e22e917f01f4442bd4dd0d350d057ffdf5b3549ca559901e6ff5147bdc25c11b23f1678f02c20e4e2e6f339b262e2b82eae0b15b4227f1d514f99ec78fbcf80c8f6f243536f2d7a809de05ae5e1d676fe950ad3513f801bbe4d16737def4b5ec4b62f8562cd5432bd372645202edeb286662d7e8d0dadac5b91c903c2756bdc4f5a7c931f2c3f7feace2b83f5459a196000e2ed1e1b2accaa9d637d5e408340161331c4b0047bf2ab31d317bb1c8f6e1b3d52f9f240bd971a447942dd4b73301781656aad9ce9b01aed907b7eb3a78397b97e601b04a4cb028d327ef32cf20c34e8dad9c9b1f981ab5c06a2b0271852e2a1016ee460d8568391c9ece5a2b8f29cbc6f2d6cc2e66c30c96df548e67dd6ad8c1ff09dfa22b2e8b2c52a3948c4febb0910c2d34c0604a5ef930cd53be69a4bed9c9ee057178ece02a6b4df4624191590952888bdfafd2dbeca128d500872a8b236fba9623672c4dc15f56a761ee0c54026112fc464f72d3039587f009b94930dac0dbe444a939b38c0f5bce7aa366bfc2bb909db231178228846f71a56ab219e28cef1b102c1bfadbe8f0916d10a573b8cb38cc2cc2ec496a410a4e82847006d2ed4bac927a63a00416d0bfce59cc69aaf78ddc9566f23582999a655c8ad3b217486fb5a037ce089baf344d55bbd475be4e90b10e92c9c1bae3202c2d63355549f0ac95058724fea81ff9cec027e7b93e2cee43af81c6978fee5faf6216118785251b8ca023115b2f87d5d4b10c29aa3616628ab40a8ef36668ef57d7f9be505eabc01947ca222362818a71b3d63e5725a4d8a2c619b1867f70daa07703360d026d6f65247330be1ba84ddaaa7779591ca261beda4f4c094af65c5c276fe3bfb89f067c8c54af67e78f61bdc114ed4aa869c3adf282d7a8e7272579e9fd9e47611e0dc89f97561110e0141c69b1fa114e27b3d1e2c825ea008a370e08cd0a0610edef20cdd8a7cda0922fff046edfd2ff391a10ffce5dd6045619ce9af6b03f4193d858a76b201ed5beb0f11321707b7b593b23adaee4a0c0caf39dfeebcbd2948030435dc94ca00990c728502ec4686194f0f454304a422023c1b2c5b1ebbcd8cd50fa2d11361e3bbdc306e2739e27de300eda27b1c1ea62d773104cea77c18037c6bcc76423621b45abbe789b384bfdfb46efa1627ff29d9d840bf6e1f05e7e13fae6383e42ce153dcb062fa0cefd0fe9298ddbe77fd78d7036b5a815504b48267203da08ca685bfe8ae89c031074bbe5d3d6dcc6a3a8a8a4d3102765c3b714867f4516df62f214351b97bb8b5697a9f9a9dd78627342b239c524a3943d1d70f8cdd7391f05e7395731a8fc05210c6733ea256040bbbb53389229b84dafaaa3db1d5eca2971d9e550149461f1a672eae2319a99beed48934520666bc54b63085a744b5fc9a9b089b16c50ae945f74adcd4c5d064a12a6e103ef59bcc035a755ad31836eb7d04e5900d3800c822b96b466a9f6611f46b8a7d6131f91c625a5604de5bf01e5ca5d99a714c8dc1160260010f8d55f9125ee453b61c911bdf0824caa804c76d6512802875c5433de9b2e8b6c579a67fec5d2bc64ed3d1c313854221b75c9a0ed42af6f5354e7b1d1bf8661baa1261e68fc20d14b5652d25a536f208bff2b90fefa163a232696e655bcf95bed39355ec865e272fed582aae18858f5096ece40b9108efb00147f9c2ced59bfe2a79826851850ed95b35908dfb4d9ab7da0668a1fa8933ac4f6534e9598481477791fd1a1c269011ac9fe81f0491790e8aac121ffc00e38a7619a1855e6899abc2c670375a3ba4ac0cf652da89a70628cee1a35ae17b3490102e3c88ca324d06fcf6e76ccb16d2a9cbf4161812e2c7758d73631024190fe9b71935de6968b289d3503b497f3f4b6306446ae9c312f8f1c63c1f7e62652173d9ed48cb128815bd44a12061f9b73fbdc6674ab9e0d01807f7bcfa0aa59168420e5ad8b72d7b576e273a1d229934fce2867689a41cb17767cf9defe1a96515a677ba08e10e187a3ce2f1d78e6b43b0d46c36163a1967b203df4f53379ee98422e973ab5c090adff21b5cc84fc78358021f681a0f0fd744f687e4f6c295470bf8f548d2d3dc841481dd51db9124cacde83bc9fef44a3e69e1cb28579d897f3013ac6133395328247fdcc152e5563678258936576196ced017c79bb6a4ea501a44cb25e5af1697afbdb3abb316837470ffdbe985ac3967334a90731602d3fac4f5c2758f04ec9c161a7cf330b7c7549fb62e6c15d07a7203c94edd3a8141c91b2029d6a90b14322337e6610822d9d7bff58c10d9c6cff71822f6456a421a65fdaa5d2c793f256a4e7a39f0d85d65fb95479eff79345c0615c9bbb4fb3324f9360b70dc709b0200042e8461b8cee9ce30beab3e276df48f41f001262fc14153f9764e13b50397442e00d7b11266bde10a3b7f83818086ff0015409679e4472d9e0215804fa9d21cebfa5cb5099cf88750cbeaaf58c2743f2746ea4cb73760ba88a07b91b68553716d563af5d7702219d0c600916dc54242d825c6d68320baf234a39f0b9ea9e6a4a72c4d5829b2f28508f54b33c7e0394a43fe23e7940d9b04bbe790d903a2d2c979e0ea79931b934d094fa2d5948c05cf278c341d788f2061ff617c9fa4700b1e1f0fbfa1b8c42848f2ea01cd318a8748c3336622ead25527ddbcd8a12ba3a5183f4419deb13558ed0ec99e73448c21ede0dbee9c01fc7675e54c60d4dee29c0f8fe81af6fe7b726f5d3c50dac634aefbf1ca6aa4df1b340a4109acf30939f6094c8591218729788111bfde98cd96d4b04b25bcd1bcb7f826241995573bae00", 0x2000, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x78, 0x0, 0x9, {0x9, 0xcbff, 0x0, {0x5, 0x3, 0x5, 0x6c, 0x7, 0x40000000000d, 0x3, 0xfffff2de, 0x101, 0xc000, 0xfffffffe, 0x0, 0xffffffffffffffff, 0x8, 0x1}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file0\x00', 0x100, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x100) 300.42318ms ago: executing program 7 (id=6038): sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6", 0x25, 0x20000000, 0x0, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0xb0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 257.784099ms ago: executing program 9 (id=6039): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000540)=0x9) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x3) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000300)) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000001c0)=0x7e) 423.726µs ago: executing program 2 (id=6040): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x9}, 0x1c) listen(r0, 0x3) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1201000002000040257d15a44000010400010902"], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000001100)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\f\n5', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8}}}}}}}, 0x0) 0s ago: executing program 4 (id=6041): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f00000000c0)='./file1\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x2) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0x9362, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r0, 0xc0189379, 0x0) kernel console output (not intermixed with test programs): 4][T10101] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 534.742435][T10101] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 534.742584][T10101] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 534.742602][T10101] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 534.742618][T10101] smsc75xx 8-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 534.742921][T10101] smsc75xx 8-1:0.184: probe with driver smsc75xx failed with error -71 [ 534.822628][T10101] usb 8-1: USB disconnect, device number 25 [ 534.900251][T14637] kexec: Could not allocate control_code_buffer [ 535.704061][T14642] lo speed is unknown, defaulting to 1000 [ 535.865424][T14653] syz_tun: entered allmulticast mode [ 535.923587][T14652] syz_tun: left allmulticast mode [ 536.228735][T14665] input: syz1 as /devices/virtual/input/input54 [ 536.322567][T14659] netlink: 'syz.4.3534': attribute type 30 has an invalid length. [ 536.445549][T14669] usb usb5: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 536.661620][T14662] pim6reg1: entered promiscuous mode [ 536.661651][T14662] pim6reg1: entered allmulticast mode [ 536.712574][T14676] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 537.436326][T14707] loop6: detected capacity change from 0 to 7 [ 537.481017][T14707] Dev loop6: unable to read RDB block 7 [ 537.481048][T14707] loop6: AHDI p3 p4 [ 537.481077][T14707] loop6: partition table partially beyond EOD, truncated [ 537.481186][T14707] loop6: p3 start 1886353253 is beyond EOD, truncated [ 537.901463][ T37] audit: type=1800 audit(1050.622:410): pid=14727 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.3565" name="nullb0" dev="devtmpfs" ino=2957 res=0 errno=0 [ 539.187418][T14768] kvm: emulating exchange as write [ 539.399159][T14775] netlink: 14528 bytes leftover after parsing attributes in process `syz.2.3583'. [ 540.275843][T14804] netlink: 'syz.7.3598': attribute type 29 has an invalid length. [ 540.276252][T14805] netlink: 'syz.7.3598': attribute type 29 has an invalid length. [ 540.278553][T14804] netlink: 500 bytes leftover after parsing attributes in process `syz.7.3598'. [ 540.528990][ T10] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 540.679198][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 540.687358][ T10] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 540.687390][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.687408][ T10] usb 5-1: Product: syz [ 540.687421][ T10] usb 5-1: Manufacturer: syz [ 540.687433][ T10] usb 5-1: SerialNumber: syz [ 540.743527][ T10] usb 5-1: config 0 descriptor?? [ 540.952675][ T10] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 541.156263][ T10] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 541.175152][ T10] usb 5-1: USB disconnect, device number 27 [ 541.438502][T10107] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 541.588649][T10107] usb 10-1: Using ep0 maxpacket: 32 [ 541.592484][T10107] usb 10-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 541.592511][T10107] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.601217][T10107] usb 10-1: config 0 descriptor?? [ 541.839836][T10107] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 541.856764][T10107] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 541.867862][T10107] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 541.867918][T10107] usb 10-1: media controller created [ 541.964599][T10107] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 542.057967][T10107] az6027: usb out operation failed. (-71) [ 542.060256][T10107] az6027: usb out operation failed. (-71) [ 542.060273][T10107] stb0899_attach: Driver disabled by Kconfig [ 542.060282][T10107] az6027: no front-end attached [ 542.060282][T10107] [ 542.060777][T10107] az6027: usb out operation failed. (-71) [ 542.060789][T10107] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 542.063710][T10107] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input55 [ 542.075463][T10107] dvb-usb: schedule remote query interval to 400 msecs. [ 542.075488][T10107] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 542.094010][T10107] usb 10-1: USB disconnect, device number 13 [ 542.339091][T10107] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 543.105503][ C1] vkms_vblank_simulate: vblank timer overrun [ 544.593270][T14920] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3646'. [ 544.642366][T10101] IPVS: starting estimator thread 0... [ 544.696997][ T31] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 544.746952][T14925] IPVS: using max 8 ests per chain, 19200 per kthread [ 544.847065][ T31] usb 8-1: Using ep0 maxpacket: 16 [ 544.853572][ T31] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 544.853596][ T31] usb 8-1: config 0 has no interface number 0 [ 544.859565][ T31] usb 8-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 544.859592][ T31] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 544.859610][ T31] usb 8-1: Product: syz [ 544.859623][ T31] usb 8-1: Manufacturer: syz [ 544.859635][ T31] usb 8-1: SerialNumber: syz [ 544.871252][ T31] usb 8-1: config 0 descriptor?? [ 544.885876][ T31] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 546.094135][ T31] gspca_spca1528: reg_w err -71 [ 546.094241][ T31] spca1528 8-1:0.1: probe with driver spca1528 failed with error -71 [ 546.098805][ T31] usb 8-1: USB disconnect, device number 26 [ 546.475269][T14966] loop2: detected capacity change from 0 to 7 [ 546.506339][T14966] Dev loop2: unable to read RDB block 7 [ 546.506393][T14966] loop2: unable to read partition table [ 546.506642][T14966] loop2: partition table beyond EOD, truncated [ 546.506658][T14966] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 546.670304][ T49] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 546.676120][ T6012] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 546.809916][ C1] vkms_vblank_simulate: vblank timer overrun [ 546.825814][ T6012] usb 10-1: Using ep0 maxpacket: 32 [ 546.828343][ T6012] usb 10-1: config 0 has an invalid interface number: 132 but max is 0 [ 546.828367][ T6012] usb 10-1: config 0 has no interface number 0 [ 546.828413][ T6012] usb 10-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 546.828835][T14972] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 546.831533][ T6012] usb 10-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 546.831560][ T6012] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.831577][ T6012] usb 10-1: Product: syz [ 546.831589][ T6012] usb 10-1: Manufacturer: syz [ 546.831601][ T6012] usb 10-1: SerialNumber: syz [ 546.840453][ T49] usb 3-1: Using ep0 maxpacket: 32 [ 546.847648][ T49] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 546.847681][ T49] usb 3-1: config 0 has no interface number 0 [ 546.847726][ T49] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 546.861505][ T49] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 546.861534][ T49] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 546.861552][ T49] usb 3-1: Product: syz [ 546.861563][ T49] usb 3-1: Manufacturer: syz [ 546.861576][ T49] usb 3-1: SerialNumber: syz [ 546.985477][ T6012] usb 10-1: config 0 descriptor?? [ 546.999788][ T6012] em28xx 10-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 546.999828][ T6012] em28xx 10-1:0.132: Video interface 132 found: [ 547.040497][ T49] usb 3-1: config 0 descriptor?? [ 547.149998][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.224828][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.233932][ T49] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 547.233965][ T49] em28xx 3-1:0.132: Video interface 132 found: [ 547.294077][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.543517][ T6012] em28xx 10-1:0.132: unknown em28xx chip ID (0) [ 547.618267][ T49] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 547.668953][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.754873][ T6012] em28xx 10-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 547.754914][ T6012] em28xx 10-1:0.132: board has no eeprom [ 547.843404][ C1] vkms_vblank_simulate: vblank timer overrun [ 547.843504][ T6012] em28xx 10-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 547.843540][ T6012] em28xx 10-1:0.132: analog set to bulk mode. [ 547.843737][T10101] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 547.851333][ T9] em28xx 10-1:0.132: Registering V4L2 extension [ 547.892912][ T49] em28xx 3-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 547.892942][ T49] em28xx 3-1:0.132: board has no eeprom [ 547.914293][ T6012] usb 10-1: USB disconnect, device number 14 [ 547.922939][ T6012] em28xx 10-1:0.132: Disconnecting em28xx [ 547.945287][ T49] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 547.945314][ T49] em28xx 3-1:0.132: analog set to bulk mode. [ 547.976841][ T49] usb 3-1: USB disconnect, device number 48 [ 547.979125][ T49] em28xx 3-1:0.132: Disconnecting em28xx [ 548.028000][ C1] vkms_vblank_simulate: vblank timer overrun [ 548.061536][T10101] usb 8-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 548.061572][T10101] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.076004][T10101] usb 8-1: config 0 descriptor?? [ 548.367472][ T9] em28xx 10-1:0.132: Config register raw data: 0xffffffed [ 548.367496][ T9] em28xx 10-1:0.132: AC97 chip type couldn't be determined [ 548.367508][ T9] em28xx 10-1:0.132: No AC97 audio processor [ 548.461131][ T9] usb 10-1: Decoder not found [ 548.461152][ T9] em28xx 10-1:0.132: failed to create media graph [ 548.461226][ T9] em28xx 10-1:0.132: V4L2 device video103 deregistered [ 548.541812][ T9] em28xx 10-1:0.132: Remote control support is not available for this card. [ 548.564949][ T31] em28xx 3-1:0.132: Registering V4L2 extension [ 548.717310][ T9] usb 8-1: USB disconnect, device number 27 [ 548.783687][ C1] vkms_vblank_simulate: vblank timer overrun [ 549.080724][ T31] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 549.080741][ T31] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 549.080748][ T31] em28xx 3-1:0.132: No AC97 audio processor [ 549.088030][ T31] usb 3-1: Decoder not found [ 549.088048][ T31] em28xx 3-1:0.132: failed to create media graph [ 549.088084][ T31] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 549.093484][ T31] em28xx 3-1:0.132: Remote control support is not available for this card. [ 549.124046][ T6012] em28xx 10-1:0.132: Closing input extension [ 549.124428][ T49] em28xx 3-1:0.132: Closing input extension [ 549.315689][ T6012] em28xx 10-1:0.132: Freeing device [ 549.393266][ T49] em28xx 3-1:0.132: Freeing device [ 549.864320][ T6012] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 550.024188][ T6012] usb 8-1: Using ep0 maxpacket: 32 [ 550.027006][ T6012] usb 8-1: config 0 has an invalid interface number: 12 but max is 0 [ 550.027031][ T6012] usb 8-1: config 0 has no interface number 0 [ 550.027077][ T6012] usb 8-1: config 0 interface 12 has no altsetting 0 [ 550.030118][ T6012] usb 8-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 550.030143][ T6012] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.030160][ T6012] usb 8-1: Product: syz [ 550.030173][ T6012] usb 8-1: Manufacturer: syz [ 550.030185][ T6012] usb 8-1: SerialNumber: syz [ 550.093757][ T6012] usb 8-1: config 0 descriptor?? [ 550.274283][ T49] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 550.434141][ T49] usb 3-1: Using ep0 maxpacket: 32 [ 550.436970][ T49] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 550.436998][ T49] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 550.437020][ T49] usb 3-1: config 0 interface 0 has no altsetting 0 [ 550.441614][ T49] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 550.441642][ T49] usb 3-1: New USB device strings: Mfr=229, Product=1, SerialNumber=3 [ 550.441660][ T49] usb 3-1: Product: syz [ 550.441672][ T49] usb 3-1: Manufacturer: syz [ 550.441685][ T49] usb 3-1: SerialNumber: syz [ 550.448712][ T49] usb 3-1: config 0 descriptor?? [ 550.873410][ T49] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 550.927016][T15037] netlink: 'syz.4.3693': attribute type 4 has an invalid length. [ 550.927681][T15037] netlink: 'syz.4.3693': attribute type 4 has an invalid length. [ 551.277128][ T49] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-EPIPE) [ 551.332209][ T6012] f81534 8-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 551.332260][ T6012] f81534 8-1:0.12: f81534_find_config_idx: read failed: -71 [ 551.332276][ T6012] f81534 8-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 551.332374][ T6012] f81534 8-1:0.12: probe with driver f81534 failed with error -71 [ 551.365045][ T49] usb 3-1: USB disconnect, device number 49 [ 551.381198][ T6012] usb 8-1: USB disconnect, device number 28 [ 551.540293][T15052] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 551.715727][T15056] netlink: 67 bytes leftover after parsing attributes in process `syz.8.3702'. [ 552.432042][T15075] netlink: 156 bytes leftover after parsing attributes in process `syz.7.3709'. [ 554.082306][T10081] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 554.234354][T10081] usb 10-1: config 0 has no interfaces? [ 554.237493][T10081] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice=20.41 [ 554.237520][T10081] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 554.237537][T10081] usb 10-1: Product: syz [ 554.237549][T10081] usb 10-1: Manufacturer: syz [ 554.237561][T10081] usb 10-1: SerialNumber: syz [ 554.296733][T10081] usb 10-1: config 0 descriptor?? [ 554.588633][ T49] usb 10-1: USB disconnect, device number 15 [ 555.271623][ T6012] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 555.434104][ T6012] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 555.434130][ T6012] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 555.434167][ T6012] usb 8-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 555.434187][ T6012] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 555.480340][ T6012] usb 8-1: config 0 descriptor?? [ 555.723797][T10081] usb 8-1: USB disconnect, device number 29 [ 556.045842][T15161] input: syz1 as /devices/virtual/input/input56 [ 556.225523][T15167] netlink: 'syz.2.3748': attribute type 1 has an invalid length. [ 556.225546][T15167] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3748'. [ 556.225562][T15167] netlink: 'syz.2.3748': attribute type 2 has an invalid length. [ 556.225572][T15167] netlink: 'syz.2.3748': attribute type 1 has an invalid length. [ 556.411070][ T10] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 556.561168][ T10] usb 10-1: Using ep0 maxpacket: 8 [ 556.565327][ T10] usb 10-1: config 0 has an invalid interface number: 38 but max is 0 [ 556.565353][ T10] usb 10-1: config 0 has no interface number 0 [ 556.565383][ T10] usb 10-1: config 0 interface 38 has no altsetting 0 [ 556.598990][ T10] usb 10-1: New USB device found, idVendor=04e6, idProduct=0009, bcdDevice= 2.00 [ 556.599025][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.599044][ T10] usb 10-1: Product: syz [ 556.599056][ T10] usb 10-1: Manufacturer: syz [ 556.599069][ T10] usb 10-1: SerialNumber: syz [ 556.641167][ T10] usb 10-1: config 0 descriptor?? [ 556.646616][ T10] usb-storage 10-1:0.38: USB Mass Storage device detected [ 556.749130][ C0] vkms_vblank_simulate: vblank timer overrun [ 556.850173][ T31] usb 10-1: USB disconnect, device number 16 [ 557.190891][ T10] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 557.343447][ T10] usb 8-1: config index 0 descriptor too short (expected 72, got 10) [ 557.343472][ T10] usb 8-1: config 1 descriptor has 1 excess byte, ignoring [ 557.343489][ T10] usb 8-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 557.435320][ T10] usb 8-1: string descriptor 0 read error: -71 [ 557.435465][ T10] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 557.435486][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.483221][ T10] usb 8-1: can't set config #1, error -71 [ 557.485725][ T10] usb 8-1: USB disconnect, device number 30 [ 557.534082][T15210] netlink: 'syz.8.3766': attribute type 12 has an invalid length. [ 557.534103][T15210] netlink: 'syz.8.3766': attribute type 29 has an invalid length. [ 557.534115][T15210] netlink: 148 bytes leftover after parsing attributes in process `syz.8.3766'. [ 557.534141][T15210] netlink: 'syz.8.3766': attribute type 1 has an invalid length. [ 557.534153][T15210] netlink: 'syz.8.3766': attribute type 2 has an invalid length. [ 557.867504][T15219] netlink: 116 bytes leftover after parsing attributes in process `syz.8.3770'. [ 557.937168][T15221] binder: 15220:15221 ioctl c0306201 0 returned -14 [ 557.937594][T15221] binder: 15220:15221 ioctl c018620c 200000000280 returned -1 [ 559.475660][ T49] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 559.637376][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.637407][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.637444][ T49] usb 8-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 559.637463][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.659122][ T49] usb 8-1: config 0 descriptor?? [ 560.130676][ T49] hid_parser_main: 5 callbacks suppressed [ 560.130698][ T49] cm6533_jd 0003:0D8C:0022.003A: unknown main item tag 0x0 [ 560.130818][ T49] cm6533_jd 0003:0D8C:0022.003A: unknown main item tag 0x0 [ 560.135398][ T49] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:0D8C:0022.003A/input/input57 [ 560.186822][ T49] cm6533_jd 0003:0D8C:0022.003A: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.7-1/input0 [ 560.421447][ C0] vkms_vblank_simulate: vblank timer overrun [ 560.512974][T10081] usb 8-1: USB disconnect, device number 31 [ 561.279744][T15276] pim6reg1: entered promiscuous mode [ 561.279773][T15276] pim6reg1: entered allmulticast mode [ 562.766732][T15315] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 562.922904][T15317] loop4: detected capacity change from 0 to 7 [ 562.942570][T15317] Dev loop4: unable to read RDB block 7 [ 562.942602][T15317] loop4: AHDI p3 p4 [ 562.942643][T15317] loop4: partition table partially beyond EOD, truncated [ 562.942754][T15317] loop4: p3 size 4227858431 extends beyond EOD, truncated [ 564.287439][ T49] usb 5-1: new full-speed USB device number 28 using dummy_hcd [ 564.444530][ T49] usb 5-1: config 150 has an invalid interface number: 204 but max is 1 [ 564.444557][ T49] usb 5-1: config 150 has no interface number 0 [ 564.444601][ T49] usb 5-1: config 150 interface 204 has no altsetting 0 [ 564.444619][ T49] usb 5-1: config 150 interface 1 has no altsetting 0 [ 564.472703][ T49] usb 5-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 564.472732][ T49] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.472750][ T49] usb 5-1: Product: syz [ 564.472762][ T49] usb 5-1: Manufacturer: syz [ 564.472774][ T49] usb 5-1: SerialNumber: syz [ 564.807165][ T49] xr_serial 5-1:150.204: xr_serial converter detected [ 565.372481][T15345] lo speed is unknown, defaulting to 1000 [ 565.670825][ T49] usb 5-1: xr_serial converter now attached to ttyUSB0 [ 565.943589][ T49] usb 5-1: USB disconnect, device number 28 [ 565.975989][ T49] xr_serial ttyUSB0: xr_serial converter now disconnected from ttyUSB0 [ 566.027305][ T49] xr_serial 5-1:150.204: device disconnected [ 566.639476][ C0] vkms_vblank_simulate: vblank timer overrun [ 566.738001][ C0] vkms_vblank_simulate: vblank timer overrun [ 566.956538][T15382] netlink: 14528 bytes leftover after parsing attributes in process `syz.8.3830'. [ 567.495691][T10116] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 567.589086][T15403] input: syz1 as /devices/virtual/input/input58 [ 567.655866][T10116] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 567.655898][T10116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 567.655930][T10116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 567.655949][T10116] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 567.655988][T10116] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 567.656009][T10116] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.752216][T10116] usb 5-1: config 0 descriptor?? [ 567.757242][T15407] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 568.165528][T10116] plantronics 0003:047F:FFFF.003B: ignoring exceeding usage max [ 568.225260][T15417] block nbd9: NBD_DISCONNECT [ 568.232695][T15417] block nbd9: Send disconnect failed -22 [ 568.235625][T10116] plantronics 0003:047F:FFFF.003B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 568.248296][T15417] block nbd9: Disconnected due to user request. [ 568.248317][T15417] block nbd9: shutting down sockets [ 568.304534][T15418] syz.8.3844 (15418) used greatest stack depth: 16024 bytes left [ 569.585801][T15447] netlink: 212264 bytes leftover after parsing attributes in process `syz.2.3856'. [ 569.873667][T15456] Invalid ELF header magic: != ELF [ 570.096396][T10101] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 570.246136][T10101] usb 8-1: Using ep0 maxpacket: 16 [ 570.248881][T10101] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 570.248911][T10101] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 570.248951][T10101] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 570.248971][T10101] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.281437][ T6012] usb 5-1: USB disconnect, device number 29 [ 570.363419][T10101] usb 8-1: config 0 descriptor?? [ 570.704719][ T9] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 570.796278][T10101] HID 045e:07da: Invalid code 65791 type 1 [ 570.813498][T10101] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.003C/input/input59 [ 570.874944][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 570.879347][ T9] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 570.879373][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.879391][ T9] usb 3-1: Product: syz [ 570.879403][ T9] usb 3-1: Manufacturer: syz [ 570.879416][ T9] usb 3-1: SerialNumber: syz [ 570.936994][ T9] usb 3-1: config 0 descriptor?? [ 570.952560][T10101] microsoft 0003:045E:07DA.003C: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 571.354435][T15476] No source specified [ 571.361561][ T9] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 571.375587][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 571.381598][ T9] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 571.381658][ T9] usb 3-1: media controller created [ 571.428598][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 571.567239][ T9] zl10353_read_register: readreg error (reg=127, ret==0) [ 571.567297][ T9] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 571.567310][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 571.608417][T10101] usb 8-1: USB disconnect, device number 32 [ 571.611502][ T9] usb 3-1: USB disconnect, device number 50 [ 571.796904][ T9] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 572.593527][T15517] Invalid ELF header len 4 [ 572.687607][T15520] loop2: detected capacity change from 0 to 7 [ 572.690354][T15520] Dev loop2: unable to read RDB block 7 [ 572.690400][T15520] loop2: unable to read partition table [ 572.690771][T15520] loop2: partition table beyond EOD, truncated [ 572.690789][T15520] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 572.774032][T10116] libceph: connect (1)[c::]:6789 error -101 [ 572.774271][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 572.781963][T10116] libceph: connect (1)[c::]:6789 error -101 [ 572.782197][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 572.860895][T10116] libceph: connect (1)[b::]:6789 error -101 [ 572.861111][T10116] libceph: mon0 (1)[b::]:6789 connect error [ 572.873984][T10116] libceph: connect (1)[b::]:6789 error -101 [ 572.874210][T10116] libceph: mon0 (1)[b::]:6789 connect error [ 572.987148][T10116] kernel write not supported for file /1248/oom_adj (pid: 10116 comm: kworker/1:10) [ 573.051540][T10116] libceph: connect (1)[c::]:6789 error -101 [ 573.051759][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 573.128563][T10116] libceph: connect (1)[b::]:6789 error -101 [ 573.128799][T10116] libceph: mon0 (1)[b::]:6789 connect error [ 573.436653][T10116] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 573.555170][T10101] libceph: connect (1)[c::]:6789 error -101 [ 573.555475][T10101] libceph: mon0 (1)[c::]:6789 connect error [ 573.562999][T15523] ceph: No mds server is up or the cluster is laggy [ 573.588062][T15529] ceph: No mds server is up or the cluster is laggy [ 573.608598][T10116] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 573.608629][T10116] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 573.608652][T10116] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 573.608671][T10116] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 573.608719][T10116] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 573.608740][T10116] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.679153][ T49] libceph: connect (1)[b::]:6789 error -101 [ 573.679367][ T49] libceph: mon0 (1)[b::]:6789 connect error [ 573.708178][T10116] usb 8-1: config 0 descriptor?? [ 573.780712][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.054394][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.170801][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170839][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170861][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170884][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170908][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170930][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170952][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170974][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.170997][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.171019][T10116] plantronics 0003:047F:FFFF.003D: unknown main item tag 0x0 [ 574.296649][T10116] plantronics 0003:047F:FFFF.003D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.7-1/input0 [ 574.429882][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.448948][T10101] usb 8-1: USB disconnect, device number 33 [ 574.546716][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.610866][T15568] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 574.664445][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.742958][ C0] vkms_vblank_simulate: vblank timer overrun [ 574.855512][ C0] vkms_vblank_simulate: vblank timer overrun [ 575.016900][ C0] vkms_vblank_simulate: vblank timer overrun [ 575.404936][ T49] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 575.557772][ T49] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 575.557888][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 575.557912][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 575.557931][ T49] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 575.557971][ T49] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 575.557991][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.589499][T15592] netlink: 5 bytes leftover after parsing attributes in process `syz.2.3914'. [ 575.589857][T15592] 0{X: renamed from gretap0 (while UP) [ 575.645173][ T49] usb 8-1: config 0 descriptor?? [ 575.670075][T15592] 0{X: entered allmulticast mode [ 575.670628][T15592] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 575.778740][T15597] hsr0: entered promiscuous mode [ 575.780193][T15597] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3916'. [ 575.824982][T15597] hsr_slave_0: left promiscuous mode [ 575.864827][T15597] hsr_slave_1: left promiscuous mode [ 575.980222][T15597] hsr0 (unregistering): left promiscuous mode [ 576.108346][ T49] plantronics 0003:047F:FFFF.003E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.7-1/input0 [ 577.177994][T15614] netlink: 212288 bytes leftover after parsing attributes in process `syz.2.3924'. [ 577.604850][T10116] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 577.764653][T10116] usb 10-1: Using ep0 maxpacket: 16 [ 577.769511][T10116] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 577.769573][T10116] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 577.769598][T10116] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 577.769621][T10116] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 577.769641][T10116] usb 10-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 577.771114][T10116] usb 10-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 577.771139][T10116] usb 10-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 577.771157][T10116] usb 10-1: Manufacturer: syz [ 577.869475][T10116] usb 10-1: config 0 descriptor?? [ 578.205007][T10116] rc_core: IR keymap rc-hauppauge not found [ 578.205027][T10116] Registered IR keymap rc-empty [ 578.205188][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.225056][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.246410][T10116] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0 [ 578.251050][T10116] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0/input61 [ 578.284793][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.305038][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.325010][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.345463][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.364739][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.384738][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.406177][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.424857][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.455099][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.475093][T10116] mceusb 10-1:0.0: Error: mce write submit urb error = -90 [ 578.502734][T10116] mceusb 10-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 578.502759][T10116] mceusb 10-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 578.582707][ T6012] usb 8-1: USB disconnect, device number 34 [ 578.744348][ T9] usb 10-1: USB disconnect, device number 17 [ 579.139926][ T10] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 579.218018][T15649] netlink: 'syz.8.3938': attribute type 1 has an invalid length. [ 579.280812][T15649] bond1: entered promiscuous mode [ 579.283020][T15649] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.297538][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 579.297575][ T10] usb 3-1: config 0 interface 0 has no altsetting 0 [ 579.300827][ T10] usb 3-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 579.300850][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.300868][ T10] usb 3-1: Product: syz [ 579.300880][ T10] usb 3-1: Manufacturer: syz [ 579.300892][ T10] usb 3-1: SerialNumber: syz [ 579.306701][ T10] usb 3-1: config 0 descriptor?? [ 579.312192][ T10] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 579.329098][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 579.329982][ T10] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 579.330034][ T10] usb 3-1: media controller created [ 579.418214][T15657] input: syz1 as /devices/virtual/input/input62 [ 579.470526][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 579.475836][T15654] 8021q: adding VLAN 0 to HW filter on device bond1 [ 579.476302][T15654] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 579.476319][T15654] bond1: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 579.500039][T15654] bond1: (slave vxcan3): making interface the new active one [ 579.500098][T15654] vxcan3: entered promiscuous mode [ 579.501542][T15654] bond1: (slave vxcan3): Enslaving as an active interface with an up link [ 579.534726][T10116] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 579.624711][ T10] DVB: Unable to find symbol tda10046_attach() [ 579.624727][ T10] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 579.624741][ T10] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 579.697552][T10116] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 579.697582][T10116] usb 5-1: config 0 interface 0 has no altsetting 0 [ 579.702902][T10116] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 579.702928][T10116] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 579.702945][T10116] usb 5-1: Product: syz [ 579.702957][T10116] usb 5-1: Manufacturer: syz [ 579.702970][T10116] usb 5-1: SerialNumber: syz [ 579.764083][T10116] usb 5-1: config 0 descriptor?? [ 579.794914][T10116] usb 5-1: selecting invalid altsetting 0 [ 580.099286][ T6012] usb 5-1: USB disconnect, device number 30 [ 580.365706][T15673] bridge0: entered allmulticast mode [ 580.371854][T15673] bridge0: left allmulticast mode [ 580.646983][ T10] dvb_usb_m920x 3-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 580.654752][ T10] usb 3-1: USB disconnect, device number 51 [ 581.214305][T15689] TCP: TCP_TX_DELAY enabled [ 581.387708][T15694] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 581.391204][T15694] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 581.906761][ T37] audit: type=1326 audit(1350.642:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=15709 comm="syz.4.3963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7fc00000 [ 582.074707][ T6012] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 582.138305][T15720] loop6: detected capacity change from 0 to 1 [ 582.144016][T15720] loop6: [POWERTEC] p1 p2 p3 p4 p5 p6 [ 582.144155][T15720] loop6: p1 start 1048576 is beyond EOD, truncated [ 582.144173][T15720] loop6: p2 size 458752 extends beyond EOD, truncated [ 582.173796][T15720] loop6: p3 start 12666 is beyond EOD, truncated [ 582.173826][T15720] loop6: p4 start 16387 is beyond EOD, truncated [ 582.173842][T15720] loop6: p5 start 2037579777 is beyond EOD, truncated [ 582.173857][T15720] loop6: p6 start 425986 is beyond EOD, truncated [ 582.233576][ T6012] usb 10-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 582.233608][ T6012] usb 10-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 582.233646][ T6012] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 582.233666][ T6012] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 582.297691][T15712] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 582.320384][ T6012] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 582.530809][ T6012] usb 10-1: USB disconnect, device number 18 [ 582.609406][ T37] audit: type=1326 audit(1351.342:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=15709 comm="syz.4.3963" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7fc00000 [ 582.922136][T15737] netlink: 'syz.8.3975': attribute type 1 has an invalid length. [ 582.974443][T15737] 8021q: adding VLAN 0 to HW filter on device bond2 [ 583.144726][ T49] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 583.168332][T15739] bond2: (slave gretap1): making interface the new active one [ 583.180285][T15739] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 583.304871][ T49] usb 5-1: Using ep0 maxpacket: 8 [ 583.307400][ T49] usb 5-1: config 0 has no interfaces? [ 583.312934][ T49] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 583.312963][ T49] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 583.312981][ T49] usb 5-1: SerialNumber: syz [ 583.318503][ T49] usb 5-1: config 0 descriptor?? [ 583.569868][ T6012] usb 5-1: USB disconnect, device number 31 [ 583.717977][T15749] sit0: entered allmulticast mode [ 584.053546][T15756] veth0: entered promiscuous mode [ 584.067551][T15756] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3982'. [ 584.138780][T10116] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 584.312877][T10116] usb 8-1: Using ep0 maxpacket: 8 [ 584.326654][T10116] usb 8-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 584.326682][T10116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 584.326700][T10116] usb 8-1: Product: syz [ 584.326713][T10116] usb 8-1: Manufacturer: syz [ 584.326725][T10116] usb 8-1: SerialNumber: syz [ 584.334961][T10116] usb 8-1: config 0 descriptor?? [ 584.341403][T10116] gspca_main: se401-2.14.0 probing 047d:5003 [ 584.562045][T15761] netlink: 'syz.8.3985': attribute type 9 has an invalid length. [ 584.562449][T15761] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3985'. [ 584.686835][T10613] netdevsim netdevsim8 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 584.689906][T10613] netdevsim netdevsim8 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 584.690008][T10613] netdevsim netdevsim8 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 584.691368][T15761] netlink: 'syz.8.3985': attribute type 9 has an invalid length. [ 584.691385][T15761] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3985'. [ 584.756697][T10116] gspca_se401: ExtraFeatures: 64 [ 584.756713][T10116] gspca_se401: Too many frame sizes [ 584.986120][T10116] usb 8-1: USB disconnect, device number 35 [ 585.704098][T15783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3995'. [ 586.057372][T15783] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3995'. [ 587.694610][ T9] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 587.854860][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 587.862165][ T9] usb 3-1: config index 0 descriptor too short (expected 16456, got 72) [ 587.862194][ T9] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 587.862212][ T9] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 587.862230][ T9] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 587.862247][ T9] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 587.862266][ T9] usb 3-1: config 0 has no interface number 0 [ 587.862326][ T9] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 587.862350][ T9] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 587.862370][ T9] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 587.862401][ T9] usb 3-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 587.862424][ T9] usb 3-1: too many endpoints for config 0 interface 125 altsetting 190: 32, using maximum allowed: 30 [ 587.862457][ T9] usb 3-1: config 0 interface 125 altsetting 190 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 587.862480][ T9] usb 3-1: config 0 interface 125 has no altsetting 0 [ 587.862496][ T9] usb 3-1: config 0 interface 125 has no altsetting 2 [ 587.865974][ T9] usb 3-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 587.866001][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 587.866017][ T9] usb 3-1: Product: syz [ 587.866029][ T9] usb 3-1: Manufacturer: syz [ 587.866042][ T9] usb 3-1: SerialNumber: syz [ 587.871402][ T9] usb 3-1: config 0 descriptor?? [ 587.883182][ T9] usb 3-1: selecting invalid altsetting 2 [ 588.118192][ C0] usb 3-1: async_complete: urb error -71 [ 588.118655][ C0] usb 3-1: async_complete: urb error -71 [ 588.118762][ C0] usb 3-1: async_complete: urb error -71 [ 588.118865][ C0] usb 3-1: async_complete: urb error -71 [ 588.122833][ T9] get_1284_register: usb error -71 [ 588.122973][ T9] uss720 3-1:0.125: probe with driver uss720 failed with error -71 [ 588.199829][ T9] usb 3-1: USB disconnect, device number 52 [ 588.593219][T15840] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4014'. [ 588.593498][T15840] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4014'. [ 588.670182][T15839] lo speed is unknown, defaulting to 1000 [ 589.065828][T15852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4018'. [ 589.644842][ T6012] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 589.797145][ T6012] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 589.797185][ T6012] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 589.797211][ T6012] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 589.797235][ T6012] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 589.797274][ T6012] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 589.797292][ T6012] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 589.805166][ T6012] usb 5-1: config 0 descriptor?? [ 589.806333][T15862] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 590.027132][T15880] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 590.152921][T15884] input: syz1 as /devices/virtual/input/input63 [ 590.272936][ T6012] plantronics 0003:047F:FFFF.003F: reserved main item tag 0xd [ 590.300281][ T6012] plantronics 0003:047F:FFFF.003F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 590.386609][T15894] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 590.557237][ T49] usb 5-1: USB disconnect, device number 32 [ 590.932232][T15909] netlink: 146780 bytes leftover after parsing attributes in process `syz.7.4043'. [ 591.403497][T15928] overlay: filesystem on ./bus not supported as upperdir [ 591.424957][T10116] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 591.598568][T10116] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 591.598599][T10116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 591.598623][T10116] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 591.598643][T10116] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 591.598681][T10116] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 591.598700][T10116] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 591.619726][T10116] usb 5-1: config 0 descriptor?? [ 592.097523][T10116] plantronics 0003:047F:FFFF.0040: ignoring exceeding usage max [ 592.120072][T10116] plantronics 0003:047F:FFFF.0040: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 592.230827][T15950] veth0: entered promiscuous mode [ 592.338988][T15950] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4061'. [ 593.341549][T15960] netlink: 'syz.7.4065': attribute type 19 has an invalid length. [ 593.341573][T15960] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4065'. [ 593.380372][T15960] netlink: 'syz.7.4065': attribute type 19 has an invalid length. [ 593.380395][T15960] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4065'. [ 593.381205][T10604] netdevsim netdevsim7 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.384085][T10604] netdevsim netdevsim7 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.384125][T10604] netdevsim netdevsim7 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.384159][T10604] netdevsim netdevsim7 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 594.190519][T10116] usb 5-1: USB disconnect, device number 33 [ 595.525826][T16010] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 595.934897][ T37] audit: type=1326 audit(1364.672:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16013 comm="syz.4.4088" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efe22dbebe9 code=0x0 [ 596.907022][T16042] loop2: detected capacity change from 0 to 7 [ 596.908233][T16042] Dev loop2: unable to read RDB block 7 [ 596.908259][T16042] loop2: AHDI p1 p2 p3 [ 596.908288][T16042] loop2: partition table partially beyond EOD, truncated [ 596.908393][T16042] loop2: p3 start 335544320 is beyond EOD, truncated [ 598.304717][ T6012] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 598.457300][ T6012] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 598.457378][ T6012] usb 3-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 598.460626][ T6012] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 598.460654][ T6012] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.460673][ T6012] usb 3-1: Product: syz [ 598.460685][ T6012] usb 3-1: Manufacturer: syz [ 598.460698][ T6012] usb 3-1: SerialNumber: syz [ 598.871775][T16104] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 599.632729][ T6012] cdc_ncm 3-1:1.0: bind() failure [ 599.688138][ T6012] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 599.688185][ T6012] cdc_ncm 3-1:1.1: bind() failure [ 599.868969][ T6012] usb 3-1: USB disconnect, device number 53 [ 600.857386][T10116] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 600.994664][ T6012] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 601.015534][T10116] usb 8-1: Using ep0 maxpacket: 32 [ 601.017606][T10116] usb 8-1: config 0 has an invalid interface number: 12 but max is 0 [ 601.017630][T10116] usb 8-1: config 0 has no interface number 0 [ 601.017677][T10116] usb 8-1: config 0 interface 12 has no altsetting 0 [ 601.040942][T10116] usb 8-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 601.040969][T10116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.040986][T10116] usb 8-1: Product: syz [ 601.040998][T10116] usb 8-1: Manufacturer: syz [ 601.041091][T10116] usb 8-1: SerialNumber: syz [ 601.087182][T10116] usb 8-1: config 0 descriptor?? [ 601.147422][ T6012] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 601.147457][ T6012] usb 5-1: config 0 has no interface number 0 [ 601.147488][ T6012] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 601.147541][ T6012] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 601.147568][ T6012] usb 5-1: config 0 interface 255 has no altsetting 0 [ 601.147600][ T6012] usb 5-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 601.147620][ T6012] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.154169][ T6012] usb 5-1: config 0 descriptor?? [ 601.172062][ T6012] ums-realtek 5-1:0.255: USB Mass Storage device detected [ 601.317179][ C1] vkms_vblank_simulate: vblank timer overrun [ 601.360249][ T6012] usb 5-1: USB disconnect, device number 34 [ 601.477188][T16154] input: syz1 as /devices/virtual/input/input65 [ 602.365766][T10116] f81534 8-1:0.12: f81534_set_register: reg: 1003 data: b0 failed: -71 [ 602.365820][T10116] f81534 8-1:0.12: f81534_find_config_idx: read failed: -71 [ 602.365834][T10116] f81534 8-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 602.365922][T10116] f81534 8-1:0.12: probe with driver f81534 failed with error -71 [ 602.424891][T10116] usb 8-1: USB disconnect, device number 36 [ 602.789086][T16188] loop2: detected capacity change from 0 to 7 [ 602.790077][T16188] Dev loop2: unable to read RDB block 7 [ 602.790121][T16188] loop2: unable to read partition table [ 602.790347][T16188] loop2: partition table beyond EOD, truncated [ 602.790363][T16188] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 602.842176][T16190] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 603.707826][T16213] Invalid ELF header magic: != ELF [ 604.091924][ C0] vcan0: j1939_tp_rxtimer: 0xffff888032459400: rx timeout, send abort [ 604.092830][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888032459400: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 604.173870][ T6012] Process accounting resumed [ 604.644660][ T6012] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 604.804695][ T6012] usb 10-1: Using ep0 maxpacket: 8 [ 604.808251][ T6012] usb 10-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 604.808278][ T6012] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.861901][ T6012] pvrusb2: Hardware description: Terratec Grabster AV400 [ 604.861923][ T6012] pvrusb2: ********** [ 604.861929][ T6012] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 604.861939][ T6012] pvrusb2: Important functionality might not be entirely working. [ 604.861946][ T6012] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 604.861954][ T6012] pvrusb2: ********** [ 605.101089][ T2370] pvrusb2: Invalid write control endpoint [ 605.321744][ T10] usb 10-1: USB disconnect, device number 19 [ 605.396902][ T2370] pvrusb2: Invalid write control endpoint [ 605.396918][ T2370] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 605.396927][ T2370] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 605.396935][ T2370] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 605.396948][ T2370] pvrusb2: Device being rendered inoperable [ 605.452093][ T2370] cx25840 3-0044: Unable to detect h/w, assuming cx23887 [ 605.452153][ T2370] cx25840 3-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 605.482099][ T2370] pvrusb2: Attached sub-driver cx25840 [ 605.482128][ T2370] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 605.482138][ T2370] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 606.264663][ T49] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 606.418648][ T49] usb 10-1: Using ep0 maxpacket: 32 [ 606.427348][ T49] usb 10-1: config 0 has an invalid interface number: 67 but max is 0 [ 606.427374][ T49] usb 10-1: config 0 has no interface number 0 [ 606.445885][ T49] usb 10-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 606.445913][ T49] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.445931][ T49] usb 10-1: Product: syz [ 606.445944][ T49] usb 10-1: Manufacturer: syz [ 606.445957][ T49] usb 10-1: SerialNumber: syz [ 606.488909][ T49] usb 10-1: config 0 descriptor?? [ 606.516262][ T49] smsc95xx v2.0.0 [ 606.852782][T16277] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4199'. [ 606.933159][ T49] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 606.933189][ T49] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 607.542223][ T49] smsc95xx 10-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 607.542543][ T49] smsc95xx 10-1:0.67: probe with driver smsc95xx failed with error -71 [ 607.555144][ T49] usb 10-1: USB disconnect, device number 20 [ 607.580066][T16289] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 607.972150][T16304] netlink: 'syz.7.4212': attribute type 1 has an invalid length. [ 608.026882][T16304] 8021q: adding VLAN 0 to HW filter on device bond3 [ 608.091495][T16306] bond3: (slave geneve2): making interface the new active one [ 608.093335][T16306] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 608.372798][T16316] netlink: 'syz.8.4217': attribute type 10 has an invalid length. [ 608.373712][T16316] netlink: 'syz.8.4217': attribute type 4 has an invalid length. [ 608.373730][T16316] netlink: 152 bytes leftover after parsing attributes in process `syz.8.4217'. [ 608.440993][T16316] : renamed from bond0 (while UP) [ 608.614739][ T49] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 608.764656][ T49] usb 8-1: Using ep0 maxpacket: 8 [ 608.767447][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 608.767479][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 608.767499][ T49] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 608.767518][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 608.767536][ T49] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 608.767571][ T49] usb 8-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 608.767589][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.784166][ T49] usb 8-1: config 0 descriptor?? [ 609.070210][ T5856] Bluetooth: hci3: urb ffff88805979bc00 submission failed (90) [ 609.113325][ T49] usb 8-1: USB disconnect, device number 37 [ 609.710919][ T37] audit: type=1326 audit(1378.442:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.710973][ T37] audit: type=1326 audit(1378.442:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.711228][ T37] audit: type=1326 audit(1378.442:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.711475][ T37] audit: type=1326 audit(1378.442:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.711746][ T37] audit: type=1326 audit(1378.442:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.712440][ T37] audit: type=1326 audit(1378.442:419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.739941][ T37] audit: type=1326 audit(1378.442:420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.739985][ T37] audit: type=1326 audit(1378.472:421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.759461][ T37] audit: type=1326 audit(1378.492:422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 609.759512][ T37] audit: type=1326 audit(1378.492:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16343 comm="syz.9.4229" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7ffc0000 [ 610.338243][T16357] Bluetooth: hci0: invalid length 0, exp 2 for type 6 [ 610.516247][T16363] netlink: 'syz.9.4236': attribute type 1 has an invalid length. [ 610.611282][T16366] netlink: 'syz.2.4238': attribute type 1 has an invalid length. [ 610.678894][T16363] 8021q: adding VLAN 0 to HW filter on device bond3 [ 610.723383][T16367] bond3: (slave ip6gretap1): making interface the new active one [ 610.738748][T16367] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 610.829250][T16366] 8021q: adding VLAN 0 to HW filter on device bond2 [ 610.995363][T16369] 8021q: adding VLAN 0 to HW filter on device bond2 [ 610.995873][T16369] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 610.998238][T16369] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 611.638618][ T49] kernel write not supported for file bpf-prog (pid: 49 comm: kworker/1:1) [ 612.098007][T16405] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4255'. [ 613.224667][ T6012] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 613.383183][ T6012] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 613.383211][ T6012] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.383229][ T6012] usb 5-1: Product: syz [ 613.383241][ T6012] usb 5-1: Manufacturer: syz [ 613.383453][ T6012] usb 5-1: SerialNumber: syz [ 613.392016][ T6012] usb 5-1: config 0 descriptor?? [ 613.682372][ T6012] usb 5-1: USB disconnect, device number 35 [ 614.232154][T16453] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4273'. [ 614.459403][T16457] IPVS: Scheduler module ip_vs_ not found [ 615.054396][T16455] overlayfs: statfs failed on './file0' [ 615.596464][ T37] kauditd_printk_skb: 5 callbacks suppressed [ 615.596481][ T37] audit: type=1326 audit(1640.335:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16473 comm="syz.9.4281" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7fc00000 [ 617.947563][T16584] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4316'. [ 617.953735][T16584] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4316'. [ 619.245317][T16627] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.4332'. [ 619.293229][T16629] vxcan1: entered allmulticast mode [ 620.064712][ T6012] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 620.117483][T16650] netlink: 'syz.4.4342': attribute type 1 has an invalid length. [ 620.216810][T16650] 8021q: adding VLAN 0 to HW filter on device bond3 [ 620.227036][ T6012] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 620.227066][ T6012] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 620.227099][ T6012] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 620.227119][ T6012] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.232186][ T6012] usb 3-1: config 0 descriptor?? [ 620.242610][T16654] bond3: (slave geneve2): making interface the new active one [ 620.282382][T16654] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 620.677492][ T6012] savu 0003:1E7D:2D5A.0041: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 620.871146][T16668] ip6gretap0: entered promiscuous mode [ 620.871444][T16668] macsec1: entered allmulticast mode [ 620.871457][T16668] ip6gretap0: entered allmulticast mode [ 620.925117][T16668] ip6gretap0: left allmulticast mode [ 620.925284][T16668] ip6gretap0: left promiscuous mode [ 620.937921][ T9] usb 3-1: USB disconnect, device number 54 [ 621.008628][ C0] vkms_vblank_simulate: vblank timer overrun [ 621.095492][T16674] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4351'. [ 621.629758][T16696] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4360'. [ 623.222293][T16755] Bluetooth: hci0: invalid length 0, exp 2 for type 16 [ 623.304854][ T6012] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 623.404960][ C0] vkms_vblank_simulate: vblank timer overrun [ 623.514795][ T6012] usb 3-1: Using ep0 maxpacket: 16 [ 623.526982][ T6012] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 623.527008][ T6012] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 623.527026][ T6012] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 623.530214][ T6012] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 623.530241][ T6012] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.530259][ T6012] usb 3-1: Product: syz [ 623.530271][ T6012] usb 3-1: Manufacturer: syz [ 623.530284][ T6012] usb 3-1: SerialNumber: syz [ 623.949285][T16776] netlink: 212376 bytes leftover after parsing attributes in process `syz.8.4396'. [ 623.976559][ T6012] usb 3-1: 0:2 : does not exist [ 624.094883][ T31] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 624.248440][ T31] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 624.248470][ T31] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 624.248489][ T31] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 624.248528][ T31] usb 8-1: New USB device found, idVendor=056e, idProduct=00fb, bcdDevice= 0.00 [ 624.248549][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 624.254098][ T31] usb 8-1: config 0 descriptor?? [ 624.682755][ T31] hid_parser_main: 5 callbacks suppressed [ 624.682779][ T31] elecom 0003:056E:00FB.0042: unknown main item tag 0x0 [ 624.708411][ T31] elecom 0003:056E:00FB.0042: hidraw0: USB HID v0.00 Device [HID 056e:00fb] on usb-dummy_hcd.7-1/input0 [ 624.814646][ T6012] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 624.885034][ T31] usb 8-1: USB disconnect, device number 38 [ 624.925282][ T6012] usb 3-1: USB disconnect, device number 55 [ 625.052712][T16789] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4402'. [ 625.824758][ T31] usb 8-1: new low-speed USB device number 39 using dummy_hcd [ 625.977537][ T31] usb 8-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 625.977566][ T31] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 626.003868][ T31] usb 8-1: config 0 descriptor?? [ 626.368876][ T37] audit: type=1326 audit(1651.105:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16829 comm="syz.2.4421" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc40461ebe9 code=0x0 [ 627.233050][ T31] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 627.233078][ T31] asix 8-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 627.233356][ T31] asix 8-1:0.0: probe with driver asix failed with error -71 [ 627.276252][ T31] usb 8-1: USB disconnect, device number 39 [ 627.587616][T16859] loop8: detected capacity change from 0 to 7 [ 627.597356][T16859] Dev loop8: unable to read RDB block 7 [ 627.597403][T16859] loop8: unable to read partition table [ 627.597643][T16859] loop8: partition table beyond EOD, truncated [ 627.597661][T16859] loop_reread_partitions: partition scan of loop8 (被x ) failed (rc=-5) [ 627.752064][T16859] Dev loop8: unable to read RDB block 7 [ 627.752121][T16859] loop8: unable to read partition table [ 627.752353][T16859] loop8: partition table beyond EOD, truncated [ 627.752371][T16859] loop_reread_partitions: partition scan of loop8 (被x ) failed (rc=-5) [ 628.068153][T16875] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4439'. [ 628.068177][T16875] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4439'. [ 628.072142][T16873] Bluetooth: hci0: invalid length 0, exp 2 for type 10 [ 628.694678][ T9] usb 8-1: new full-speed USB device number 40 using dummy_hcd [ 628.852674][ T9] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 628.852700][ T9] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 628.876465][ T9] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 628.876492][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.876511][ T9] usb 8-1: Product: syz [ 628.876524][ T9] usb 8-1: Manufacturer: syz [ 628.876536][ T9] usb 8-1: SerialNumber: syz [ 629.109275][ T9] usb 8-1: 0:2 : does not exist [ 629.127834][ T9] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 629.209472][ T9] usb 8-1: USB disconnect, device number 40 [ 629.463727][T16903] netlink: 'syz.2.4451': attribute type 25 has an invalid length. [ 629.463746][T16903] netlink: 'syz.2.4451': attribute type 7 has an invalid length. [ 629.488346][T16903] netlink: 'syz.2.4451': attribute type 25 has an invalid length. [ 629.488368][T16903] netlink: 'syz.2.4451': attribute type 7 has an invalid length. [ 630.015239][ C0] vkms_vblank_simulate: vblank timer overrun [ 630.383993][T16932] netlink: 64 bytes leftover after parsing attributes in process `syz.7.4463'. [ 630.414707][ T9] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 630.564625][ T9] usb 10-1: Using ep0 maxpacket: 32 [ 630.566951][ T9] usb 10-1: config 0 has an invalid interface number: 184 but max is 0 [ 630.566976][ T9] usb 10-1: config 0 has no interface number 0 [ 630.567090][ T9] usb 10-1: config 0 interface 184 has no altsetting 0 [ 630.576623][ T9] usb 10-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 630.576651][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.576669][ T9] usb 10-1: Product: syz [ 630.576681][ T9] usb 10-1: Manufacturer: syz [ 630.576693][ T9] usb 10-1: SerialNumber: syz [ 630.593873][ T9] usb 10-1: config 0 descriptor?? [ 630.609557][ T9] smsc75xx v1.0.0 [ 630.672321][T16941] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 630.709611][T16941] macvlan2: entered promiscuous mode [ 630.709842][T16941] macvlan2: entered allmulticast mode [ 630.709856][T16941] team0: entered allmulticast mode [ 630.709867][T16941] team_slave_0: entered allmulticast mode [ 630.709887][T16941] team_slave_1: entered allmulticast mode [ 630.712825][T16941] bond0: (slave macvlan2): Enslaving as an active interface with an up link [ 631.268624][ T9] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 631.268653][ T9] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 631.477572][ T9] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 631.477601][ T9] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 631.477619][ T9] smsc75xx 10-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 631.477928][ T9] smsc75xx 10-1:0.184: probe with driver smsc75xx failed with error -32 [ 631.519337][ T9] usb 10-1: USB disconnect, device number 21 [ 632.035068][T16972] netlink: 'syz.4.4477': attribute type 10 has an invalid length. [ 632.089245][T16967] netlink: 'syz.4.4477': attribute type 4 has an invalid length. [ 632.089267][T16967] netlink: 152 bytes leftover after parsing attributes in process `syz.4.4477'. [ 632.180537][ T37] audit: type=1326 audit(1656.915:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16975 comm="syz.9.4479" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fecd5c0ebe9 code=0x0 [ 632.196107][T16967] : renamed from bond0 (while UP) [ 632.456684][T16982] bridge0: port 2(bridge_slave_1) entered disabled state [ 632.703805][T16991] overlayfs: failed to clone upperpath [ 633.130216][T17003] netlink: 1347 bytes leftover after parsing attributes in process `syz.9.4491'. [ 634.798363][T17029] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4499'. [ 635.183924][ T37] audit: type=1400 audit(1659.915:432): lsm=SMACK fn=smk_curacc_msq action=denied subject="w" object="_" requested=rw pid=17036 comm="syz.8.4503" ipc_key=0 [ 636.118973][T17047] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 636.431266][T17050] vlan2: entered allmulticast mode [ 636.431289][T17050] dummy0: entered allmulticast mode [ 637.457846][T17070] use of bytesused == 0 is deprecated and will be removed in the future, [ 637.457863][T17070] use the actual size instead. [ 638.196237][T17093] netlink: 'syz.9.4526': attribute type 10 has an invalid length. [ 638.249857][T17092] netlink: 'syz.9.4526': attribute type 4 has an invalid length. [ 638.249878][T17092] netlink: 152 bytes leftover after parsing attributes in process `syz.9.4526'. [ 638.294612][ T31] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 638.352838][T17093] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 638.444712][ T31] usb 8-1: Using ep0 maxpacket: 8 [ 638.473570][ T31] usb 8-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=44.b2 [ 638.473599][ T31] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.473617][ T31] usb 8-1: Product: syz [ 638.473629][ T31] usb 8-1: Manufacturer: syz [ 638.473642][ T31] usb 8-1: SerialNumber: syz [ 638.513228][ T31] usb 8-1: config 0 descriptor?? [ 638.576969][T17092] : renamed from bond0 (while UP) [ 638.753227][ T31] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 638.932744][T17104] input: syz0 as /devices/virtual/input/input66 [ 638.991712][T17108] overlayfs: failed to clone upperpath [ 639.132167][T17110] veth1_to_bond: entered allmulticast mode [ 639.133156][T17110] veth1_to_bond: entered promiscuous mode [ 639.145968][T17109] veth1_to_bond: left promiscuous mode [ 639.146153][T17109] veth1_to_bond: left allmulticast mode [ 639.776316][ T31] gspca_sunplus: reg_w_riv err -71 [ 639.776415][ T31] sunplus 8-1:0.0: probe with driver sunplus failed with error -71 [ 639.805000][ T31] usb 8-1: USB disconnect, device number 41 [ 640.625944][T17146] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4549'. [ 642.452653][ T37] audit: type=1326 audit(1667.185:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.452702][ T37] audit: type=1326 audit(1667.185:434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454693][ T37] audit: type=1326 audit(1667.185:435): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454738][ T37] audit: type=1326 audit(1667.185:436): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454780][ T37] audit: type=1326 audit(1667.185:437): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=115 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454818][ T37] audit: type=1326 audit(1667.185:438): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454856][ T37] audit: type=1326 audit(1667.185:439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.454894][ T37] audit: type=1326 audit(1667.185:440): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17192 comm="syz.2.4570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x7ffc0000 [ 642.727739][T17205] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 643.072626][T17221] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.664108][T17238] netlink: 204 bytes leftover after parsing attributes in process `syz.8.4586'. [ 644.734675][ T49] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 644.887013][ T49] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 644.887044][ T49] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 644.887065][ T49] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 644.887106][ T49] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 644.887127][ T49] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.948481][ T49] usb 3-1: config 0 descriptor?? [ 645.454941][ T49] plantronics 0003:047F:FFFF.0043: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 645.683670][ T49] usb 3-1: USB disconnect, device number 56 [ 646.533647][T17292] tls_set_device_offload_rx: netdev not found [ 649.997995][T17348] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4633'. [ 650.097870][T17350] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4636'. [ 650.122689][T17348] vxlan1: entered promiscuous mode [ 650.374766][ T10] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 650.562326][ T10] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 650.562355][ T10] usb 8-1: config 0 interface 0 has no altsetting 0 [ 650.568697][ T10] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 650.568725][ T10] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 650.568742][ T10] usb 8-1: Product: syz [ 650.568754][ T10] usb 8-1: Manufacturer: syz [ 650.568767][ T10] usb 8-1: SerialNumber: syz [ 650.577002][ T10] usb 8-1: config 0 descriptor?? [ 650.608222][ T10] usb 8-1: selecting invalid altsetting 0 [ 651.104200][ T10] usb 8-1: USB disconnect, device number 42 [ 651.585836][T17393] Invalid ELF header magic: != ELF [ 652.055793][ T37] audit: type=1326 audit(1676.795:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17400 comm="syz.8.4656" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5545d0ebe9 code=0x0 [ 652.920780][T17432] lo speed is unknown, defaulting to 1000 [ 653.456989][T17444] unknown channel width for channel at 909000KHz? [ 653.457016][T17444] unknown channel width for channel at 909000KHz? [ 654.258200][T17456] netlink: 51 bytes leftover after parsing attributes in process `syz.9.4675'. [ 654.566803][T17473] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4685'. [ 654.566841][T17473] netlink: 'syz.7.4685': attribute type 30 has an invalid length. [ 655.048676][T17473] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4685'. [ 655.048710][T17473] netlink: 'syz.7.4685': attribute type 30 has an invalid length. [ 655.867293][T17506] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4698'. [ 656.736507][T17527] lo speed is unknown, defaulting to 1000 [ 656.848374][ T37] audit: type=1326 audit(1681.585:442): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17535 comm="syz.9.4711" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fecd5c0ebe9 code=0x0 [ 656.931958][T17537] atomic_op ffff88802efe3218 conn xmit_atomic 0000000000000000 [ 657.322579][T17542] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 657.558386][T17546] netlink: 55631 bytes leftover after parsing attributes in process `syz.8.4714'. [ 657.558423][T17546] netlink: 6320 bytes leftover after parsing attributes in process `syz.8.4714'. [ 657.558437][T17546] netlink: 6 bytes leftover after parsing attributes in process `syz.8.4714'. [ 658.785120][T17587] netlink: 'syz.9.4733': attribute type 13 has an invalid length. [ 658.785142][T17587] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4733'. [ 658.835231][T17587] netlink: 'syz.9.4733': attribute type 13 has an invalid length. [ 658.835252][T17587] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4733'. [ 658.835323][ T1132] netdevsim netdevsim9 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.835646][ T1132] netdevsim netdevsim9 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.835681][ T1132] netdevsim netdevsim9 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.835711][ T1132] netdevsim netdevsim9 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.040843][T17593] netlink: 104 bytes leftover after parsing attributes in process `syz.7.4738'. [ 660.260763][T17631] netlink: 'syz.9.4754': attribute type 21 has an invalid length. [ 660.260786][T17631] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4754'. [ 660.261042][T17631] netlink: 'syz.9.4754': attribute type 21 has an invalid length. [ 660.261056][T17631] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4754'. [ 660.406783][T17636] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 660.509208][T17640] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4756'. [ 663.034246][ T37] audit: type=1326 audit(1687.765:443): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.8.4774" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5545d0ebe9 code=0x7fc00000 [ 664.244618][ T6012] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 664.397157][ T6012] usb 3-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 664.397185][ T6012] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.407535][ T6012] usb 3-1: config 0 descriptor?? [ 664.666726][ T6012] kaweth 3-1:0.0: Firmware present in device. [ 664.837550][ T6012] kaweth 3-1:0.0: Statistics collection: 0 [ 664.837571][ T6012] kaweth 3-1:0.0: Multicast filter limit: 0 [ 664.837584][ T6012] kaweth 3-1:0.0: MTU: 0 [ 664.837595][ T6012] kaweth 3-1:0.0: Read MAC address 00:00:00:00:00:00 [ 665.458864][ T37] audit: type=1326 audit(1690.195:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17728 comm="syz.9.4795" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fecd5c0ebe9 code=0x7fc00000 [ 665.495568][ T6012] kaweth 3-1:0.0: kaweth interface created at eth13 [ 665.647939][ T49] usb 3-1: USB disconnect, device number 57 [ 666.584541][T17775] netlink: 'syz.4.4814': attribute type 3 has an invalid length. [ 666.746158][T17777] 9pnet_fd: Insufficient options for proto=fd [ 666.954921][T17785] Bluetooth: hci0: invalid length 0, exp 2 for type 3 [ 667.100669][T17791] tipc: Started in network mode [ 667.100697][T17791] tipc: Node identity ac14140f, cluster identity 4711 [ 667.101022][T17791] tipc: New replicast peer: 255.255.255.255 [ 667.101559][T17791] tipc: Enabled bearer , priority 10 [ 667.346335][ T37] audit: type=1326 audit(1692.075:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17798 comm="syz.2.4825" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc40461ebe9 code=0x0 [ 668.110107][ T49] tipc: Node number set to 2886997007 [ 668.309168][ T37] audit: type=1326 audit(1693.045:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17807 comm="syz.2.4829" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x0 [ 668.536216][T17812] 9pnet_fd: Insufficient options for proto=fd [ 669.273119][T17824] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.4834'. [ 669.978309][ T37] audit: type=1326 audit(1694.715:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17829 comm="syz.2.4837" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc40461ebe9 code=0x0 [ 670.460104][T17842] netlink: 16 bytes leftover after parsing attributes in process `syz.8.4841'. [ 670.460127][T17842] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4841'. [ 672.516325][T17884] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4857'. [ 672.516882][T17884] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4857'. [ 673.590337][T10116] libceph: connect (1)[c::]:6789 error -101 [ 673.590571][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 673.591273][T10116] libceph: connect (1)[c::]:6789 error -101 [ 673.591401][ T6012] libceph: connect (1)[c::]:6789 error -101 [ 673.591483][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 673.591598][ T6012] libceph: mon0 (1)[c::]:6789 connect error [ 673.855631][T10116] libceph: connect (1)[c::]:6789 error -101 [ 673.855869][T10116] libceph: mon0 (1)[c::]:6789 connect error [ 673.875272][ T10] libceph: connect (1)[c::]:6789 error -101 [ 673.875496][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 674.326010][T17909] ceph: No mds server is up or the cluster is laggy [ 674.331208][T17904] ceph: No mds server is up or the cluster is laggy [ 674.378993][ T31] libceph: connect (1)[c::]:6789 error -101 [ 674.379237][ T31] libceph: mon0 (1)[c::]:6789 connect error [ 674.385356][ T10] libceph: connect (1)[c::]:6789 error -101 [ 674.385574][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 674.388388][T17920] : renamed from bridge_slave_0 (while UP) [ 675.239142][T17938] netlink: 51 bytes leftover after parsing attributes in process `syz.4.4881'. [ 676.254095][T17956] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4888'. [ 676.538921][ T37] audit: type=1326 audit(1701.275:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17960 comm="syz.4.4891" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x0 [ 678.222664][T17976] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0 [ 678.232816][T17975] IPVS: stopping master sync thread 17976 ... [ 678.564752][T17978] 9pnet: p9_errstr2errno: server reported unknown error @pA;KZ44/@qkp [ 678.564752][T17978] [ 680.057530][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805bb54400: rx timeout, send abort [ 680.557601][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805bb54400: abort rx timeout. Force session deactivation [ 681.377853][T18026] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 682.584712][ T6012] usb 3-1: new full-speed USB device number 58 using dummy_hcd [ 682.740831][ T6012] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 682.740865][ T6012] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 682.740887][ T6012] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 682.783158][ T6012] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 682.783186][ T6012] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.783204][ T6012] usb 3-1: Product: syz [ 682.783216][ T6012] usb 3-1: Manufacturer: syz [ 682.783229][ T6012] usb 3-1: SerialNumber: syz [ 682.826683][ T6012] usb 3-1: config 0 descriptor?? [ 682.827483][T18051] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 682.827604][T18051] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 682.829855][ T6012] usb 3-1: ucan: probing device on interface #0 [ 683.334750][T10116] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 683.499239][T10116] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 683.499262][T10116] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 683.500391][ T6012] ucan 3-1:0.0 can0: registered device [ 683.500802][T10116] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 683.500825][T10116] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 683.500841][T10116] usb 8-1: SerialNumber: syz [ 683.680514][ T6012] ucan 3-1:0.0 can0: firmware string: w [ 683.749755][T10116] usb 8-1: 0:2 : does not exist [ 683.906434][ T31] usb 3-1: USB disconnect, device number 58 [ 683.947347][T10116] usb 8-1: USB disconnect, device number 43 [ 684.176112][T18083] syz.8.4943: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz8,mems_allowed=0-1 [ 684.176364][T18083] CPU: 0 UID: 0 PID: 18083 Comm: syz.8.4943 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 684.176386][T18083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 684.176399][T18083] Call Trace: [ 684.176427][T18083] [ 684.176435][T18083] dump_stack_lvl+0x189/0x250 [ 684.176470][T18083] ? __pfx_dump_stack_lvl+0x10/0x10 [ 684.176494][T18083] ? __pfx__printk+0x10/0x10 [ 684.176516][T18083] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 684.176535][T18083] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 684.176555][T18083] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 684.176577][T18083] warn_alloc+0x22e/0x3b0 [ 684.176602][T18083] ? stack_trace_save+0x9c/0xe0 [ 684.176627][T18083] ? __pfx_warn_alloc+0x10/0x10 [ 684.176658][T18083] ? __kasan_kmalloc+0x93/0xb0 [ 684.176677][T18083] ? __kmalloc_cache_noprof+0x1a8/0x320 [ 684.176697][T18083] ? xskq_create+0x56/0x170 [ 684.176716][T18083] ? xsk_init_queue+0xb0/0x110 [ 684.176734][T18083] ? xsk_setsockopt+0x57b/0x8d0 [ 684.176752][T18083] ? do_sock_setsockopt+0x17c/0x1b0 [ 684.176773][T18083] ? __x64_sys_setsockopt+0x145/0x1b0 [ 684.176801][T18083] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.176826][T18083] __vmalloc_node_range_noprof+0x125/0x12f0 [ 684.176883][T18083] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 684.176916][T18083] ? __kasan_kmalloc+0x93/0xb0 [ 684.176940][T18083] vmalloc_user_noprof+0xad/0xf0 [ 684.176964][T18083] ? xskq_create+0xbf/0x170 [ 684.176986][T18083] xskq_create+0xbf/0x170 [ 684.177011][T18083] xsk_init_queue+0xb0/0x110 [ 684.177035][T18083] xsk_setsockopt+0x57b/0x8d0 [ 684.177057][T18083] ? __pfx_xsk_setsockopt+0x10/0x10 [ 684.177084][T18083] ? __fget_files+0x2a/0x420 [ 684.177111][T18083] ? __fget_files+0x2a/0x420 [ 684.177132][T18083] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 684.177149][T18083] ? __pfx_xsk_setsockopt+0x10/0x10 [ 684.177171][T18083] do_sock_setsockopt+0x17c/0x1b0 [ 684.177199][T18083] __x64_sys_setsockopt+0x145/0x1b0 [ 684.177228][T18083] do_syscall_64+0xfa/0x3b0 [ 684.177250][T18083] ? lockdep_hardirqs_on+0x9c/0x150 [ 684.177272][T18083] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.177289][T18083] ? clear_bhb_loop+0x60/0xb0 [ 684.177311][T18083] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.177328][T18083] RIP: 0033:0x7f5545d0ebe9 [ 684.177345][T18083] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 684.177359][T18083] RSP: 002b:00007f5543f76038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 684.177377][T18083] RAX: ffffffffffffffda RBX: 00007f5545f45fa0 RCX: 00007f5545d0ebe9 [ 684.177390][T18083] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000004 [ 684.177402][T18083] RBP: 00007f5545d91e19 R08: 0000000000000004 R09: 0000000000000000 [ 684.177413][T18083] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 684.177425][T18083] R13: 00007f5545f46038 R14: 00007f5545f45fa0 R15: 00007fff3f1ae6d8 [ 684.177457][T18083] [ 684.177472][T18083] Mem-Info: [ 684.177484][T18083] active_anon:255 inactive_anon:10373 isolated_anon:0 [ 684.177484][T18083] active_file:15766 inactive_file:44012 isolated_file:0 [ 684.177484][T18083] unevictable:777 dirty:307 writeback:0 [ 684.177484][T18083] slab_reclaimable:11865 slab_unreclaimable:115932 [ 684.177484][T18083] mapped:32182 shmem:5261 pagetables:1512 [ 684.177484][T18083] sec_pagetables:0 bounce:0 [ 684.177484][T18083] kernel_misc_reclaimable:0 [ 684.177484][T18083] free:1291994 free_pcp:7645 free_cma:0 [ 684.177536][T18083] Node 0 active_anon:1020kB inactive_anon:41492kB active_file:62808kB inactive_file:176048kB unevictable:1572kB isolated(anon):0kB isolated(file):0kB mapped:128676kB dirty:1228kB writeback:0kB shmem:19508kB kernel_stack:13968kB pagetables:5908kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 684.177580][T18083] Node 1 active_anon:0kB inactive_anon:0kB active_file:256kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:52kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:48kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 684.177622][T18083] Node 0 DMA free:15360kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 684.177679][T18083] lowmem_reserve[]: 0 2512 2513 2513 2513 [ 684.177711][T18083] Node 0 DMA32 free:1253560kB boost:0kB min:3940kB low:6484kB high:9028kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1016kB inactive_anon:41452kB active_file:61792kB inactive_file:175980kB unevictable:1572kB writepending:1228kB present:3129332kB managed:2572324kB mlocked:0kB bounce:0kB free_pcp:30576kB local_pcp:11024kB free_cma:0kB [ 684.177767][T18083] lowmem_reserve[]: 0 0 1 1 1 [ 684.177807][T18083] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:40kB active_file:1016kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 684.177857][T18083] lowmem_reserve[]: 0 0 0 0 0 [ 684.177887][T18083] Node 1 Normal free:3899056kB boost:0kB min:6364kB low:10472kB high:14580kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:256kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 684.177939][T18083] lowmem_reserve[]: 0 0 0 0 0 [ 684.177967][T18083] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 684.178072][T18083] Node 0 DMA32: 351*4kB (UME) 137*8kB (UME) 59*16kB (UE) 476*32kB (UME) 534*64kB (UME) 283*128kB (UME) 183*256kB (UME) 97*512kB (UME) 51*1024kB (UME) 20*2048kB (UM) 238*4096kB (UM) = 1253620kB [ 684.178206][T18083] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 684.178292][T18083] Node 1 Normal: 210*4kB (UME) 45*8kB (UME) 48*16kB (UME) 212*32kB (UME) 96*64kB (UME) 39*128kB (UME) 11*256kB (UM) 7*512kB (UM) 4*1024kB (UM) 3*2048kB (UME) 943*4096kB (M) = 3899056kB [ 684.178431][T18083] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 684.178446][T18083] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 684.178461][T18083] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 684.178476][T18083] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 684.178490][T18083] 65035 total pagecache pages [ 684.178502][T18083] 0 pages in swap cache [ 684.178509][T18083] Free swap = 124996kB [ 684.178515][T18083] Total swap = 124996kB [ 684.178522][T18083] 2097051 pages RAM [ 684.178528][T18083] 0 pages HighMem/MovableOnly [ 684.178535][T18083] 422072 pages reserved [ 684.178541][T18083] 0 pages cma reserved [ 685.490759][T18116] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4960'. [ 685.541084][T18116] veth1_macvtap: left promiscuous mode [ 686.940581][T18163] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4975'. [ 687.029108][T18163] gretap0: entered promiscuous mode [ 687.056501][T18166] netlink: 5 bytes leftover after parsing attributes in process `syz.4.4975'. [ 687.089690][T18166] 0{X: renamed from gretap0 [ 687.118440][T18166] 0{X: left promiscuous mode [ 687.118468][T18166] 0{X: entered allmulticast mode [ 687.141973][T18166] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 688.600332][T18208] lo speed is unknown, defaulting to 1000 [ 688.713923][T18213] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4996'. [ 688.943681][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805433f000: rx timeout, send abort [ 688.943855][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805433c000: rx timeout, send abort [ 688.944051][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805433f000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 688.944209][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805433c000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 689.153258][T18229] 9pnet_fd: Insufficient options for proto=fd [ 689.893536][T18245] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5007'. [ 689.893559][T18245] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5007'. [ 689.893584][T18245] netlink: 'syz.8.5007': attribute type 20 has an invalid length. [ 689.897809][T18245] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5007'. [ 689.897833][T18245] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5007'. [ 689.897856][T18245] netlink: 'syz.8.5007': attribute type 20 has an invalid length. [ 690.755941][T18271] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 691.180634][T18282] netlink: 28 bytes leftover after parsing attributes in process `syz.9.5024'. [ 691.557207][T18292] overlayfs: failed to clone upperpath [ 691.890559][T18300] mac80211_hwsim hwsim21 `: renamed from wlan1 [ 693.460517][T18336] loop2: detected capacity change from 0 to 7 [ 693.462768][T18336] Dev loop2: unable to read RDB block 7 [ 693.462804][T18336] loop2: AHDI p3 p4 [ 693.462831][T18336] loop2: partition table partially beyond EOD, truncated [ 693.463001][T18336] loop2: p3 start 1869967406 is beyond EOD, truncated [ 694.812513][T18365] lo speed is unknown, defaulting to 1000 [ 695.266444][ T9] hid-generic 0000:3000000:0000.0044: unknown main item tag 0x4 [ 695.266480][ T9] hid-generic 0000:3000000:0000.0044: unknown main item tag 0x2 [ 695.266549][ T9] hid-generic 0000:3000000:0000.0044: unknown main item tag 0x3 [ 695.310175][ T9] hid-generic 0000:3000000:0000.0044: hidraw0: HID v0.00 Device [sy] on syz0 [ 695.656342][T18395] Bluetooth: hci0: unsupported parameter 5148 [ 695.656365][T18395] Bluetooth: hci0: unsupported parameter 65024 [ 695.656377][T18395] Bluetooth: hci0: unsupported parameter 5148 [ 695.656387][T18395] Bluetooth: hci0: unsupported parameter 65024 [ 695.981350][T18401] netlink: 20 bytes leftover after parsing attributes in process `syz.7.5075'. [ 696.919214][T18414] tipc: Started in network mode [ 696.919231][T18414] tipc: Node identity , cluster identity 4711 [ 696.919243][T18414] tipc: Failed to obtain node identity [ 696.919271][T18414] tipc: Enabling of bearer rejected, failed to enable media [ 698.432202][T18456] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 701.135916][T18495] overlayfs: failed to clone upperpath [ 702.519178][T18542] netlink: 'syz.9.5133': attribute type 11 has an invalid length. [ 702.589462][T18543] netlink: 'syz.2.5134': attribute type 10 has an invalid length. [ 702.643200][T18543] dummy0: entered allmulticast mode [ 702.656567][T18543] team0: Port device dummy0 added [ 702.657614][T18545] netlink: 'syz.2.5134': attribute type 10 has an invalid length. [ 702.738125][T18545] dummy0: left allmulticast mode [ 702.802572][T18545] team0: Port device dummy0 removed [ 702.817251][T18545] dummy0: entered promiscuous mode [ 702.817467][T18545] dummy0: entered allmulticast mode [ 702.818928][T18545] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 703.850827][ T37] audit: type=1326 audit(1728.585:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=18574 comm="syz.7.5146" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f50df31ebe9 code=0x0 [ 704.674146][ T37] audit: type=1804 audit(1729.365:450): pid=18593 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz.2.5152" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=78880 res=1 errno=0 [ 705.048814][T18601] netlink: 'syz.2.5154': attribute type 4 has an invalid length. [ 705.048837][T18601] netlink: 14345 bytes leftover after parsing attributes in process `syz.2.5154'. [ 705.471206][T18608] lo speed is unknown, defaulting to 1000 [ 705.622172][T18614] netlink: 'syz.9.5158': attribute type 2 has an invalid length. [ 705.622191][T18614] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5158'. [ 706.392687][T18624] mac80211_hwsim hwsim9 `: renamed from wlan1 [ 706.769748][T18628] lo speed is unknown, defaulting to 1000 [ 707.597143][T18635] netlink: 'syz.4.5166': attribute type 4 has an invalid length. [ 707.865287][T10116] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 708.095042][T10116] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 708.095073][T10116] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 708.095110][T10116] usb 8-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 708.095131][T10116] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 708.104073][T10116] usb 8-1: config 0 descriptor?? [ 709.142773][T10116] uclogic 0003:256C:006D.0045: failed retrieving string descriptor #100: -71 [ 709.142842][T10116] uclogic 0003:256C:006D.0045: failed retrieving pen parameters: -71 [ 709.142863][T10116] uclogic 0003:256C:006D.0045: failed probing pen v1 parameters: -71 [ 709.142911][T10116] uclogic 0003:256C:006D.0045: failed probing parameters: -71 [ 709.143006][T10116] uclogic 0003:256C:006D.0045: probe with driver uclogic failed with error -71 [ 709.195948][T10116] usb 8-1: USB disconnect, device number 44 [ 709.539660][T18672] netlink: 'syz.2.5183': attribute type 39 has an invalid length. [ 710.433953][T18692] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.5190'. [ 710.766359][T18709] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5197'. [ 710.974752][T10116] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 711.124772][T10116] usb 8-1: Using ep0 maxpacket: 8 [ 711.130872][T10116] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 711.130899][T10116] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 711.130917][T10116] usb 8-1: Product: syz [ 711.130929][T10116] usb 8-1: Manufacturer: syz [ 711.130942][T10116] usb 8-1: SerialNumber: syz [ 711.174171][T10116] usb 8-1: config 0 descriptor?? [ 711.410709][T10116] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 712.216004][T18747] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 712.272051][T10116] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 712.293405][T10116] usb 8-1: USB disconnect, device number 45 [ 712.538126][T18756] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 712.683230][T18760] 9pnet: p9_errstr2errno: server reported unknown error l [ 713.181483][T18776] lo speed is unknown, defaulting to 1000 [ 713.631468][T18793] netlink: 104 bytes leftover after parsing attributes in process `syz.9.5235'. [ 715.105888][T18834] hsr0: entered allmulticast mode [ 715.105909][T18834] hsr_slave_0: entered allmulticast mode [ 715.105931][T18834] hsr_slave_1: entered allmulticast mode [ 715.124673][ T31] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 715.205087][T18834] hsr_slave_0: left promiscuous mode [ 715.246367][T18834] hsr_slave_1: left promiscuous mode [ 715.339197][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 715.339325][ T31] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 715.339347][ T31] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 715.339389][ T31] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 715.339410][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.417631][ T31] usb 3-1: config 0 descriptor?? [ 715.439403][T18834] hsr0 (unregistering): left allmulticast mode [ 715.712082][T18839] lo speed is unknown, defaulting to 1000 [ 715.859472][ T31] plantronics 0003:047F:FFFF.0046: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 717.925383][ T6012] usb 3-1: USB disconnect, device number 59 [ 719.141604][T18899] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5280'. [ 719.786696][ T49] delete_channel: no stack [ 720.068418][T18923] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5290'. [ 722.192000][T18998] fuse: Bad value for 'fd' [ 723.274993][ T49] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 723.445048][ T49] usb 8-1: Using ep0 maxpacket: 32 [ 723.454138][ T49] usb 8-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 723.454165][ T49] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 723.454184][ T49] usb 8-1: Product: syz [ 723.454197][ T49] usb 8-1: Manufacturer: syz [ 723.454209][ T49] usb 8-1: SerialNumber: syz [ 723.496915][ T49] usb 8-1: config 0 descriptor?? [ 723.518743][ T49] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 724.777535][ T49] gspca_stk1135: reg_w 0xd err -71 [ 724.778598][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778611][ T49] gspca_stk1135: Sensor write failed [ 724.778633][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778641][ T49] gspca_stk1135: Sensor write failed [ 724.778667][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778676][ T49] gspca_stk1135: Sensor read failed [ 724.778697][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778706][ T49] gspca_stk1135: Sensor read failed [ 724.778712][ T49] gspca_stk1135: Detected sensor type unknown (0x0) [ 724.778737][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778745][ T49] gspca_stk1135: Sensor read failed [ 724.778765][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778773][ T49] gspca_stk1135: Sensor read failed [ 724.778793][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778801][ T49] gspca_stk1135: Sensor write failed [ 724.778821][ T49] gspca_stk1135: serial bus timeout: status=0x00 [ 724.778829][ T49] gspca_stk1135: Sensor write failed [ 724.778914][ T49] stk1135 8-1:0.0: probe with driver stk1135 failed with error -71 [ 724.909229][ T49] usb 8-1: USB disconnect, device number 46 [ 725.454289][T19089] ipvlan2: entered promiscuous mode [ 726.781068][T19117] lo speed is unknown, defaulting to 1000 [ 727.914364][T19138] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5368'. [ 728.669971][T19160] 9pnet_fd: Insufficient options for proto=fd [ 728.703975][T19162] netlink: 'syz.4.5378': attribute type 1 has an invalid length. [ 728.703996][T19162] netlink: 'syz.4.5378': attribute type 4 has an invalid length. [ 728.704007][T19162] netlink: 15334 bytes leftover after parsing attributes in process `syz.4.5378'. [ 728.880196][ C0] vkms_vblank_simulate: vblank timer overrun [ 729.434348][T19187] netlink: 'syz.4.5390': attribute type 1 has an invalid length. [ 729.534824][ T9] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 729.700112][T19187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 729.704656][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 729.731741][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 729.731773][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 729.731793][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 729.731832][ T9] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 729.731851][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 729.764284][ T9] usb 3-1: config 0 descriptor?? [ 729.884037][T19189] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 730.242352][ T9] shield 0003:0955:7214.0047: unknown main item tag 0x0 [ 730.242377][ T9] shield 0003:0955:7214.0047: unknown main item tag 0x0 [ 730.242392][ T9] shield 0003:0955:7214.0047: unknown main item tag 0x0 [ 730.242407][ T9] shield 0003:0955:7214.0047: unknown main item tag 0x0 [ 730.242421][ T9] shield 0003:0955:7214.0047: unknown main item tag 0x0 [ 730.251692][ T9] input: HID 0955:7214 Haptics as /devices/virtual/input/input69 [ 730.435710][T19183] random: crng reseeded on system resumption [ 730.589555][ T9] shield 0003:0955:7214.0047: Registered Thunderstrike controller [ 730.589926][ T9] shield 0003:0955:7214.0047: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 730.999345][ T6012] shield 0003:0955:7214.0047: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 731.002224][ T6012] shield 0003:0955:7214.0047: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 731.002713][T10101] usb 3-1: USB disconnect, device number 60 [ 731.004765][ T6012] shield 0003:0955:7214.0047: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 732.457752][T19253] netlink: 16 bytes leftover after parsing attributes in process `syz.7.5415'. [ 737.289855][T19363] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5463'. [ 737.461002][T19369] Invalid ELF header magic: != ELF [ 737.679956][T19375] netlink: 56 bytes leftover after parsing attributes in process `syz.9.5468'. [ 739.754297][T19427] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 741.854921][T19465] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5503'. [ 741.854964][T19465] netlink: 'syz.8.5503': attribute type 15 has an invalid length. [ 741.854978][T19465] netlink: 'syz.8.5503': attribute type 18 has an invalid length. [ 743.141000][ T37] audit: type=1326 audit(1767.875:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19486 comm="syz.8.5512" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5545d0ebe9 code=0x0 [ 744.709695][T19526] netlink: 'syz.4.5526': attribute type 12 has an invalid length. [ 744.709715][T19526] netlink: 'syz.4.5526': attribute type 29 has an invalid length. [ 744.709727][T19526] netlink: 148 bytes leftover after parsing attributes in process `syz.4.5526'. [ 746.251551][T19561] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.5542'. [ 748.179596][T19581] lo speed is unknown, defaulting to 1000 [ 749.248887][T19603] Bluetooth: hci0: invalid length 0, exp 2 for type 5 [ 749.997059][ C1] vkms_vblank_simulate: vblank timer overrun [ 750.156804][ T10] IPVS: starting estimator thread 0... [ 750.274734][T19629] IPVS: using max 7 ests per chain, 16800 per kthread [ 750.967564][T19652] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 751.090318][T19657] netlink: 'syz.4.5580': attribute type 12 has an invalid length. [ 751.090341][T19657] netlink: 'syz.4.5580': attribute type 29 has an invalid length. [ 751.090353][T19657] netlink: 148 bytes leftover after parsing attributes in process `syz.4.5580'. [ 751.090380][T19657] netlink: 51 bytes leftover after parsing attributes in process `syz.4.5580'. [ 751.648356][T19673] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 752.825100][ T9] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 752.977286][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 752.980415][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 752.980431][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.980441][ T9] usb 3-1: Product: syz [ 752.980447][ T9] usb 3-1: Manufacturer: syz [ 752.980454][ T9] usb 3-1: SerialNumber: syz [ 753.531821][T19722] overlayfs: failed to clone upperpath [ 753.619112][ T9] cdc_ncm 3-1:1.0: failed GET_NTB_PARAMETERS [ 753.619196][ T9] cdc_ncm 3-1:1.0: bind() failure [ 753.650399][ T9] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 753.650445][ T9] cdc_ncm 3-1:1.1: bind() failure [ 753.695106][ T9] usb 3-1: USB disconnect, device number 61 [ 753.876771][T19729] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 754.609469][T19746] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5616'. [ 754.643670][T19746] erspan0: entered promiscuous mode [ 754.643999][T19746] macvtap0: entered promiscuous mode [ 754.644183][T19746] macvtap0: entered allmulticast mode [ 754.644197][T19746] erspan0: entered allmulticast mode [ 754.756927][T19748] erspan0: left allmulticast mode [ 754.757164][T19748] erspan0: left promiscuous mode [ 754.977117][T19757] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5621'. [ 755.635868][T19777] fuse: root generation should be zero [ 756.137764][T19786] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 756.364027][T19793] netlink: 'syz.2.5637': attribute type 12 has an invalid length. [ 756.364049][T19793] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5637'. [ 756.388056][T19793] netlink: 'syz.2.5637': attribute type 12 has an invalid length. [ 756.388079][T19793] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5637'. [ 756.388127][ T1426] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 756.393731][ T1426] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 756.393779][ T1426] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 756.393822][ T1426] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 757.831725][T19830] bridge0: port 2(bridge_slave_1) entered disabled state [ 757.832435][T19830] bridge_slave_1: left allmulticast mode [ 757.832462][T19830] bridge_slave_1: left promiscuous mode [ 757.832722][T19830] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.345724][T19837] netlink: 120 bytes leftover after parsing attributes in process `syz.9.5652'. [ 758.735290][T19843] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 759.229896][T19861] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 760.580739][T19895] netlink: 'syz.7.5673': attribute type 10 has an invalid length. [ 760.747012][T19895] A link change request failed with some changes committed already. Interface may have been left with an inconsistent configuration, please check. [ 761.176005][ T49] IPVS: starting estimator thread 0... [ 761.276473][T19905] IPVS: using max 7 ests per chain, 16800 per kthread [ 761.326214][T10101] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 761.490683][T10101] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 761.490714][T10101] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 761.490750][T10101] usb 8-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 761.490771][T10101] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 761.528629][T10101] usb 8-1: config 0 descriptor?? [ 761.890096][T19921] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5686'. [ 761.890575][T19921] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5686'. [ 761.972648][T10101] cp2112 0003:10C4:EA90.0048: unknown main item tag 0x0 [ 762.015453][T10101] cp2112 0003:10C4:EA90.0048: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.7-1/input0 [ 762.125508][T19926] fuse: Bad value for 'fd' [ 762.199644][T10101] cp2112 0003:10C4:EA90.0048: Part Number: 0x00 Device Version: 0x4D [ 762.880064][T19942] lo speed is unknown, defaulting to 1000 [ 763.844954][ T49] usb 8-1: USB disconnect, device number 47 [ 763.956392][ T37] audit: type=1326 audit(1788.685:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19941 comm="syz.4.5695" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x0 [ 764.569554][T19975] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5707'. [ 764.570758][T19975] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5707'. [ 764.704804][ T49] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 764.825875][T19981] tipc: Started in network mode [ 764.825903][T19981] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 764.825951][T19981] tipc: Enabling of bearer rejected, failed to enable media [ 764.914658][ T49] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 764.914703][ T49] usb 8-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 764.914723][ T49] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.919849][ T49] usb 8-1: config 0 descriptor?? [ 765.384830][ T49] lenovo 0003:17EF:6047.0049: hidraw0: USB HID v0.00 Device [HID 17ef:6047] on usb-dummy_hcd.7-1/input0 [ 765.510764][T19996] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5715'. [ 766.304627][ T10] hid-generic 0000:0000:0000.004A: unknown main item tag 0x0 [ 766.315009][ T10] hid-generic 0000:0000:0000.004A: hidraw1: HID v0.00 Device [syz0] on syz0 [ 766.394907][T20006] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5720'. [ 766.490956][T10101] usb 8-1: USB disconnect, device number 48 [ 767.709651][T20043] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 767.789868][T20043] overlayfs: failed lookup in lower (/, name='bus', err=-66): unsupported object type [ 768.263978][T20053] netlink: 96 bytes leftover after parsing attributes in process `syz.9.5740'. [ 769.084618][ T10] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 769.237105][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 769.237130][ T10] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 769.241508][ T10] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 769.241535][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.241552][ T10] usb 3-1: Product: syz [ 769.241565][ T10] usb 3-1: Manufacturer: syz [ 769.241577][ T10] usb 3-1: SerialNumber: syz [ 769.535726][ T10] usb 3-1: 0:2 : does not exist [ 769.550171][ T10] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 769.593720][ T10] usb 3-1: USB disconnect, device number 62 [ 771.440026][T20126] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5771'. [ 771.440061][T20126] netlink: 'syz.4.5771': attribute type 7 has an invalid length. [ 771.440072][T20126] netlink: 'syz.4.5771': attribute type 8 has an invalid length. [ 771.440083][T20126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5771'. [ 771.489332][T20126] erspan0: entered promiscuous mode [ 771.499033][T20126] erspan0: left promiscuous mode [ 772.124630][ T10] usb 8-1: new high-speed USB device number 49 using dummy_hcd [ 772.274956][ T10] usb 8-1: Using ep0 maxpacket: 8 [ 772.277696][ T10] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 772.281061][ T10] usb 8-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 772.281086][ T10] usb 8-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 772.281104][ T10] usb 8-1: Product: syz [ 772.281116][ T10] usb 8-1: Manufacturer: syz [ 772.281128][ T10] usb 8-1: SerialNumber: syz [ 772.548847][ T10] usb 8-1: Handspring Visor / Palm OS: No valid connect info available [ 772.548870][ T10] usb 8-1: Handspring Visor / Palm OS: port 0, is for HotSync use [ 772.548886][ T10] usb 8-1: Handspring Visor / Palm OS: port 0, is for Generic use [ 772.548902][ T10] usb 8-1: Handspring Visor / Palm OS: Number of ports: 2 [ 772.749436][ T10] usb 8-1: palm_os_3_probe - error -71 getting bytes available request [ 772.749528][ T10] visor 8-1:1.0: Handspring Visor / Palm OS converter detected [ 772.774938][ T10] usb 8-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 772.781635][ T10] usb 8-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 772.806580][ T10] usb 8-1: USB disconnect, device number 49 [ 772.829773][ T10] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 772.856994][ T10] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 772.857544][ T10] visor 8-1:1.0: device disconnected [ 772.861656][T20158] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5785'. [ 773.155797][T20170] Bluetooth: hci0: invalid length 0, exp 2 for type 14 [ 773.556758][T20181] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5793'. [ 773.556792][T20181] netlink: 'syz.8.5793': attribute type 20 has an invalid length. [ 773.557055][T20181] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5793'. [ 773.557073][T20181] netlink: 'syz.8.5793': attribute type 20 has an invalid length. [ 773.850273][T20185] netlink: 36 bytes leftover after parsing attributes in process `syz.8.5794'. [ 776.811634][T20229] overlayfs: failed to clone upperpath [ 777.019333][T20237] loop2: detected capacity change from 0 to 7 [ 777.023213][T20237] Dev loop2: unable to read RDB block 7 [ 777.023242][T20237] loop2: AHDI p2 p3 [ 777.023271][T20237] loop2: partition table partially beyond EOD, truncated [ 777.023376][T20237] loop2: p3 start 335544320 is beyond EOD, truncated [ 777.676828][T20256] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 777.710514][T20256] batadv_slave_0: entered promiscuous mode [ 777.960937][T20258] gtp1: entered promiscuous mode [ 777.995657][T20258] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5828'. [ 781.698240][T20319] af_packet: tpacket_rcv: packet too big, clamped from 65232 to 4294967272. macoff=96 [ 784.191972][T20353] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 787.788219][T20411] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 788.360314][T20424] netlink: 24 bytes leftover after parsing attributes in process `syz.9.5890'. [ 792.338863][ T37] audit: type=1326 audit(1817.075:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 792.338912][ T37] audit: type=1326 audit(1817.075:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 792.338948][ T37] audit: type=1326 audit(1817.075:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 792.475643][ T37] audit: type=1326 audit(1817.195:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 792.506453][ T37] audit: type=1326 audit(1817.215:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 792.506504][ T37] audit: type=1326 audit(1817.235:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=20497 comm="syz.4.5924" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe22dbebe9 code=0x7ffc0000 [ 795.725567][T20534] overlayfs: failed to clone upperpath [ 796.184676][T20539] netlink: 'syz.4.5940': attribute type 10 has an invalid length. [ 796.315029][T20539] team0: Port device dummy0 added [ 797.359283][T20549] netlink: 56 bytes leftover after parsing attributes in process `syz.4.5942'. [ 797.818566][T20566] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5948'. [ 798.175712][T10101] kernel write not supported for file bpf-prog (pid: 10101 comm: kworker/1:7) [ 798.746481][T20593] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 800.046528][T20629] batadv_slave_0: entered promiscuous mode [ 800.449950][T20641] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5971'. [ 800.449980][T20641] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5971'. [ 802.206120][ C0] vkms_vblank_simulate: vblank timer overrun [ 802.800988][T20674] lo speed is unknown, defaulting to 1000 [ 803.562473][ C0] vkms_vblank_simulate: vblank timer overrun [ 803.693452][ C0] vkms_vblank_simulate: vblank timer overrun [ 803.764255][T20499] Set syz1 is full, maxelem 65536 reached [ 803.827901][ C0] vkms_vblank_simulate: vblank timer overrun [ 804.456602][ C0] vkms_vblank_simulate: vblank timer overrun [ 805.854551][ T6012] usb 8-1: new high-speed USB device number 50 using dummy_hcd [ 806.110233][ T6012] usb 8-1: Using ep0 maxpacket: 32 [ 806.112307][ T6012] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 806.125569][ T6012] usb 8-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 806.125595][ T6012] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 806.125613][ T6012] usb 8-1: Product: syz [ 806.125625][ T6012] usb 8-1: Manufacturer: syz [ 806.125638][ T6012] usb 8-1: SerialNumber: syz [ 806.131147][ T6012] usb 8-1: config 0 descriptor?? [ 806.139295][ T6012] cdc_ether 8-1:0.0: skipping garbage [ 806.139315][ T6012] usb 8-1: bad CDC descriptors [ 806.140477][ T6012] usb 8-1: unsupported MDLM descriptors [ 806.643232][ T49] usb 8-1: USB disconnect, device number 50 [ 807.396681][T20775] input: syz1 as /devices/virtual/input/input70 [ 807.695184][T20781] netlink: 'syz.8.6027': attribute type 1 has an invalid length. [ 807.695206][T20781] netlink: 'syz.8.6027': attribute type 4 has an invalid length. [ 807.695218][T20781] netlink: 9462 bytes leftover after parsing attributes in process `syz.8.6027'. [ 807.928372][T20789] netlink: 8 bytes leftover after parsing attributes in process `syz.8.6031'. [ 808.556796][ C0] ------------[ cut here ]------------ [ 808.556819][ C0] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 [ 808.556866][ C0] Modules linked in: [ 808.556888][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 808.556908][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 808.556920][ C0] RIP: 0010:est_timer+0x6dc/0x9f0 [ 808.556942][ C0] Code: ff c7 42 80 3c 23 00 74 08 4c 89 f7 e8 bd 2c 41 f9 4d 89 3e 42 80 3c 23 00 0f 85 54 ff ff ff e9 57 ff ff ff e8 d5 f4 e1 f8 90 <0f> 0b 90 e9 63 fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 65 fa ff ff [ 808.556958][ C0] RSP: 0018:ffffc900001577a0 EFLAGS: 00010246 [ 808.556976][ C0] RAX: ffffffff88dc69fb RBX: 0000000000000001 RCX: ffff88801beed940 [ 808.556991][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 808.557004][ C0] RBP: ffffc900001578b0 R08: 0000000000000000 R09: 0000000000000100 [ 808.557018][ C0] R10: dffffc0000000000 R11: fffff5200002af0a R12: 0000000000000008 [ 808.557029][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888075c95468 [ 808.557043][ C0] FS: 0000000000000000(0000) GS:ffff8881268c2000(0000) knlGS:0000000000000000 [ 808.557058][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 808.557072][ C0] CR2: 00007fc4053856c0 CR3: 0000000064b46000 CR4: 00000000003526f0 [ 808.557088][ C0] Call Trace: [ 808.557096][ C0] [ 808.557119][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.557153][ C0] call_timer_fn+0x17b/0x5f0 [ 808.557177][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.557195][ C0] ? call_timer_fn+0xbe/0x5f0 [ 808.557219][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 808.557251][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 808.557275][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 808.557298][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.557321][ C0] __run_timer_base+0x648/0x970 [ 808.557361][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 808.557405][ C0] run_timer_softirq+0xb7/0x180 [ 808.557428][ C0] handle_softirqs+0x22c/0x710 [ 808.557464][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 808.557496][ C0] run_ktimerd+0xcf/0x190 [ 808.557522][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 808.557545][ C0] ? schedule+0x91/0x360 [ 808.557577][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 808.557599][ C0] smpboot_thread_fn+0x542/0xa60 [ 808.557623][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 808.557658][ C0] kthread+0x711/0x8a0 [ 808.557692][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 808.557717][ C0] ? __pfx_kthread+0x10/0x10 [ 808.557752][ C0] ? __pfx_kthread+0x10/0x10 [ 808.557782][ C0] ret_from_fork+0x3f9/0x770 [ 808.557812][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 808.557840][ C0] ? __switch_to_asm+0x39/0x70 [ 808.557868][ C0] ? __switch_to_asm+0x33/0x70 [ 808.557885][ C0] ? __pfx_kthread+0x10/0x10 [ 808.557915][ C0] ret_from_fork_asm+0x1a/0x30 [ 808.557951][ C0] [ 808.557961][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 808.557976][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 808.557999][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 808.558010][ C0] Call Trace: [ 808.558018][ C0] [ 808.558025][ C0] dump_stack_lvl+0x99/0x250 [ 808.558054][ C0] ? __asan_memcpy+0x40/0x70 [ 808.558075][ C0] ? __pfx_dump_stack_lvl+0x10/0x10 [ 808.558103][ C0] ? __pfx__printk+0x10/0x10 [ 808.558142][ C0] vpanic+0x281/0x750 [ 808.558171][ C0] ? __pfx__printk+0x10/0x10 [ 808.558191][ C0] ? __pfx_vpanic+0x10/0x10 [ 808.558218][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 808.558260][ C0] panic+0xb9/0xc0 [ 808.558289][ C0] ? __pfx_panic+0x10/0x10 [ 808.558335][ C0] __warn+0x31b/0x4b0 [ 808.558361][ C0] ? est_timer+0x6dc/0x9f0 [ 808.558387][ C0] ? est_timer+0x6dc/0x9f0 [ 808.558409][ C0] report_bug+0x2be/0x4f0 [ 808.558435][ C0] ? est_timer+0x6dc/0x9f0 [ 808.558458][ C0] ? est_timer+0x6dc/0x9f0 [ 808.558479][ C0] ? est_timer+0x6de/0x9f0 [ 808.558500][ C0] handle_bug+0x84/0x160 [ 808.558531][ C0] exc_invalid_op+0x1a/0x50 [ 808.558560][ C0] asm_exc_invalid_op+0x1a/0x20 [ 808.558578][ C0] RIP: 0010:est_timer+0x6dc/0x9f0 [ 808.558601][ C0] Code: ff c7 42 80 3c 23 00 74 08 4c 89 f7 e8 bd 2c 41 f9 4d 89 3e 42 80 3c 23 00 0f 85 54 ff ff ff e9 57 ff ff ff e8 d5 f4 e1 f8 90 <0f> 0b 90 e9 63 fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c 65 fa ff ff [ 808.558618][ C0] RSP: 0018:ffffc900001577a0 EFLAGS: 00010246 [ 808.558637][ C0] RAX: ffffffff88dc69fb RBX: 0000000000000001 RCX: ffff88801beed940 [ 808.558653][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 808.558666][ C0] RBP: ffffc900001578b0 R08: 0000000000000000 R09: 0000000000000100 [ 808.558680][ C0] R10: dffffc0000000000 R11: fffff5200002af0a R12: 0000000000000008 [ 808.558695][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888075c95468 [ 808.558719][ C0] ? est_timer+0x6db/0x9f0 [ 808.558766][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.558802][ C0] call_timer_fn+0x17b/0x5f0 [ 808.558828][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.558847][ C0] ? call_timer_fn+0xbe/0x5f0 [ 808.558880][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 808.558917][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 808.558944][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 808.558968][ C0] ? __pfx_est_timer+0x10/0x10 [ 808.558993][ C0] __run_timer_base+0x648/0x970 [ 808.559036][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 808.559081][ C0] run_timer_softirq+0xb7/0x180 [ 808.559108][ C0] handle_softirqs+0x22c/0x710 [ 808.559145][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 808.559184][ C0] run_ktimerd+0xcf/0x190 [ 808.559211][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 808.559236][ C0] ? schedule+0x91/0x360 [ 808.559270][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 808.559293][ C0] smpboot_thread_fn+0x542/0xa60 [ 808.559320][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 808.559355][ C0] kthread+0x711/0x8a0 [ 808.559389][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 808.559414][ C0] ? __pfx_kthread+0x10/0x10 [ 808.559449][ C0] ? __pfx_kthread+0x10/0x10 [ 808.559480][ C0] ret_from_fork+0x3f9/0x770 [ 808.559509][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 808.559544][ C0] ? __switch_to_asm+0x39/0x70 [ 808.559562][ C0] ? __switch_to_asm+0x33/0x70 [ 808.559580][ C0] ? __pfx_kthread+0x10/0x10 [ 808.559610][ C0] ret_from_fork_asm+0x1a/0x30 [ 808.559660][ C0] [ 808.560021][ C0] Kernel Offset: disabled