last executing test programs: 8m6.526786893s ago: executing program 3 (id=89): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000200)={&(0x7f0000000180)=[{0x8a, 0x1000, 0x0, 0x0}], 0x1}) syz_usb_control_io(r1, 0x0, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, 0x0) ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, &(0x7f0000000040)=""/144) 8m2.60702592s ago: executing program 3 (id=97): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) socket$inet6(0xa, 0x805, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) r3 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r3, 0x0, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40186f40, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 8m1.763588499s ago: executing program 3 (id=99): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz0\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3f, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x40, 0x4, 0x25cd, 0x1, 0xb4, 0xd49, 0x80a2b9, 0x6, 0xb, 0xe4, 0x6, 0xfc000000, 0x2, 0xbbf, 0x4a732f64, 0x1, 0x3, 0x5, 0xfffffffd, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x1000, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x3, 0x4, 0x9, 0x1, 0x1, 0x10401, 0xfffffff5, 0x404, 0xa7, 0x81, 0x9, 0x8001, 0x0, 0xff, 0x2, 0x4, 0x9, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0xb4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x497d, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x6, 0x8, 0x2, 0x4, 0x8, 0xffffff7f, 0x400, 0x8, 0x4c2336d3, 0x4, 0x0, 0xfffffff6, 0x401, 0x46, 0xf1, 0x4, 0xab000e0, 0x5, 0x6, 0x2, 0x1, 0x8003ff, 0x1ff, 0x1, 0x7fff, 0x6, 0x1cb, 0x1, 0x80000004, 0x8, 0x438, 0x2, 0xa, 0x95, 0x80000001, 0x4, 0xfffffff9, 0x1, 0x1000, 0x8, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x5, 0x8d3, 0x200003, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10100a, 0x2, 0x400, 0x3e55, 0x5, 0xd3, 0x5, 0x97f7, 0x3, 0xd, 0x6, 0x603, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xe, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x9, 0x10000, 0xfefffffd, 0x5, 0x72], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0x3, 0x1005, 0x1, 0x9, 0x1e, 0x9, 0x812, 0x3, 0x0, 0xd, 0xfffffff7, 0x6, 0x140f2, 0x5396, 0x0, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0x98ce, 0x7fffffff, 0x100009, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7ffc, 0x3, 0x6, 0xf, 0xe, 0x1, 0x269, 0x6, 0x1, 0xa82b, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x109980, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000380)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x2}}, 0x10) sendmsg$key(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40400d5) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) ioctl$TFD_IOC_SET_TICKS(0xffffffffffffffff, 0x40085400, &(0x7f00000001c0)=0x8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 7m54.306603172s ago: executing program 3 (id=108): socket$inet6(0xa, 0x2, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x5c0c000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/devices.allow\x00', 0x2, 0xc8) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(0xffffffffffffffff, 0x2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}, 0x20) mknod(0x0, 0x8001420, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101001, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0xc015, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r1, 0x2, &(0x7f00000000c0)={0x1, 0x2}, 0x0) kcmp$KCMP_EPOLL_TFD(0x0, 0x0, 0x7, 0xffffffffffffffff, &(0x7f00000001c0)={r0, 0xffffffffffffffff, 0x18000000}) close_range(r1, 0xffffffffffffffff, 0x0) 7m51.83016742s ago: executing program 3 (id=113): sendmsg$unix(0xffffffffffffffff, 0x0, 0xc800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0xffffffff, 0xffffffffffffffff, 0x0, 0x0}) r1 = shmget$private(0x0, 0x800000, 0x0, &(0x7f0000173000/0x800000)=nil) shmat(r1, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000380)={'\x00', 0x7, 0xff, 0xfffffffa, 0x1ff, 0x1, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4}, 0x50) getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) r2 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14) setsockopt$packet_int(r2, 0x107, 0x10, &(0x7f00000001c0)=0x7, 0x4) socket$unix(0x1, 0x1, 0x0) r3 = syz_clone(0x80000400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r3) ptrace(0x8, r3) sched_setscheduler(r3, 0x6, &(0x7f0000000180)=0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000940)=ANY=[@ANYBLOB="043e0a0300c900080394000800"], 0xd) 7m50.845301124s ago: executing program 3 (id=115): sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) unshare(0x62040200) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r1, 0x84, 0x6d, &(0x7f0000001100)=""/4112, &(0x7f0000001040)=0x1010) r2 = syz_open_dev$dvb_demux(0x0, 0x0, 0x20000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(0xffffffffffffffff, 0x80083313, &(0x7f0000000100)) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x35, 0x0, 0x0, 0xfffffffd}, {0x20, 0x6, 0x0, 0x8}, {0x6, 0xfd, 0x0, 0x7ffffcbb}]}) ioctl$DVB_DEMUX_DMX_ADD_PID(r2, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r2, 0x6f29) socket$nl_generic(0x10, 0x3, 0x10) 7m34.762661663s ago: executing program 32 (id=115): sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0xc000) unshare(0x62040200) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r1, 0x84, 0x6d, &(0x7f0000001100)=""/4112, &(0x7f0000001040)=0x1010) r2 = syz_open_dev$dvb_demux(0x0, 0x0, 0x20000) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(0xffffffffffffffff, 0x80083313, &(0x7f0000000100)) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x35, 0x0, 0x0, 0xfffffffd}, {0x20, 0x6, 0x0, 0x8}, {0x6, 0xfd, 0x0, 0x7ffffcbb}]}) ioctl$DVB_DEMUX_DMX_ADD_PID(r2, 0x40026f33, &(0x7f00000000c0)=0x7) ioctl$DVB_DEMUX_DMX_START(r2, 0x6f29) socket$nl_generic(0x10, 0x3, 0x10) 2m46.400766302s ago: executing program 0 (id=766): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 2m44.935584301s ago: executing program 0 (id=768): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0b00000005000000000400000900000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000700)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000980)={r2}, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) 2m42.290896513s ago: executing program 0 (id=769): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0x2000}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/185, &(0x7f0000000140)=""/79, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000240)=0x1) 2m42.094416783s ago: executing program 0 (id=772): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0x3, 0x2) openat$vimc2(0xffffffffffffff9c, &(0x7f0000001240), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socket$kcm(0x2, 0x3, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 2m41.830357169s ago: executing program 0 (id=775): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) ioctl$KVM_CAP_PMU_CAPABILITY(r3, 0x4068aea3, &(0x7f0000000800)={0xd4, 0x0, 0x6}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = memfd_create(0x0, 0x2) execveat(r4, 0x0, 0x0, 0x0, 0x1000) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@dellinkprop={0x4c, 0x6d, 0x1, 0x709d27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1a, 0x2800}, [@IFLA_PROP_LIST={0x18, 0x34, 0x0, 0x1, [{0x14, 0x35, 'macvtap0\x00'}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bridge0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4048060}, 0x40000) 2m38.756587594s ago: executing program 0 (id=777): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x7, 0x0, 0x0, 0x20000010}, 0x4090) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xaa17bfcc0c104563, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r6, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r6, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xfee0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x25dfdb7c, {0x60, 0x0, 0x0, r1, {}, {0x1, 0x2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x12, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x6}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40004}, 0x20040000) 2m23.253865884s ago: executing program 33 (id=777): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x7, 0x0, 0x0, 0x20000010}, 0x4090) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xaa17bfcc0c104563, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) ioctl$PPPOEIOCSFWD(0xffffffffffffffff, 0x4008b100, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r6, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r6, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xfee0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x40, 0x24, 0xd0f, 0x0, 0x25dfdb7c, {0x60, 0x0, 0x0, r1, {}, {0x1, 0x2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x12, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x2, 0xb, 0x6}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40004}, 0x20040000) 45.376768576s ago: executing program 1 (id=1018): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0x2000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/185, 0x0, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) 44.178322173s ago: executing program 1 (id=1021): ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ftruncate(0xffffffffffffffff, 0x2007ffb) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000480)=@generic={&(0x7f0000000440)='./file0\x00', 0x0, 0x8}, 0x18) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) 43.853344887s ago: executing program 1 (id=1023): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="19000000040000000400000003"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70200000000f900850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000002200000000000000160000008500000061000000850000005000000095"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r2, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r4}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 43.214788076s ago: executing program 1 (id=1025): r0 = syz_open_dev$sndctrl(&(0x7f0000000440), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, 0x0, 0x1000000) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0505510, &(0x7f0000000480)={0x3, 0x1, 0x3, 0x4, &(0x7f0000001c00)=[{}]}) socket$inet6_sctp(0xa, 0x1, 0x84) 42.004123787s ago: executing program 1 (id=1028): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30"], 0xe4}}, 0x20050840) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b82f8ff"], 0x0, 0x4, 0x0, 0x0, 0x0, 0xc}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 41.796380382s ago: executing program 1 (id=1030): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004004}}], 0x1, 0xc000) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) 26.447608685s ago: executing program 34 (id=1030): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004004}}], 0x1, 0xc000) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x8, 0x3, 0x7, 0x7, 0x3, 0x800, 0x6}, 0x0, 0x0, 0x0, 0x0) 10.477850056s ago: executing program 5 (id=1113): r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xe, 0x4, 0x4, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r1}, &(0x7f0000000500), &(0x7f0000000540)=r1}, 0x20) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) shutdown(r4, 0x1) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/user\x00') getsockname$packet(r3, 0x0, &(0x7f0000001bc0)) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@bloom_filter={0x1e, 0x0, 0x0, 0xffffff2b, 0x33a, r1, 0x8000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x5, 0x3, 0xe}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f00000000c0)={r6, 0x0, 0x0, 0x4}, 0x20) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r5, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4010}, 0xc100) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000140)={'erspan0\x00', &(0x7f0000000040)={'gretap0\x00', 0x0, 0x8, 0x10, 0x6e, 0x5, {{0x19, 0x4, 0x0, 0x8, 0x64, 0x68, 0x0, 0x9, 0x73c4ce55f9c778f1, 0x0, @private=0xa010101, @empty, {[@lsrr={0x83, 0xb, 0xf, [@loopback, @dev={0xac, 0x14, 0x14, 0xc}]}, @generic={0x7, 0x9, "693d74fb41c1dd"}, @lsrr={0x83, 0x3, 0xe}, @timestamp_addr={0x44, 0x34, 0xbc, 0x1, 0x5, [{@multicast2, 0x5}, {@private=0xa010102, 0x8}, {@dev={0xac, 0x14, 0x14, 0x23}, 0x8000}, {@local, 0x80000000}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x6}, {@empty, 0x6}]}, @ra={0x94, 0x4, 0x1}, @noop]}}}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000800) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000300)={'syztnl2\x00', 0x0, 0x4, 0xe, 0x76, 0xfffffff5, 0x2, @ipv4={'\x00', '\xff\xff', @local}, @loopback, 0x40, 0x700, 0x6, 0x5}}) 9.416396925s ago: executing program 4 (id=1116): ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2007ffb) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000480)=@generic={&(0x7f0000000440)='./file0\x00', 0x0, 0x8}, 0x18) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) 9.222665663s ago: executing program 4 (id=1117): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}, {0x0}], 0x2) socket$nl_crypto(0x10, 0x3, 0x15) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1ff, 0x4) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r1], 0x108}}], 0x1, 0xc040) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) 9.111307339s ago: executing program 5 (id=1119): openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @local}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 7.926052558s ago: executing program 4 (id=1120): mkdirat(0xffffffffffffff9c, 0x0, 0x1a) mount$bind(&(0x7f0000000200)='.\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89901) unshare(0x22020600) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f00000058c0)={0x2020}, 0x2020) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) 7.719698585s ago: executing program 5 (id=1121): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=@newtaction={0x58, 0x30, 0x1, 0x70bd29, 0x0, {}, [{0x44, 0x1, [@m_mpls={0x40, 0x1, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0xcf474}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8863}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x58}}, 0x800) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000480)={0x1ff, 0x1ff, 0x2, {0x4, @pix_mp={0xffffffff, 0xf, 0x31363553, 0x7, 0xd, [{0x9, 0x5}, {0x22955b83, 0x7f68}, {0x5, 0x4}, {0x28, 0x3}, {0x6, 0x5}, {0x800, 0x3}, {0x5, 0xb33b}, {0x3, 0x4}], 0x42, 0x6, 0x1, 0x2, 0x1}}, 0x9}) close(0xffffffffffffffff) map_shadow_stack(&(0x7f00000f3000/0x3000)=nil, 0x3000, 0x1) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x1}, 0xe) 4.33554563s ago: executing program 4 (id=1128): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}, {0x0}], 0x2) socket$nl_crypto(0x10, 0x3, 0x15) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1ff, 0x4) sendmmsg(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r1], 0x108}}], 0x1, 0xc040) socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) 2.92161222s ago: executing program 4 (id=1130): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000700)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x9c, 0x0, @val=0x80}}}}}}}, 0x0) 1.972164821s ago: executing program 2 (id=1134): ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ftruncate(0xffffffffffffffff, 0x2007ffb) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) 1.743480183s ago: executing program 2 (id=1135): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = dup(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000100), 0x0) sendmsg$inet6(r3, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) r6 = dup(r3) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x1}}, 0x7, 0x1, 0x457, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/vlan/vlan0\x00') syz_open_procfs(0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 598.28727ms ago: executing program 5 (id=1136): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1a) mount$bind(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x89901) unshare(0x22020600) mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r0, &(0x7f00000058c0)={0x2020}, 0x2020) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) 586.181535ms ago: executing program 2 (id=1137): r0 = socket$netlink(0x10, 0x3, 0x0) unshare(0x22020600) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) 488.59764ms ago: executing program 4 (id=1138): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000000)={0x6, 'veth1_vlan\x00', {}, 0x5}) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xfffffffffffffde0, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0xffffffffffffffb9, 0x1, 0x4}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}]}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x0) 355.456602ms ago: executing program 5 (id=1139): openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @loopback}, {0x2, 0x0, @local}, {0x2, 0x4e23, @local}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x4, 0x6}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 268.737312ms ago: executing program 2 (id=1140): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000001300), 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[], 0xfc}}, 0x0) 103.608757ms ago: executing program 2 (id=1141): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_int(r0, 0x1, 0x2a, 0x0, 0x0) 42.790761ms ago: executing program 2 (id=1142): connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x20, @loopback, 0x23}, 0x1c) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0x2000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/185, 0x0, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) 0s ago: executing program 5 (id=1143): ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8923, &(0x7f0000000000)={'vlan0\x00', @local}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ftruncate(0xffffffffffffffff, 0x2007ffb) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000580)={0x2, 0xfc}, 0x2) kernel console output (not intermixed with test programs): g [ 229.832275][ T43] usb 2-1: config 0 has no interfaces? [ 229.993310][ T43] usb 2-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 229.993339][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 229.993748][ T43] usb 2-1: Product: syz [ 229.993764][ T43] usb 2-1: Manufacturer: syz [ 229.993777][ T43] usb 2-1: SerialNumber: syz [ 230.616732][ T43] usb 2-1: config 0 descriptor?? [ 230.695953][ T6696] uprobe: syz.4.239:6696 failed to unregister, leaking uprobe [ 230.824219][ T6699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 230.824888][ T6699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 231.978674][ T6699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 231.979256][ T6699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.645332][ T5699] IPVS: starting estimator thread 0... [ 232.762147][ T6718] IPVS: using max 9 ests per chain, 21600 per kthread [ 233.435124][ T5724] usb 2-1: USB disconnect, device number 3 [ 233.522562][ T5260] 8021q: adding VLAN 0 to HW filter on device eth4 [ 234.742922][ T59] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 234.783228][ T6726] netlink: 76 bytes leftover after parsing attributes in process `syz.1.246'. [ 234.787641][ T59] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 234.792207][ T59] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 234.831907][ T59] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 234.866808][ T59] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 235.618398][ T6745] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 236.581548][ T5331] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 236.731985][ T5331] usb 3-1: Using ep0 maxpacket: 32 [ 236.734581][ T5331] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 236.734603][ T5331] usb 3-1: config 0 has no interface number 0 [ 236.739624][ T5331] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 236.739650][ T5331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 236.739667][ T5331] usb 3-1: Product: syz [ 236.739680][ T5331] usb 3-1: Manufacturer: syz [ 236.739692][ T5331] usb 3-1: SerialNumber: syz [ 236.800000][ T5331] usb 3-1: config 0 descriptor?? [ 236.830080][ T5331] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 236.830120][ T5331] usb 3-1: selecting invalid altsetting 1 [ 236.830135][ T5331] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 236.901696][ T5600] Bluetooth: hci1: command tx timeout [ 236.910655][ T5331] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 236.911039][ T5331] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 236.911109][ T5331] usb 3-1: media controller created [ 236.970747][ T5331] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 237.416549][ T6296] netdevsim netdevsim5: probe with driver netdevsim failed with error -12 [ 237.449572][ T5331] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 237.449626][ T5331] zl10353_read_register: readreg error (reg=127, ret==-71) [ 237.498520][ T5331] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 237.732378][ T5600] Bluetooth: hci2: unexpected event for opcode 0x0000 [ 237.836251][ T6773] netlink: 76 bytes leftover after parsing attributes in process `syz.4.258'. [ 237.894179][ T5331] usb 3-1: USB disconnect, device number 11 [ 238.981517][ T5600] Bluetooth: hci1: command tx timeout [ 241.256212][ T5600] Bluetooth: hci1: command tx timeout [ 241.797580][ T5600] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 241.797956][ T5600] Bluetooth: hci2: Injecting HCI hardware error event [ 241.800642][ T59] Bluetooth: hci2: hardware error 0x00 [ 241.942307][ T5699] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 241.998953][ T6809] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 242.152251][ T5699] usb 3-1: Using ep0 maxpacket: 32 [ 242.157878][ T5699] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 242.157899][ T5699] usb 3-1: config 0 has no interface number 0 [ 242.161290][ T5699] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 242.161314][ T5699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 242.161362][ T5699] usb 3-1: Product: syz [ 242.209654][ T5699] usb 3-1: Manufacturer: syz [ 242.209673][ T5699] usb 3-1: SerialNumber: syz [ 242.364230][ T5699] usb 3-1: config 0 descriptor?? [ 242.390744][ T5699] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 242.390770][ T5699] usb 3-1: selecting invalid altsetting 1 [ 242.390784][ T5699] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 242.432239][ T5699] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 242.434346][ T5699] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 242.434397][ T5699] usb 3-1: media controller created [ 242.511110][ T5699] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 242.531966][ T13] bridge_slave_1: left allmulticast mode [ 242.531995][ T13] bridge_slave_1: left promiscuous mode [ 242.532229][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.594411][ T5699] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 242.594473][ T5699] zl10353_read_register: readreg error (reg=127, ret==-71) [ 242.597109][ T5699] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 242.647154][ T13] bridge_slave_0: left allmulticast mode [ 242.647185][ T13] bridge_slave_0: left promiscuous mode [ 242.647502][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.696993][ T5699] usb 3-1: USB disconnect, device number 12 [ 242.808413][ T6817] netlink: 76 bytes leftover after parsing attributes in process `syz.4.271'. [ 243.208630][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 243.349324][ T5600] Bluetooth: hci1: command tx timeout [ 243.559099][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 243.676198][ T13] bond0 (unregistering): Released all slaves [ 243.871705][ T5699] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 243.950188][ T59] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 244.045522][ T5699] usb 1-1: Using ep0 maxpacket: 32 [ 244.060099][ T5699] usb 1-1: unable to get BOS descriptor or descriptor too short [ 244.074675][ T5699] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 244.074704][ T5699] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 161, changing to 11 [ 244.105616][ T5699] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice= 0.40 [ 244.105642][ T5699] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 244.105660][ T5699] usb 1-1: Product: syz [ 244.105673][ T5699] usb 1-1: Manufacturer: syz [ 244.105686][ T5699] usb 1-1: SerialNumber: syz [ 244.185774][ T6828] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 244.481701][ T13] hsr_slave_0: left promiscuous mode [ 244.546000][ T13] hsr_slave_1: left promiscuous mode [ 244.567007][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 244.706133][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.524731][ T36] audit: type=1800 audit(1777778794.938:7): pid=6849 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.279" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 246.366115][ T5699] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 246.749609][ T6855] netlink: 4 bytes leftover after parsing attributes in process `syz.1.280'. [ 246.749718][ T6855] openvswitch: netlink: Unknown nsh attribute 0 [ 247.154252][ T5699] usb 1-1: USB disconnect, device number 6 [ 247.281534][ T5735] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 247.456826][ T5735] usb 5-1: Using ep0 maxpacket: 32 [ 247.458803][ T5735] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 247.458825][ T5735] usb 5-1: config 0 has no interface number 0 [ 247.481019][ T5735] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 247.481047][ T5735] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 247.481065][ T5735] usb 5-1: Product: syz [ 247.481078][ T5735] usb 5-1: Manufacturer: syz [ 247.481097][ T5735] usb 5-1: SerialNumber: syz [ 247.774389][ T5735] usb 5-1: config 0 descriptor?? [ 247.801461][ T5735] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 247.801487][ T5735] usb 5-1: selecting invalid altsetting 1 [ 247.801502][ T5735] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 247.817773][ T6865] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.284'. [ 248.044590][ T5735] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 248.045004][ T5735] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 248.045059][ T5735] usb 5-1: media controller created [ 248.106204][ T5735] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 248.125717][ T6869] netlink: 76 bytes leftover after parsing attributes in process `syz.0.286'. [ 248.575841][ T5735] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 248.575894][ T5735] zl10353_read_register: readreg error (reg=127, ret==-71) [ 248.596358][ T5735] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 248.960132][ T5735] usb 5-1: USB disconnect, device number 6 [ 249.717421][ T13] team0 (unregistering): Port device team_slave_1 removed [ 249.906275][ T13] team0 (unregistering): Port device team_slave_0 removed [ 250.145434][ T36] audit: type=1800 audit(1777778799.548:8): pid=6886 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.291" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 251.318034][ T6894] netlink: 4 bytes leftover after parsing attributes in process `syz.2.292'. [ 251.318165][ T6894] openvswitch: netlink: Unknown nsh attribute 0 [ 252.484435][ T6901] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 252.824422][ T6907] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.296'. [ 253.335045][ T36] audit: type=1800 audit(1777778802.738:9): pid=6911 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.297" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 253.792447][ T6724] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.792648][ T6724] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.793388][ T6724] bridge_slave_0: entered allmulticast mode [ 253.797418][ T6724] bridge_slave_0: entered promiscuous mode [ 253.837085][ T6724] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.838281][ T6724] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.838485][ T6724] bridge_slave_1: entered allmulticast mode [ 253.842863][ T6724] bridge_slave_1: entered promiscuous mode [ 254.059575][ T5724] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 254.080954][ T6724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 254.093383][ T6724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 254.243255][ T5724] usb 1-1: Using ep0 maxpacket: 32 [ 254.266004][ T5724] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 254.266028][ T5724] usb 1-1: config 0 has no interface number 0 [ 254.268299][ T5724] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 254.268324][ T5724] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 254.268342][ T5724] usb 1-1: Product: syz [ 254.268354][ T5724] usb 1-1: Manufacturer: syz [ 254.268367][ T5724] usb 1-1: SerialNumber: syz [ 254.327067][ T6724] team0: Port device team_slave_0 added [ 254.339156][ T5724] usb 1-1: config 0 descriptor?? [ 254.346758][ T6724] team0: Port device team_slave_1 added [ 254.398080][ T6724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 254.398095][ T6724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 254.398117][ T6724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 254.401366][ T6724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 254.401379][ T6724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 254.469583][ T5724] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 254.469609][ T5724] usb 1-1: selecting invalid altsetting 1 [ 254.469622][ T5724] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 254.502749][ T6724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 254.634443][ T6724] hsr_slave_0: entered promiscuous mode [ 254.635856][ T6724] hsr_slave_1: entered promiscuous mode [ 254.636804][ T6724] debugfs: 'hsr0' already exists in 'hsr' [ 254.636827][ T6724] Cannot create hsr debugfs directory [ 254.949283][ T5724] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 254.949719][ T5724] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 254.949767][ T5724] usb 1-1: media controller created [ 255.020685][ T5724] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 255.232560][ T5724] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 255.232614][ T5724] zl10353_read_register: readreg error (reg=127, ret==-71) [ 255.233044][ T5724] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 255.288679][ T6940] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 255.720140][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.720198][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.754342][ T6946] netlink: 76 bytes leftover after parsing attributes in process `syz.1.305'. [ 255.785312][ T36] audit: type=1800 audit(1777778805.188:10): pid=6947 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.303" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 256.188874][ T5724] usb 1-1: USB disconnect, device number 7 [ 256.255902][ T6948] netlink: 'syz.4.304': attribute type 3 has an invalid length. [ 256.685586][ T6959] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.307'. [ 257.428444][ T6974] misc userio: The device must be registered before sending interrupts [ 258.371576][ T5331] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 258.521546][ T5331] usb 3-1: Using ep0 maxpacket: 32 [ 258.523921][ T5331] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 258.523944][ T5331] usb 3-1: config 0 has no interface number 0 [ 258.526715][ T5331] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 258.526740][ T5331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 258.526759][ T5331] usb 3-1: Product: syz [ 258.526773][ T5331] usb 3-1: Manufacturer: syz [ 258.526786][ T5331] usb 3-1: SerialNumber: syz [ 259.022416][ T5331] usb 3-1: config 0 descriptor?? [ 259.114188][ T5331] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 259.114222][ T5331] usb 3-1: selecting invalid altsetting 1 [ 259.114236][ T5331] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 259.120873][ T5331] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 259.121246][ T5331] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 259.121306][ T5331] usb 3-1: media controller created [ 259.150326][ T5331] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 259.494110][ T6997] netlink: 76 bytes leftover after parsing attributes in process `syz.0.315'. [ 259.559027][ T5331] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 259.559080][ T5331] zl10353_read_register: readreg error (reg=127, ret==-71) [ 259.560742][ T5331] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 259.754234][ T6724] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 259.790354][ T5331] usb 3-1: USB disconnect, device number 13 [ 259.973557][ T36] audit: type=1800 audit(1777778809.338:11): pid=7004 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.317" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 260.626520][ T6724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 260.627851][ T6724] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 261.060870][ T6724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 261.104293][ T7018] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 261.124763][ T6724] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 261.311176][ T6724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 261.334315][ T6724] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 261.400995][ T6724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 261.451170][ T7024] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.320'. [ 261.640949][ T7020] syz.2.321 uses obsolete (PF_INET,SOCK_PACKET) [ 261.846431][ T7041] netlink: 4 bytes leftover after parsing attributes in process `syz.0.323'. [ 262.934390][ T6724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.653245][ T6724] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.675352][ T1274] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.675517][ T1274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 263.720948][ T1466] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.721044][ T1466] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.891819][ T5724] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 265.048876][ T5724] usb 1-1: Using ep0 maxpacket: 32 [ 265.052944][ T5724] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 265.052972][ T5724] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.121346][ T5724] usb 1-1: config 0 descriptor?? [ 265.330051][ T5724] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 265.340272][ T5724] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 265.345594][ T5724] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 265.345644][ T5724] usb 1-1: media controller created [ 265.374815][ T10] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 265.431840][ T5331] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 265.474394][ T36] audit: type=1800 audit(1777778814.888:12): pid=7085 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.329" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 265.951934][ T5331] usb 3-1: Using ep0 maxpacket: 16 [ 265.954584][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 266.066723][ T5724] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 266.074429][ T5331] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 266.074452][ T5331] usb 3-1: config 0 has no interfaces? [ 266.092396][ T5331] usb 3-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 266.092423][ T5331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.092441][ T5331] usb 3-1: Product: syz [ 266.092454][ T5331] usb 3-1: Manufacturer: syz [ 266.092466][ T5331] usb 3-1: SerialNumber: syz [ 266.095759][ T10] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 266.095779][ T10] usb 5-1: config 0 has no interface number 0 [ 266.144884][ T10] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 266.144910][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.144929][ T10] usb 5-1: Product: syz [ 266.144941][ T10] usb 5-1: Manufacturer: syz [ 266.144954][ T10] usb 5-1: SerialNumber: syz [ 266.165289][ T5331] usb 3-1: config 0 descriptor?? [ 266.241345][ T10] usb 5-1: config 0 descriptor?? [ 266.314984][ T10] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 266.315010][ T10] usb 5-1: selecting invalid altsetting 1 [ 266.315024][ T10] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 266.353382][ T10] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 266.368987][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 266.369038][ T10] usb 5-1: media controller created [ 266.419796][ T7075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.420505][ T7075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.457886][ T7075] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.458495][ T7075] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.614808][ T5724] DVB: Unable to find symbol dib7000p_attach() [ 266.614822][ T5724] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 266.867195][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 267.329473][ T10] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 267.329527][ T10] zl10353_read_register: readreg error (reg=127, ret==-71) [ 267.331062][ T10] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 267.403371][ T5724] rc_core: IR keymap rc-dib0700-rc5 not found [ 267.403390][ T5724] Registered IR keymap rc-empty [ 267.403669][ T5724] dvb-usb: could not initialize remote control. [ 267.403677][ T5724] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 267.568120][ T7102] netlink: 'syz.0.331': attribute type 3 has an invalid length. [ 267.617242][ T7103] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.332'. [ 267.665270][ T5724] usb 1-1: USB disconnect, device number 8 [ 268.145069][ T10] usb 5-1: USB disconnect, device number 7 [ 268.246217][ T6724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 268.337118][ T5792] usb 3-1: USB disconnect, device number 14 [ 268.586374][ T5724] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 268.832774][ T7108] netlink: 4 bytes leftover after parsing attributes in process `syz.4.333'. [ 269.862905][ T7132] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 270.124531][ T6724] veth0_vlan: entered promiscuous mode [ 270.157362][ T6724] veth1_vlan: entered promiscuous mode [ 270.389361][ T6724] veth0_macvtap: entered promiscuous mode [ 270.408915][ T6724] veth1_macvtap: entered promiscuous mode [ 270.446643][ T6724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 270.561851][ T6724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 270.603944][ T42] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.604767][ T42] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.605076][ T42] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.605399][ T42] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 271.811602][ T5730] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 271.850721][ T1562] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 271.850742][ T1562] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 271.972535][ T5730] usb 3-1: Using ep0 maxpacket: 32 [ 271.975380][ T5730] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 271.975406][ T5730] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.056962][ T5730] usb 3-1: config 0 descriptor?? [ 272.278296][ T5730] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 272.286705][ T5730] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 272.309573][ T5730] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 272.309625][ T5730] usb 3-1: media controller created [ 272.425018][ T163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 272.425030][ T163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 272.543447][ T5730] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 272.728568][ T5730] DVB: Unable to find symbol dib7000p_attach() [ 272.728579][ T5730] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 272.831608][ T5730] rc_core: IR keymap rc-dib0700-rc5 not found [ 272.831627][ T5730] Registered IR keymap rc-empty [ 272.831811][ T5730] dvb-usb: could not initialize remote control. [ 272.831816][ T5730] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 272.878791][ T5730] usb 3-1: USB disconnect, device number 15 [ 273.027940][ T5792] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 273.130446][ T5730] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 273.201532][ T5792] usb 2-1: Using ep0 maxpacket: 32 [ 273.204013][ T5792] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 273.204036][ T5792] usb 2-1: config 0 has no interface number 0 [ 273.207185][ T5792] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 273.207216][ T5792] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.207234][ T5792] usb 2-1: Product: syz [ 273.207247][ T5792] usb 2-1: Manufacturer: syz [ 273.207260][ T5792] usb 2-1: SerialNumber: syz [ 273.274921][ T5792] usb 2-1: config 0 descriptor?? [ 273.297378][ T5792] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 273.297394][ T5792] usb 2-1: selecting invalid altsetting 1 [ 273.297402][ T5792] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 273.309032][ T5792] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 273.309384][ T5792] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 273.309443][ T5792] usb 2-1: media controller created [ 273.378306][ T5792] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 273.441606][ T43] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 273.591560][ T10] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 273.751827][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 273.756718][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 273.756741][ T10] usb 1-1: config 0 has no interfaces? [ 273.759316][ T10] usb 1-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 273.759342][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.759359][ T10] usb 1-1: Product: syz [ 273.759372][ T10] usb 1-1: Manufacturer: syz [ 273.759391][ T10] usb 1-1: SerialNumber: syz [ 273.801519][ T5724] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 273.830921][ T10] usb 1-1: config 0 descriptor?? [ 273.973702][ T5724] usb 6-1: config 0 has an invalid interface number: 69 but max is 0 [ 273.973729][ T5724] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 273.973746][ T5724] usb 6-1: config 0 has no interface number 0 [ 273.973788][ T5724] usb 6-1: config 0 interface 69 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 273.973818][ T5724] usb 6-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 273.976109][ T5724] usb 6-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 273.976134][ T5724] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 273.976204][ T5724] usb 6-1: Product: syz [ 273.976218][ T5724] usb 6-1: Manufacturer: syz [ 273.976231][ T5724] usb 6-1: SerialNumber: syz [ 274.012069][ T5724] usb 6-1: config 0 descriptor?? [ 274.084578][ T7159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.094624][ T5724] cyberjack 6-1:0.69: required endpoints missing [ 274.104849][ T7159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.118490][ T7159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.139418][ T7159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.234758][ T5724] usb 6-1: USB disconnect, device number 2 [ 274.581125][ T5792] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 274.613176][ T5792] zl10353_read_register: readreg error (reg=127, ret==-110) [ 275.988114][ T59] Bluetooth: hci3: unexpected event for opcode 0x0000 [ 276.652950][ T5792] usb 2-1: USB disconnect, device number 4 [ 276.875306][ T5699] usb 1-1: USB disconnect, device number 9 [ 277.605231][ T7198] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 277.872897][ T10] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 277.962467][ T7203] tipc: Started in network mode [ 277.962495][ T7203] tipc: Node identity e61ba62fe023, cluster identity 4711 [ 277.964935][ T7203] tipc: Enabled bearer , priority 0 [ 277.969989][ T7203] syzkaller0: MTU too low for tipc bearer [ 277.970007][ T7203] tipc: Disabling bearer [ 278.091581][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 278.094138][ T10] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 278.094163][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.150331][ T10] usb 1-1: config 0 descriptor?? [ 278.396340][ T10] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 278.474999][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 278.478441][ T10] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 278.478494][ T10] usb 1-1: media controller created [ 278.945943][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 280.027781][ T59] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 280.028060][ T59] Bluetooth: hci3: Injecting HCI hardware error event [ 280.032669][ T59] Bluetooth: hci3: hardware error 0x00 [ 280.285148][ T10] DVB: Unable to find symbol dib7000p_attach() [ 280.285163][ T10] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 280.401514][ T10] rc_core: IR keymap rc-dib0700-rc5 not found [ 280.401533][ T10] Registered IR keymap rc-empty [ 280.401922][ T10] dvb-usb: could not initialize remote control. [ 280.401932][ T10] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 280.486857][ T10] usb 1-1: USB disconnect, device number 10 [ 280.488955][ T5724] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 280.663658][ T5724] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 280.663692][ T5724] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 280.663710][ T5724] usb 5-1: config 0 has no interface number 0 [ 280.663751][ T5724] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 280.663773][ T5724] usb 5-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 280.666321][ T5724] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 280.666346][ T5724] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.666363][ T5724] usb 5-1: Product: syz [ 280.666376][ T5724] usb 5-1: Manufacturer: syz [ 280.666389][ T5724] usb 5-1: SerialNumber: syz [ 280.677980][ T5724] usb 5-1: config 0 descriptor?? [ 280.680636][ T7217] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 280.706044][ T5724] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 280.871532][ T5792] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 280.889535][ T10] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 280.910722][ T36] audit: type=1800 audit(1777778830.318:13): pid=7222 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.364" name="SYSV00000000" dev="tmpfs" ino=3 res=0 errno=0 [ 281.063591][ T5792] usb 3-1: Using ep0 maxpacket: 32 [ 281.229104][ T5792] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 281.229130][ T5792] usb 3-1: config 0 has no interface number 0 [ 281.259249][ T5724] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 281.283742][ T5792] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 281.283770][ T5792] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 281.283788][ T5792] usb 3-1: Product: syz [ 281.283801][ T5792] usb 3-1: Manufacturer: syz [ 281.283814][ T5792] usb 3-1: SerialNumber: syz [ 281.369243][ T7231] tipc: Started in network mode [ 281.369264][ T7231] tipc: Node identity 4, cluster identity 4711 [ 281.369276][ T7231] tipc: Node number set to 4 [ 281.756818][ T5792] usb 3-1: config 0 descriptor?? [ 281.773455][ T5792] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 281.773471][ T5792] usb 3-1: selecting invalid altsetting 1 [ 281.773479][ T5792] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 281.809572][ T5724] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 281.870042][ T5792] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 281.870367][ T5792] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 281.870412][ T5792] usb 3-1: media controller created [ 281.924011][ T5792] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 281.992044][ T5724] usb 5-1: USB disconnect, device number 9 [ 281.992747][ T5792] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 281.992797][ T5792] zl10353_read_register: readreg error (reg=127, ret==-71) [ 281.993233][ T5792] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 282.165350][ T5724] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 282.166442][ T5724] cyberjack 5-1:0.69: device disconnected [ 282.261630][ T59] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 282.346797][ T5792] usb 3-1: USB disconnect, device number 16 [ 282.591569][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 282.763439][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 282.770766][ T10] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.770800][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 282.770832][ T10] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 282.770854][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.811162][ T10] usb 2-1: config 0 descriptor?? [ 283.973860][ T10] nzxt-smart2 0003:1E71:2009.0001: unknown main item tag 0x0 [ 283.973959][ T10] nzxt-smart2 0003:1E71:2009.0001: unknown main item tag 0x0 [ 283.973985][ T10] nzxt-smart2 0003:1E71:2009.0001: unknown main item tag 0x0 [ 283.974008][ T10] nzxt-smart2 0003:1E71:2009.0001: unknown main item tag 0x0 [ 283.974030][ T10] nzxt-smart2 0003:1E71:2009.0001: unknown main item tag 0x0 [ 285.814193][ T7263] openvswitch: netlink: Unexpected mask (mask=100000000, allowed=10048) [ 285.846845][ T10] nzxt-smart2 0003:1E71:2009.0001: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 285.941804][ T59] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 285.958686][ T59] Bluetooth: hci1: Injecting HCI hardware error event [ 285.965555][ T5600] Bluetooth: hci1: hardware error 0x00 [ 286.396729][ T10] usb 2-1: USB disconnect, device number 5 [ 286.668549][ T7268] fido_id[7268]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 286.851563][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 286.876879][ T7282] tipc: Started in network mode [ 286.876899][ T7282] tipc: Node identity 4, cluster identity 4711 [ 286.876911][ T7282] tipc: Node number set to 4 [ 287.003656][ T10] usb 2-1: config 0 has an invalid interface number: 69 but max is 0 [ 287.003682][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 287.003700][ T10] usb 2-1: config 0 has no interface number 0 [ 287.003741][ T10] usb 2-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 287.003764][ T10] usb 2-1: config 0 interface 69 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 287.203854][ T10] usb 2-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 287.203881][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.203898][ T10] usb 2-1: Product: syz [ 287.203911][ T10] usb 2-1: Manufacturer: syz [ 287.203923][ T10] usb 2-1: SerialNumber: syz [ 287.269369][ T10] usb 2-1: config 0 descriptor?? [ 287.278602][ T7275] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 287.293854][ T10] cyberjack 2-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 287.307875][ T10] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 287.319328][ T10] usb 2-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 287.538680][ T10] usb 2-1: USB disconnect, device number 6 [ 287.611347][ T10] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 287.649445][ T10] cyberjack 2-1:0.69: device disconnected [ 287.781776][ T43] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 287.931546][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 287.939905][ T43] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 287.939932][ T43] usb 1-1: config 0 has no interface number 0 [ 287.968272][ T43] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 287.968298][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.968316][ T43] usb 1-1: Product: syz [ 287.968329][ T43] usb 1-1: Manufacturer: syz [ 287.968340][ T43] usb 1-1: SerialNumber: syz [ 288.021027][ T43] usb 1-1: config 0 descriptor?? [ 288.039466][ T43] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 288.039490][ T43] usb 1-1: selecting invalid altsetting 1 [ 288.039505][ T43] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 288.076523][ T43] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 288.076996][ T43] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 288.077044][ T43] usb 1-1: media controller created [ 288.116949][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 288.422830][ T5600] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 289.305575][ T43] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 289.305647][ T43] zl10353_read_register: readreg error (reg=127, ret==-110) [ 289.351691][ T7287] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 289.402160][ T36] audit: type=1804 audit(1777778838.818:14): pid=7310 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.390" name="/newroot/96/file0" dev="tmpfs" ino=508 res=1 errno=0 [ 291.958606][ T7309] uprobe: syz.4.390:7309 failed to unregister, leaking uprobe [ 292.732281][ T5706] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 294.150730][ T5706] usb 3-1: Using ep0 maxpacket: 32 [ 294.167934][ T5706] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 294.167986][ T5706] usb 3-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 294.168010][ T5706] usb 3-1: config 0 interface 0 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 294.168044][ T5706] usb 3-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 294.168067][ T5706] usb 3-1: config 0 interface 0 has no altsetting 0 [ 294.168095][ T5706] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1c09, bcdDevice= 0.00 [ 294.168114][ T5706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 294.169767][ T43] usb 1-1: USB disconnect, device number 11 [ 294.515002][ T5706] usb 3-1: config 0 descriptor?? [ 295.050840][ T5706] corsair-psu 0003:1B1C:1C09.0002: unknown main item tag 0x0 [ 295.050862][ T5706] corsair-psu 0003:1B1C:1C09.0002: unknown main item tag 0x0 [ 295.050877][ T5706] corsair-psu 0003:1B1C:1C09.0002: unknown main item tag 0x0 [ 295.050892][ T5706] corsair-psu 0003:1B1C:1C09.0002: unknown main item tag 0x0 [ 295.175053][ T5706] corsair-psu 0003:1B1C:1C09.0002: hidraw0: USB HID v4.08 Device [HID 1b1c:1c09] on usb-dummy_hcd.2-1/input0 [ 295.234795][ T5706] corsair-psu 0003:1B1C:1C09.0002: unable to initialize device (-38) [ 295.301929][ T5706] corsair-psu 0003:1B1C:1C09.0002: probe with driver corsair-psu failed with error -38 [ 295.328868][ T5706] usb 3-1: USB disconnect, device number 17 [ 295.345775][ T7332] fido_id[7332]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 295.408665][ T7337] netlink: 4 bytes leftover after parsing attributes in process `syz.5.399'. [ 296.992355][ T5706] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 297.161637][ T5706] usb 2-1: Using ep0 maxpacket: 32 [ 297.168941][ T5706] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 297.168965][ T5706] usb 2-1: config 0 has no interface number 0 [ 297.171224][ T5706] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 297.171248][ T5706] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.171265][ T5706] usb 2-1: Product: syz [ 297.171277][ T5706] usb 2-1: Manufacturer: syz [ 297.171290][ T5706] usb 2-1: SerialNumber: syz [ 297.238694][ T5706] usb 2-1: config 0 descriptor?? [ 297.280761][ T5706] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 297.280777][ T5706] usb 2-1: selecting invalid altsetting 1 [ 297.280784][ T5706] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 297.327164][ T5706] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 297.328417][ T5706] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 297.328468][ T5706] usb 2-1: media controller created [ 297.389863][ T5706] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 297.473970][ T7362] netlink: 16 bytes leftover after parsing attributes in process `syz.2.406'. [ 298.504203][ T5706] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 298.504277][ T5706] zl10353_read_register: readreg error (reg=127, ret==-110) [ 298.527486][ T7359] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 298.552906][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 298.784598][ T5706] usb 2-1: USB disconnect, device number 7 [ 299.285879][ T7378] trusted_key: encrypted_key: insufficient parameters specified [ 301.422809][ T7416] trusted_key: encrypted_key: insufficient parameters specified [ 301.523147][ T43] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 301.661291][ T5699] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 301.741559][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 301.743753][ T43] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 301.743776][ T43] usb 5-1: config 0 has no interface number 0 [ 301.748194][ T43] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 301.748220][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.748239][ T43] usb 5-1: Product: syz [ 301.748252][ T43] usb 5-1: Manufacturer: syz [ 301.748265][ T43] usb 5-1: SerialNumber: syz [ 301.834656][ T5699] usb 2-1: Using ep0 maxpacket: 8 [ 302.102062][ T43] usb 5-1: config 0 descriptor?? [ 302.556616][ T5699] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 302.556641][ T5699] usb 2-1: config 0 has no interface number 0 [ 302.556680][ T5699] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 302.556701][ T5699] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 302.556723][ T5699] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 302.556747][ T5699] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 302.556786][ T5699] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 302.556807][ T5699] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 302.660825][ T5699] usb 2-1: config 0 descriptor?? [ 302.670071][ T43] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 302.670102][ T43] usb 5-1: selecting invalid altsetting 1 [ 302.670110][ T43] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 302.703587][ T43] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 302.703860][ T43] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 302.703886][ T43] usb 5-1: media controller created [ 302.739124][ T5699] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 302.804238][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 302.861982][ T43] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 302.862041][ T43] zl10353_read_register: readreg error (reg=127, ret==-71) [ 302.862504][ T43] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 302.938434][ T43] usb 5-1: USB disconnect, device number 10 [ 302.981731][ T5706] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 303.141864][ T5706] usb 6-1: Using ep0 maxpacket: 16 [ 303.288561][ T5706] usb 6-1: config index 0 descriptor too short (expected 65, got 36) [ 303.288613][ T5706] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 303.288764][ T5706] usb 6-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 303.288785][ T5706] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 303.394716][ T5706] usb 6-1: config 0 descriptor?? [ 303.521280][ T5706] pxrc 6-1:0.0: Could not find endpoint [ 303.536301][ T5706] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 303.766197][ T10] usb 2-1: USB disconnect, device number 8 [ 303.766285][ C0] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 303.798906][ T7430] ldusb: No device or device unplugged -19 [ 303.799291][ T10] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 303.818992][ T7428] warning: `syz.5.430' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 305.139257][ T5707] usb 6-1: USB disconnect, device number 3 [ 306.206647][ T7456] trusted_key: encrypted_key: insufficient parameters specified [ 306.291611][ T5699] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 306.461828][ T5699] usb 5-1: config 0 has an invalid interface number: 69 but max is 0 [ 306.461856][ T5699] usb 5-1: config 0 has no interface number 0 [ 306.461896][ T5699] usb 5-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 306.461918][ T5699] usb 5-1: config 0 interface 69 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 306.495592][ T5699] usb 5-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 306.495620][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.495637][ T5699] usb 5-1: Product: syz [ 306.495649][ T5699] usb 5-1: Manufacturer: syz [ 306.495662][ T5699] usb 5-1: SerialNumber: syz [ 306.556642][ T5699] usb 5-1: config 0 descriptor?? [ 306.571870][ T7454] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 306.575662][ T5699] cyberjack 5-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 306.577347][ T5699] cyberjack ttyUSB0: usb_submit_urb(read int) failed [ 306.607053][ T5699] usb 5-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 306.745227][ T7459] sctp: [Deprecated]: syz.5.440 (pid 7459) Use of struct sctp_assoc_value in delayed_ack socket option. [ 306.745227][ T7459] Use struct sctp_sack_info instead [ 306.795783][ T5707] usb 5-1: USB disconnect, device number 11 [ 306.979136][ T5707] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 307.002334][ T5699] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 307.041732][ T5707] cyberjack 5-1:0.69: device disconnected [ 307.047934][ T7468] cgroup: fork rejected by pids controller in [ 307.153723][ T5699] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 307.153775][ T5699] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 307.153794][ T5699] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 307.168546][ T7468] /syz1 [ 307.219345][ T5699] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 307.219374][ T5699] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 307.219394][ T5699] usb 1-1: Product: syz [ 307.219407][ T5699] usb 1-1: Manufacturer: syz [ 307.219420][ T5699] usb 1-1: SerialNumber: syz [ 307.269930][ T5699] usb 1-1: config 0 descriptor?? [ 307.281759][ T5699] radio-si470x 1-1:0.0: could not find interrupt in endpoint [ 307.281841][ T5699] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5 [ 307.282350][ T5699] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 310.068942][ T7488] tipc: Started in network mode [ 310.068963][ T7488] tipc: Node identity 4, cluster identity 4711 [ 310.068975][ T7488] tipc: Node number set to 4 [ 311.539378][ T5730] usb 1-1: USB disconnect, device number 12 [ 315.239065][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 316.128301][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 316.218976][ T59] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 316.233401][ T59] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 316.264570][ T59] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 316.281328][ T59] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 316.937733][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.081514][ T5707] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 317.146404][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.146466][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.249081][ T5707] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 317.249132][ T5707] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 317.249152][ T5707] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 317.277143][ T5707] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 317.277169][ T5707] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 317.277187][ T5707] usb 3-1: Product: syz [ 317.277200][ T5707] usb 3-1: Manufacturer: syz [ 317.277213][ T5707] usb 3-1: SerialNumber: syz [ 317.324636][ T5707] usb 3-1: config 0 descriptor?? [ 317.389764][ T5707] radio-si470x 3-1:0.0: could not find interrupt in endpoint [ 317.389845][ T5707] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 317.390356][ T5707] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 318.421669][ T5600] Bluetooth: hci4: command tx timeout [ 319.598527][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.508250][ T5600] Bluetooth: hci4: command 0x041b tx timeout [ 322.217001][ T5707] usb 3-1: USB disconnect, device number 18 [ 322.635003][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 322.741522][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 324.840036][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 326.192404][ T13] bridge0: port 3(team0) entered disabled state [ 327.252394][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 327.332809][ T13] bridge_slave_1: left allmulticast mode [ 327.332842][ T13] bridge_slave_1: left promiscuous mode [ 327.382359][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 327.546675][ T13] bridge_slave_0: left allmulticast mode [ 327.546697][ T13] bridge_slave_0: left promiscuous mode [ 327.546838][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.767334][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 330.721959][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 330.764025][ T13] bond0 (unregistering): Released all slaves [ 330.940412][ T7600] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 330.940565][ T7600] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 330.941846][ T13] tipc: Left network mode [ 331.236062][ T7600] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 331.851530][ T31] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 332.643291][ T31] usb 3-1: device descriptor read/64, error -71 [ 332.931575][ T31] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 332.984898][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 333.124517][ T31] usb 3-1: device descriptor read/64, error -71 [ 333.234374][ T31] usb usb3-port1: attempt power cycle [ 333.441159][ T10] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 333.514769][ T36] audit: type=1804 audit(1777778882.918:15): pid=7665 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.493" name="/newroot/114/file0" dev="tmpfs" ino=603 res=1 errno=0 [ 333.651473][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 333.729324][ T10] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 333.729438][ T10] usb 1-1: config 0 interface 0 has no altsetting 0 [ 333.752149][ T10] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 333.752178][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 333.763849][ T31] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 334.168619][ T10] usb 1-1: config 0 descriptor?? [ 334.329592][ T5260] 8021q: adding VLAN 0 to HW filter on device eth6 [ 335.061620][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 336.160682][ T31] usb 3-1: device descriptor read/8, error -71 [ 336.454121][ T10] nzxt-smart2 0003:1E71:2009.0003: unknown main item tag 0x0 [ 336.454157][ T10] nzxt-smart2 0003:1E71:2009.0003: unknown main item tag 0x0 [ 336.454183][ T10] nzxt-smart2 0003:1E71:2009.0003: unknown main item tag 0x0 [ 336.454208][ T10] nzxt-smart2 0003:1E71:2009.0003: unknown main item tag 0x0 [ 336.454234][ T10] nzxt-smart2 0003:1E71:2009.0003: unknown main item tag 0x0 [ 336.612170][ T10] nzxt-smart2 0003:1E71:2009.0003: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.0-1/input0 [ 336.884757][ T7682] netlink: 36 bytes leftover after parsing attributes in process `syz.5.498'. [ 337.141514][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 337.261869][ T5699] usb 5-1: new full-speed USB device number 12 using dummy_hcd [ 337.425119][ T5699] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 337.425163][ T5699] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 337.425184][ T5699] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 337.427290][ T5699] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 337.427307][ T5699] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 337.427323][ T5699] usb 5-1: Product: syz [ 337.427336][ T5699] usb 5-1: Manufacturer: syz [ 337.427348][ T5699] usb 5-1: SerialNumber: syz [ 337.442324][ T5699] usb 5-1: config 0 descriptor?? [ 337.550289][ T5699] radio-si470x 5-1:0.0: could not find interrupt in endpoint [ 337.565007][ T5699] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 337.565521][ T5699] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 338.787463][ T13] hsr_slave_0: left promiscuous mode [ 338.828115][ T13] hsr_slave_1: left promiscuous mode [ 338.851759][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 338.851784][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 338.880102][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 338.882662][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.002754][ T13] veth1_macvtap: left promiscuous mode [ 339.007412][ T13] veth0_macvtap: left promiscuous mode [ 339.011351][ T13] veth1_vlan: left promiscuous mode [ 339.033517][ T13] veth0_vlan: left promiscuous mode [ 339.359930][ T5730] usb 1-1: USB disconnect, device number 13 [ 340.581460][ T5730] usb 5-1: USB disconnect, device number 12 [ 341.494070][ T13] team_slave_1 (unregistering): left promiscuous mode [ 341.494094][ T13] team_slave_1 (unregistering): left allmulticast mode [ 341.532122][ T13] team0 (unregistering): Port device team_slave_1 removed [ 341.558785][ T13] team_slave_0 (unregistering): left promiscuous mode [ 341.558817][ T13] team_slave_0 (unregistering): left allmulticast mode [ 341.592890][ T13] team0 (unregistering): Port device team_slave_0 removed [ 342.079487][ T7691] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 342.870944][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 343.253184][ T10] usb 3-1: no configurations [ 343.253204][ T10] usb 3-1: can't read configurations, error -22 [ 343.380627][ T7522] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.380701][ T7522] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.380822][ T7522] bridge_slave_0: entered allmulticast mode [ 343.388077][ T7522] bridge_slave_0: entered promiscuous mode [ 343.412087][ T7522] bridge0: port 2(bridge_slave_1) entered blocking state [ 343.413826][ T7522] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.414013][ T7522] bridge_slave_1: entered allmulticast mode [ 343.419620][ T7522] bridge_slave_1: entered promiscuous mode [ 343.431615][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 343.609321][ T7522] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 343.612381][ T10] usb 3-1: no configurations [ 343.612397][ T10] usb 3-1: can't read configurations, error -22 [ 343.612948][ T10] usb usb3-port1: attempt power cycle [ 343.613641][ T7522] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 343.951829][ T10] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 343.961535][ T5854] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 343.973003][ T10] usb 3-1: no configurations [ 343.973019][ T10] usb 3-1: can't read configurations, error -22 [ 344.107385][ T7522] team0: Port device team_slave_0 added [ 344.109988][ T10] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 344.111562][ T5854] usb 6-1: Using ep0 maxpacket: 16 [ 344.114040][ T5854] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 344.114074][ T5854] usb 6-1: config 0 interface 0 has no altsetting 0 [ 344.114104][ T5854] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 344.114124][ T5854] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 344.118910][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 344.120204][ T7522] team0: Port device team_slave_1 added [ 344.138466][ T10] usb 3-1: no configurations [ 344.138484][ T10] usb 3-1: can't read configurations, error -22 [ 344.143508][ T5854] usb 6-1: config 0 descriptor?? [ 344.158698][ T10] usb usb3-port1: unable to enumerate USB device [ 344.388290][ T7730] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 344.570737][ T5854] nzxt-smart2 0003:1E71:2009.0004: unknown main item tag 0x0 [ 344.570772][ T5854] nzxt-smart2 0003:1E71:2009.0004: unknown main item tag 0x0 [ 344.570798][ T5854] nzxt-smart2 0003:1E71:2009.0004: unknown main item tag 0x0 [ 344.570823][ T5854] nzxt-smart2 0003:1E71:2009.0004: unknown main item tag 0x0 [ 344.570848][ T5854] nzxt-smart2 0003:1E71:2009.0004: unknown main item tag 0x0 [ 344.659342][ T5854] nzxt-smart2 0003:1E71:2009.0004: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 346.065150][ T13] IPVS: stop unused estimator thread 0... [ 346.341676][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 346.843499][ T7522] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.843581][ T7522] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.843644][ T7522] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 347.319065][ T7522] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 347.319081][ T7522] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 347.319106][ T7522] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 349.038744][ T7758] netlink: 48 bytes leftover after parsing attributes in process `syz.0.516'. [ 349.727574][ T5854] usb 6-1: USB disconnect, device number 4 [ 349.803396][ T5260] 8021q: adding VLAN 0 to HW filter on device eth5 [ 351.061497][ T7522] hsr_slave_0: entered promiscuous mode [ 351.064906][ T7522] hsr_slave_1: entered promiscuous mode [ 351.871656][ T7761] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 352.341600][ T5854] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 352.502542][ T5854] usb 3-1: no configurations [ 352.502554][ T5854] usb 3-1: can't read configurations, error -22 [ 352.632394][ T5854] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 352.783758][ T5854] usb 3-1: no configurations [ 352.783781][ T5854] usb 3-1: can't read configurations, error -22 [ 352.784215][ T5854] usb usb3-port1: attempt power cycle [ 352.924420][ T7792] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 353.429890][ T5854] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 353.453395][ T5854] usb 3-1: no configurations [ 353.453408][ T5854] usb 3-1: can't read configurations, error -22 [ 353.484279][ T5707] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 353.487278][ T7807] misc userio: The device must be registered before sending interrupts [ 353.581562][ T5854] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 353.626505][ T5854] usb 3-1: no configurations [ 353.626517][ T5854] usb 3-1: can't read configurations, error -22 [ 353.629767][ T5854] usb usb3-port1: unable to enumerate USB device [ 353.631747][ T5707] usb 6-1: Using ep0 maxpacket: 16 [ 353.634131][ T5707] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.634152][ T5707] usb 6-1: config 0 has no interfaces? [ 353.636302][ T5707] usb 6-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 353.636325][ T5707] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.636342][ T5707] usb 6-1: Product: syz [ 353.636355][ T5707] usb 6-1: Manufacturer: syz [ 353.636368][ T5707] usb 6-1: SerialNumber: syz [ 353.687325][ T5707] usb 6-1: config 0 descriptor?? [ 353.937453][ T7798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.953935][ T7798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 353.963758][ T7798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 353.965440][ T7798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.234765][ T5854] IPVS: starting estimator thread 0... [ 354.331525][ T7818] IPVS: using max 9 ests per chain, 21600 per kthread [ 354.343315][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 354.701672][ T5707] usb 6-1: USB disconnect, device number 5 [ 355.082120][ T5854] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 355.255559][ T5854] usb 5-1: config index 0 descriptor too short (expected 5668, got 36) [ 355.255586][ T5854] usb 5-1: config 3 has too many interfaces: 84, using maximum allowed: 32 [ 355.255606][ T5854] usb 5-1: config 3 has 1 interface, different from the descriptor's value: 84 [ 355.255623][ T5854] usb 5-1: config 3 has no interface number 0 [ 355.255661][ T5854] usb 5-1: config 3 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 355.255685][ T5854] usb 5-1: config 3 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 355.325759][ T5854] usb 5-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 355.325780][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 355.325790][ T5854] usb 5-1: Product: syz [ 355.325796][ T5854] usb 5-1: Manufacturer: syz [ 355.325815][ T5854] usb 5-1: SerialNumber: syz [ 355.379166][ T7820] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 355.785438][ T31] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 356.122494][ T31] usb 3-1: Using ep0 maxpacket: 16 [ 356.243668][ T31] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 356.243701][ T31] usb 3-1: config 0 interface 0 has no altsetting 0 [ 356.243923][ T31] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 356.244056][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.486636][ T31] usb 3-1: config 0 descriptor?? [ 356.683842][ T5854] usb-storage 5-1:3.20: USB Mass Storage device detected [ 356.934530][ T5854] usb-storage 5-1:3.20: Quirks match for vid 04e6 pid 000b: 4 [ 356.953426][ T5854] scsi host1: usb-storage 5-1:3.20 [ 357.930792][ T5854] usb 5-1: USB disconnect, device number 13 [ 360.261950][ T31] nzxt-smart2 0003:1E71:2009.0005: unknown main item tag 0x0 [ 360.261987][ T31] nzxt-smart2 0003:1E71:2009.0005: unknown main item tag 0x0 [ 360.262014][ T31] nzxt-smart2 0003:1E71:2009.0005: unknown main item tag 0x0 [ 360.263477][ T31] nzxt-smart2 0003:1E71:2009.0005: unknown main item tag 0x0 [ 360.263507][ T31] nzxt-smart2 0003:1E71:2009.0005: unknown main item tag 0x0 [ 360.273111][ T31] nzxt-smart2 0003:1E71:2009.0005: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 360.538661][ T7845] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 361.826304][ T7864] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 363.181638][ T5854] usb 3-1: USB disconnect, device number 31 [ 363.721500][ T5707] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 363.863948][ T59] Bluetooth: hci4: command 0x041b tx timeout [ 363.941874][ T5707] usb 5-1: Using ep0 maxpacket: 16 [ 363.949651][ T5707] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 363.949676][ T5707] usb 5-1: config 0 has no interfaces? [ 363.981736][ T5707] usb 5-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 363.981835][ T5707] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.981854][ T5707] usb 5-1: Product: syz [ 363.981866][ T5707] usb 5-1: Manufacturer: syz [ 363.981878][ T5707] usb 5-1: SerialNumber: syz [ 364.036422][ T5707] usb 5-1: config 0 descriptor?? [ 364.247264][ T7885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.249238][ T7885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 364.265573][ T7885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 364.266100][ T7885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 366.241534][ T5854] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 366.411304][ T5854] usb 1-1: config index 0 descriptor too short (expected 5668, got 36) [ 366.411333][ T5854] usb 1-1: config 3 has too many interfaces: 84, using maximum allowed: 32 [ 366.416668][ T5854] usb 1-1: config 3 has 1 interface, different from the descriptor's value: 84 [ 366.416693][ T5854] usb 1-1: config 3 has no interface number 0 [ 366.416739][ T5854] usb 1-1: config 3 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 366.416766][ T5854] usb 1-1: config 3 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 366.480743][ T5854] usb 1-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 366.480772][ T5854] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.480789][ T5854] usb 1-1: Product: syz [ 366.480802][ T5854] usb 1-1: Manufacturer: syz [ 366.480816][ T5854] usb 1-1: SerialNumber: syz [ 366.586604][ T7898] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 366.600174][ T31] usb 5-1: USB disconnect, device number 14 [ 366.869074][ T5854] usb-storage 1-1:3.20: USB Mass Storage device detected [ 366.895510][ T5854] usb-storage 1-1:3.20: Quirks match for vid 04e6 pid 000b: 4 [ 366.899300][ T5854] scsi host1: usb-storage 1-1:3.20 [ 367.011324][ T7905] binder: 7903:7905 ioctl 4018620d 0 returned -22 [ 367.085319][ T5854] usb 1-1: USB disconnect, device number 15 [ 367.994359][ T7522] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 368.151704][ T7522] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 368.157757][ T7522] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 368.231599][ T7522] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 368.243043][ T7522] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 368.887048][ T7522] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 368.902846][ T7522] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 368.922338][ T7920] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 369.005993][ T7522] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 369.531491][ T5707] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 369.583007][ T7950] sctp: [Deprecated]: syz.2.554 (pid 7950) Use of struct sctp_assoc_value in delayed_ack socket option. [ 369.583007][ T7950] Use struct sctp_sack_info instead [ 369.741500][ T5707] usb 5-1: Using ep0 maxpacket: 16 [ 369.746320][ T5707] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 369.746339][ T5707] usb 5-1: config 0 interface 0 has no altsetting 0 [ 369.746357][ T5707] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 369.746374][ T5707] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.805265][ T5707] usb 5-1: config 0 descriptor?? [ 369.884881][ T7522] 8021q: adding VLAN 0 to HW filter on device bond0 [ 370.033922][ T5600] Bluetooth: hci4: command 0x041b tx timeout [ 370.081020][ T7522] 8021q: adding VLAN 0 to HW filter on device team0 [ 370.128224][ T1428] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.128527][ T1428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 370.240607][ T5707] nzxt-smart2 0003:1E71:2009.0006: unknown main item tag 0x0 [ 370.240643][ T5707] nzxt-smart2 0003:1E71:2009.0006: unknown main item tag 0x0 [ 370.240668][ T5707] nzxt-smart2 0003:1E71:2009.0006: unknown main item tag 0x0 [ 370.240691][ T5707] nzxt-smart2 0003:1E71:2009.0006: unknown main item tag 0x0 [ 370.240714][ T5707] nzxt-smart2 0003:1E71:2009.0006: unknown main item tag 0x0 [ 370.244545][ T1543] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.244672][ T1543] bridge0: port 2(bridge_slave_1) entered forwarding state [ 370.315663][ T5707] nzxt-smart2 0003:1E71:2009.0006: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.4-1/input0 [ 371.659460][ T7977] binder: 7975:7977 ioctl c0306201 0 returned -14 [ 372.730051][ T7522] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 372.831717][ T43] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 372.996339][ T5854] usb 5-1: USB disconnect, device number 15 [ 373.015721][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 373.019357][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 373.019380][ T43] usb 3-1: config 0 has no interfaces? [ 373.046177][ T43] usb 3-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 373.046206][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.046224][ T43] usb 3-1: Product: syz [ 373.046238][ T43] usb 3-1: Manufacturer: syz [ 373.046251][ T43] usb 3-1: SerialNumber: syz [ 373.089414][ T43] usb 3-1: config 0 descriptor?? [ 373.269098][ T8004] netlink: 20 bytes leftover after parsing attributes in process `syz.5.561'. [ 373.998495][ T8006] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 374.003418][ T7988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.023659][ T7988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.048509][ T7988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 374.049072][ T7988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 374.295981][ T59] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 374.346684][ T59] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 374.347959][ T59] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 374.350730][ T59] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 374.367064][ T59] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 375.265593][ T43] usb 3-1: USB disconnect, device number 32 [ 375.477464][ T8017] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 375.539781][ T8017] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 375.539833][ T8017] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 375.664077][ T8017] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 375.900176][ T8037] sctp: [Deprecated]: syz.4.566 (pid 8037) Use of struct sctp_assoc_value in delayed_ack socket option. [ 375.900176][ T8037] Use struct sctp_sack_info instead [ 376.096183][ T8043] binder: 8041:8043 ioctl c0306201 0 returned -14 [ 377.549836][ T5600] Bluetooth: hci5: command 0x041b tx timeout [ 378.592000][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.592064][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.074559][ T8080] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 379.795674][ T8105] binder: 8103:8105 ioctl c0306201 0 returned -14 [ 379.977761][ T8109] sctp: [Deprecated]: syz.2.582 (pid 8109) Use of struct sctp_assoc_value in delayed_ack socket option. [ 379.977761][ T8109] Use struct sctp_sack_info instead [ 380.501494][ T5600] Bluetooth: hci5: command 0x041b tx timeout [ 382.582892][ T5600] Bluetooth: hci5: command 0x041b tx timeout [ 384.460476][ T8130] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 384.845760][ T8152] fuse: Bad value for 'fd' [ 385.138410][ T8022] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.138607][ T8022] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.138894][ T8022] bridge_slave_0: entered allmulticast mode [ 385.173671][ T8022] bridge_slave_0: entered promiscuous mode [ 385.192993][ T8022] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.195685][ T8022] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.195917][ T8022] bridge_slave_1: entered allmulticast mode [ 385.200499][ T8022] bridge_slave_1: entered promiscuous mode [ 385.381168][ T8022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 385.430036][ T8022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 385.474204][ T8145] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 385.536542][ T8022] team0: Port device team_slave_0 added [ 385.557742][ T8022] team0: Port device team_slave_1 added [ 385.655447][ T8022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 385.655463][ T8022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 385.655485][ T8022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 385.742180][ T8022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 385.742199][ T8022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 385.742223][ T8022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 385.757357][ T8165] genirq: Flags mismatch irq 4. 00202000 (pcl812) vs. 00202080 (ttyS0) [ 385.781774][ T8168] sctp: [Deprecated]: syz.2.599 (pid 8168) Use of struct sctp_assoc_value in delayed_ack socket option. [ 385.781774][ T8168] Use struct sctp_sack_info instead [ 386.044829][ T1274] bridge_slave_1: left allmulticast mode [ 386.044862][ T1274] bridge_slave_1: left promiscuous mode [ 386.045123][ T1274] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.144265][ T1274] bridge_slave_0: left allmulticast mode [ 386.144298][ T1274] bridge_slave_0: left promiscuous mode [ 386.144540][ T1274] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.988773][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 389.151603][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 391.075114][ T1274] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 391.152398][ T1274] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 391.175899][ T1274] bond0 (unregistering): Released all slaves [ 391.221590][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 391.482637][ T8204] netlink: 20 bytes leftover after parsing attributes in process `syz.2.607'. [ 391.491778][ T5260] 8021q: adding VLAN 0 to HW filter on device eth5 [ 391.532149][ T8022] hsr_slave_0: entered promiscuous mode [ 391.540560][ T8022] hsr_slave_1: entered promiscuous mode [ 391.553059][ T8022] debugfs: 'hsr0' already exists in 'hsr' [ 391.553086][ T8022] Cannot create hsr debugfs directory [ 391.603206][ T8208] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 391.763757][ T8222] sctp: [Deprecated]: syz.5.610 (pid 8222) Use of struct sctp_assoc_value in delayed_ack socket option. [ 391.763757][ T8222] Use struct sctp_sack_info instead [ 393.351643][ T1274] hsr_slave_0: left promiscuous mode [ 394.190510][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 394.312470][ T1274] hsr_slave_1: left promiscuous mode [ 394.315056][ T1274] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 394.356048][ T1274] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 396.754139][ T1274] team0 (unregistering): Port device team_slave_1 removed [ 397.515411][ T1274] team0 (unregistering): Port device team_slave_0 removed [ 398.860159][ T8259] sctp: [Deprecated]: syz.5.623 (pid 8259) Use of struct sctp_assoc_value in delayed_ack socket option. [ 398.860159][ T8259] Use struct sctp_sack_info instead [ 404.198851][ T8315] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 404.214643][ T8315] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 407.132108][ T5260] 8021q: adding VLAN 0 to HW filter on device eth6 [ 407.238912][ T8308] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 411.039479][ T8022] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 411.080917][ T8022] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 411.098669][ T8022] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 411.158148][ T8022] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 411.174019][ T8022] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 411.336928][ T8022] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 411.343972][ T8022] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 411.409347][ T8022] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 411.994295][ T8399] netlink: 20 bytes leftover after parsing attributes in process `syz.0.656'. [ 413.216997][ T36] audit: type=1800 audit(1777778962.628:16): pid=8409 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.658" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 415.257521][ T8430] binder: 8428:8430 ioctl c0306201 0 returned -14 [ 415.413081][ T8022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.542850][ T8022] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.577385][ T1274] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.577525][ T1274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.619044][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.619176][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 416.366018][ T5706] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 417.277215][ T5706] usb 6-1: Using ep0 maxpacket: 16 [ 417.287383][ T5706] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 417.287415][ T5706] usb 6-1: config 0 interface 0 has no altsetting 0 [ 417.287447][ T5706] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 417.287469][ T5706] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 417.337968][ T5706] usb 6-1: config 0 descriptor?? [ 418.216066][ T5706] nzxt-smart2 0003:1E71:2009.0007: unknown main item tag 0x0 [ 418.216102][ T5706] nzxt-smart2 0003:1E71:2009.0007: unknown main item tag 0x0 [ 418.216127][ T5706] nzxt-smart2 0003:1E71:2009.0007: unknown main item tag 0x0 [ 418.216150][ T5706] nzxt-smart2 0003:1E71:2009.0007: unknown main item tag 0x0 [ 418.216173][ T5706] nzxt-smart2 0003:1E71:2009.0007: unknown main item tag 0x0 [ 418.299588][ T5706] nzxt-smart2 0003:1E71:2009.0007: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 418.793668][ T5706] usb 6-1: USB disconnect, device number 6 [ 419.024088][ T8480] fido_id[8480]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 419.251653][ T5792] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 419.403272][ T5792] usb 5-1: config index 0 descriptor too short (expected 5668, got 36) [ 419.403350][ T5792] usb 5-1: config 3 has too many interfaces: 84, using maximum allowed: 32 [ 419.403368][ T5792] usb 5-1: config 3 has 1 interface, different from the descriptor's value: 84 [ 419.403387][ T5792] usb 5-1: config 3 has no interface number 0 [ 419.403428][ T5792] usb 5-1: config 3 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 419.403453][ T5792] usb 5-1: config 3 interface 20 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 419.409419][ T5792] usb 5-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 419.409540][ T5792] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.409560][ T5792] usb 5-1: Product: syz [ 419.409573][ T5792] usb 5-1: Manufacturer: syz [ 419.409587][ T5792] usb 5-1: SerialNumber: syz [ 419.532628][ T8494] binder: 8493:8494 ioctl c0306201 0 returned -14 [ 419.563101][ T8484] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 419.804291][ T8022] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 419.807471][ T8484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 419.834749][ T8484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 419.840574][ T5792] usb-storage 5-1:3.20: USB Mass Storage device detected [ 419.861068][ T5792] usb-storage 5-1:3.20: Quirks match for vid 04e6 pid 000b: 4 [ 419.869368][ T5792] scsi host1: usb-storage 5-1:3.20 [ 419.940416][ T5792] usb 5-1: USB disconnect, device number 16 [ 420.768753][ T36] audit: type=1804 audit(1777778970.178:17): pid=8522 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.684" name="/newroot/162/file0" dev="tmpfs" ino=858 res=1 errno=0 [ 423.601490][ T8520] uprobe: syz.4.684:8520 failed to unregister, leaking uprobe [ 423.764903][ T8022] veth0_vlan: entered promiscuous mode [ 423.797205][ T8022] veth1_vlan: entered promiscuous mode [ 423.916956][ T8022] veth0_macvtap: entered promiscuous mode [ 423.930424][ T8022] veth1_macvtap: entered promiscuous mode [ 423.984566][ T8022] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.989397][ T8535] binder: 8533:8535 ioctl c0306201 0 returned -14 [ 424.010411][ T8022] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 424.021726][ T820] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 424.031933][ T1552] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.031977][ T1552] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.032012][ T1552] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.032046][ T1552] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.183495][ T820] usb 3-1: Using ep0 maxpacket: 16 [ 424.192031][ T820] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 424.192062][ T820] usb 3-1: config 0 interface 0 has no altsetting 0 [ 424.192093][ T820] usb 3-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 424.192113][ T820] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.228364][ T820] usb 3-1: config 0 descriptor?? [ 424.916057][ T820] nzxt-smart2 0003:1E71:2009.0008: unknown main item tag 0x0 [ 424.916095][ T820] nzxt-smart2 0003:1E71:2009.0008: unknown main item tag 0x0 [ 424.916120][ T820] nzxt-smart2 0003:1E71:2009.0008: unknown main item tag 0x0 [ 424.916143][ T820] nzxt-smart2 0003:1E71:2009.0008: unknown main item tag 0x0 [ 424.916166][ T820] nzxt-smart2 0003:1E71:2009.0008: unknown main item tag 0x0 [ 425.106653][ T820] nzxt-smart2 0003:1E71:2009.0008: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.2-1/input0 [ 425.461685][ T820] usb 3-1: USB disconnect, device number 33 [ 425.539398][ T1439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.539417][ T1439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.679546][ T8546] fido_id[8546]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 425.704853][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.704868][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.572250][ T8572] ======================================================= [ 429.572250][ T8572] WARNING: The mand mount option has been deprecated and [ 429.572250][ T8572] and is ignored by this kernel. Remove the mand [ 429.572250][ T8572] option from the mount to silence this warning. [ 429.572250][ T8572] ======================================================= [ 440.161224][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.161302][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 444.043482][ T8675] input: syz0 as /devices/virtual/input/input9 [ 446.933455][ T8706] netlink: 20 bytes leftover after parsing attributes in process `syz.2.739'. [ 448.907028][ T5600] Bluetooth: hci5: command 0x041b tx timeout [ 449.623153][ T8733] netlink: 'syz.0.750': attribute type 10 has an invalid length. [ 449.623177][ T8733] netlink: 40 bytes leftover after parsing attributes in process `syz.0.750'. [ 449.623276][ T8733] team0: entered promiscuous mode [ 449.623292][ T8733] team_slave_0: entered promiscuous mode [ 449.623592][ T8733] team_slave_1: entered promiscuous mode [ 449.623777][ T8733] team0: entered allmulticast mode [ 449.623790][ T8733] team_slave_0: entered allmulticast mode [ 449.623811][ T8733] team_slave_1: entered allmulticast mode [ 449.624591][ T8733] bridge0: port 3(team0) entered blocking state [ 449.624707][ T8733] bridge0: port 3(team0) entered disabled state [ 449.629108][ T8733] bridge0: port 3(team0) entered blocking state [ 449.629240][ T8733] bridge0: port 3(team0) entered forwarding state [ 450.303223][ T8739] netlink: 20 bytes leftover after parsing attributes in process `syz.0.753'. [ 452.465223][ T820] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 452.611704][ T820] usb 2-1: Using ep0 maxpacket: 32 [ 452.660662][ T820] usb 2-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice= 0.40 [ 452.660727][ T820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.660778][ T820] usb 2-1: Product: syz [ 452.660827][ T820] usb 2-1: Manufacturer: syz [ 452.660841][ T820] usb 2-1: SerialNumber: syz [ 453.582519][ T820] snd-ua101 2-1:1.1: sample format descriptor not found [ 453.582551][ T820] snd-ua101 2-1:1.0: invalid num_altsetting [ 453.800592][ T820] usb 2-1: USB disconnect, device number 9 [ 454.724079][ T36] audit: type=1800 audit(1777779003.958:18): pid=8763 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.760" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 457.750858][ T36] audit: type=1804 audit(1777779006.818:19): pid=8788 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.765" name="/newroot/178/file0" dev="tmpfs" ino=942 res=1 errno=0 [ 468.217254][ T8836] netlink: 136 bytes leftover after parsing attributes in process `syz.2.782'. [ 468.474888][ T8830] syz.0.777 (8830) used greatest stack depth: 16840 bytes left [ 468.790738][ T8853] netlink: 'syz.2.789': attribute type 10 has an invalid length. [ 468.790759][ T8853] netlink: 40 bytes leftover after parsing attributes in process `syz.2.789'. [ 471.671739][ T8864] netlink: 136 bytes leftover after parsing attributes in process `syz.5.793'. [ 480.407533][ T8876] netlink: 20 bytes leftover after parsing attributes in process `syz.1.795'. [ 481.076393][ T5600] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 481.114907][ T5600] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 481.170108][ T5600] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 481.244146][ T5600] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 481.249241][ T5600] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 483.326223][ T8918] netlink: 136 bytes leftover after parsing attributes in process `syz.2.806'. [ 483.390166][ T5600] Bluetooth: hci4: command tx timeout [ 486.401089][ T5600] Bluetooth: hci4: command tx timeout [ 488.469545][ T5600] Bluetooth: hci4: command tx timeout [ 490.801592][ T5600] Bluetooth: hci4: command tx timeout [ 491.949165][ T36] audit: type=1804 audit(1777779041.358:20): pid=8974 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.822" name="/newroot/193/file0" dev="tmpfs" ino=1019 res=1 errno=0 [ 493.083838][ T6234] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 493.725846][ T6234] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 495.635250][ T6234] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.094884][ T9018] netlink: 208240 bytes leftover after parsing attributes in process `syz.4.834'. [ 498.479548][ T6234] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.670055][ T9016] sctp: [Deprecated]: syz.2.832 (pid 9016) Use of struct sctp_assoc_value in delayed_ack socket option. [ 498.670055][ T9016] Use struct sctp_sack_info instead [ 499.116750][ T8885] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.116959][ T8885] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.117971][ T8885] bridge_slave_0: entered allmulticast mode [ 499.135501][ T8885] bridge_slave_0: entered promiscuous mode [ 499.155321][ T8885] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.155509][ T8885] bridge0: port 2(bridge_slave_1) entered disabled state [ 499.155726][ T8885] bridge_slave_1: entered allmulticast mode [ 499.162139][ T8885] bridge_slave_1: entered promiscuous mode [ 499.319012][ T8885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 499.353392][ T8885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 499.399604][ T8885] team0: Port device team_slave_0 added [ 499.411656][ T8885] team0: Port device team_slave_1 added [ 499.464180][ T8885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 499.464196][ T8885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.464222][ T8885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 499.467800][ T8885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 499.467815][ T8885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 499.467842][ T8885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 499.900263][ T9050] netlink: 208240 bytes leftover after parsing attributes in process `syz.4.844'. [ 500.878584][ T8885] hsr_slave_0: entered promiscuous mode [ 500.880100][ T8885] hsr_slave_1: entered promiscuous mode [ 500.921481][ T5706] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 501.071394][ T5706] usb 6-1: Using ep0 maxpacket: 16 [ 501.156927][ T5706] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.156952][ T5706] usb 6-1: config 0 has no interfaces? [ 501.225238][ T5706] usb 6-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 501.225275][ T5706] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.225348][ T5706] usb 6-1: Product: syz [ 501.225362][ T5706] usb 6-1: Manufacturer: syz [ 501.225376][ T5706] usb 6-1: SerialNumber: syz [ 501.301959][ T5706] usb 6-1: config 0 descriptor?? [ 501.476196][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.476362][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.859788][ T9052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.957819][ T9052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 501.966683][ T9052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 501.967172][ T9052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.572695][ T8872] usb 6-1: USB disconnect, device number 7 [ 503.692920][ T9079] netlink: 88 bytes leftover after parsing attributes in process `syz.5.852'. [ 503.780668][ T9064] sctp: [Deprecated]: syz.4.848 (pid 9064) Use of struct sctp_assoc_value in delayed_ack socket option. [ 503.780668][ T9064] Use struct sctp_sack_info instead [ 503.863769][ T9087] netlink: 208240 bytes leftover after parsing attributes in process `syz.5.855'. [ 504.431415][ T8872] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 504.589993][ T8872] usb 2-1: Using ep0 maxpacket: 8 [ 504.605178][ T8872] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 504.605207][ T8872] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.605226][ T8872] usb 2-1: Product: syz [ 504.605239][ T8872] usb 2-1: Manufacturer: syz [ 504.605253][ T8872] usb 2-1: SerialNumber: syz [ 504.666559][ T8872] usb 2-1: config 0 descriptor?? [ 504.688246][ T8872] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 504.688298][ T8872] pctv452e: pctv452e_power_ctrl: 1 [ 504.688298][ T8872] [ 504.688343][ T8872] usb 2-1: selecting invalid altsetting 3 [ 504.688356][ T8872] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 504.688356][ T8872] [ 504.688371][ T8872] dvb-usb: bulk message failed: -22 (5/0) [ 504.748401][ T8872] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 504.750471][ T8872] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 504.750534][ T8872] usb 2-1: media controller created [ 504.799730][ T8872] dvb-usb: bulk message failed: -22 (8/0) [ 504.799753][ T8872] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 504.799808][ T8872] dvb-usb: MAC address reading failed. [ 504.848657][ T8872] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 504.925412][ T9093] dvb-usb: bulk message failed: -22 (8/0) [ 504.925433][ T9093] pctv452e: I2C error -22; AA 02 00 01 00 -> aa 02 31 04 00 01 00 [ 504.975230][ T6234] bridge0: port 3(team0) entered disabled state [ 505.228259][ T6234] bridge_slave_1: left allmulticast mode [ 505.228294][ T6234] bridge_slave_1: left promiscuous mode [ 505.228539][ T6234] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.303892][ T8872] DVB: Unable to find symbol stb0899_attach() [ 505.303907][ T8872] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 505.471493][ T8872] rc_core: IR keymap rc-tt-1500 not found [ 505.471512][ T8872] Registered IR keymap rc-empty [ 505.638906][ T6234] bridge_slave_0: left allmulticast mode [ 505.638929][ T6234] bridge_slave_0: left promiscuous mode [ 505.639066][ T6234] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.023811][ T8872] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 506.263432][ T8872] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input10 [ 507.238335][ T8872] dvb-usb: schedule remote query interval to 100 msecs. [ 507.238353][ T8872] pctv452e: pctv452e_power_ctrl: 0 [ 507.238353][ T8872] [ 507.238360][ T8872] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 507.287998][ T8872] usb 2-1: USB disconnect, device number 10 [ 507.459667][ T9126] netlink: 'syz.2.863': attribute type 25 has an invalid length. [ 507.702095][ T8872] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 509.080600][ T9144] netlink: 28 bytes leftover after parsing attributes in process `syz.5.866'. [ 509.132029][ T6234] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 509.193031][ T6234] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 509.213289][ T6234] bond0 (unregistering): Released all slaves [ 509.296181][ T5260] 8021q: adding VLAN 0 to HW filter on device eth5 [ 509.358695][ T9106] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 509.358976][ T9106] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 509.359087][ T9106] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 509.433407][ T6234] tipc: Left network mode [ 509.455361][ T9106] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 510.836492][ T9149] sctp: [Deprecated]: syz.4.867 (pid 9149) Use of struct sctp_assoc_value in delayed_ack socket option. [ 510.836492][ T9149] Use struct sctp_sack_info instead [ 511.381440][ T5600] Bluetooth: hci4: command 0x0c1a tx timeout [ 511.381692][ T5600] Bluetooth: hci5: command 0x041b tx timeout [ 513.182698][ T5260] 8021q: adding VLAN 0 to HW filter on device eth6 [ 513.401195][ T9194] netlink: 'syz.1.877': attribute type 25 has an invalid length. [ 513.528494][ T59] Bluetooth: hci4: command 0x0c1a tx timeout [ 513.827942][ T9202] netlink: 28 bytes leftover after parsing attributes in process `syz.5.879'. [ 513.991671][ T9189] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 514.002444][ T9189] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 514.269575][ T8885] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 514.539499][ T8885] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 516.210516][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 516.217882][ T59] Bluetooth: hci4: command 0x0c1a tx timeout [ 517.705422][ T59] Bluetooth: hci5: unexpected event for opcode 0x0402 [ 518.384755][ T6234] hsr_slave_0: left promiscuous mode [ 518.476716][ T6234] hsr_slave_1: left promiscuous mode [ 518.477809][ T6234] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 518.477834][ T6234] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.517303][ T6234] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 518.517321][ T6234] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 519.073701][ T6234] veth1_macvtap: left promiscuous mode [ 519.073798][ T6234] veth0_macvtap: left promiscuous mode [ 519.096702][ T6234] veth1_vlan: left promiscuous mode [ 519.096892][ T6234] veth0_vlan: left promiscuous mode [ 519.969099][ T6234] team_slave_1 (unregistering): left promiscuous mode [ 519.969134][ T6234] team_slave_1 (unregistering): left allmulticast mode [ 520.003945][ T6234] team0 (unregistering): Port device team_slave_1 removed [ 520.018939][ T6234] team_slave_0 (unregistering): left promiscuous mode [ 520.018962][ T6234] team_slave_0 (unregistering): left allmulticast mode [ 520.058747][ T6234] team0 (unregistering): Port device team_slave_0 removed [ 520.264212][ T8885] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 520.306996][ T8885] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 520.312476][ T8885] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 520.347358][ T8885] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 520.349875][ T8885] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 520.381671][ T9239] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 520.394793][ T9239] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 520.454549][ T8885] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 522.421492][ T59] Bluetooth: hci4: command 0x0c1a tx timeout [ 522.421529][ T59] Bluetooth: hci5: command 0x041b tx timeout [ 524.096740][ T36] audit: type=1804 audit(1777779073.508:21): pid=9276 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.899" name="/newroot/188/file0" dev="tmpfs" ino=983 res=1 errno=0 [ 525.357766][ T8885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 525.651483][ T8885] 8021q: adding VLAN 0 to HW filter on device team0 [ 525.816537][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 525.816664][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 525.958341][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 525.958436][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 526.393931][ T9295] netlink: 'syz.1.905': attribute type 25 has an invalid length. [ 526.560466][ T6234] IPVS: stop unused estimator thread 0... [ 528.379466][ T36] audit: type=1804 audit(1777779077.788:22): pid=9312 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.910" name="/newroot/39/file0" dev="tmpfs" ino=220 res=1 errno=0 [ 529.276714][ T5854] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 529.461450][ T5854] usb 5-1: Using ep0 maxpacket: 16 [ 529.470554][ T5854] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.470626][ T5854] usb 5-1: config 0 has no interfaces? [ 529.617075][ T5854] usb 5-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 529.617142][ T5854] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.617162][ T5854] usb 5-1: Product: syz [ 529.617176][ T5854] usb 5-1: Manufacturer: syz [ 529.617189][ T5854] usb 5-1: SerialNumber: syz [ 530.011944][ T5854] usb 5-1: config 0 descriptor?? [ 530.452450][ T9320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.608181][ T9320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.052119][ T9320] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.078206][ T9320] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 534.072701][ T5260] 8021q: adding VLAN 0 to HW filter on device eth7 [ 534.108649][ T820] usb 5-1: USB disconnect, device number 17 [ 534.682609][ T9350] netlink: 'syz.4.918': attribute type 2 has an invalid length. [ 534.759350][ T9353] netlink: 136 bytes leftover after parsing attributes in process `syz.2.917'. [ 536.157179][ T36] audit: type=1804 audit(1777779085.568:23): pid=9365 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.4.922" name="/newroot/218/file0" dev="tmpfs" ino=1149 res=1 errno=0 [ 537.959506][ T5600] Bluetooth: hci5: unexpected event for opcode 0x0000 [ 539.775513][ T9403] tipc: Started in network mode [ 539.775540][ T9403] tipc: Node identity fef2d20000000000000000000000001, cluster identity 4711 [ 539.775586][ T9403] tipc: Enabling of bearer rejected, failed to enable media [ 539.780876][ T8885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.024305][ T5600] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 542.056491][ T5600] Bluetooth: hci5: Injecting HCI hardware error event [ 542.107428][ T5600] Bluetooth: hci5: hardware error 0x00 [ 543.076768][ T9411] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 543.101149][ T5260] 8021q: adding VLAN 0 to HW filter on device eth8 [ 543.907967][ T9465] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 543.937807][ T9465] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 543.956361][ T9465] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 543.977224][ T9465] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 543.980052][ T9465] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 544.261726][ T5600] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 546.131375][ T9472] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 546.131599][ T9472] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 546.757607][ T9472] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 548.595749][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 549.629972][ T9503] fuse: Bad value for 'fd' [ 550.661549][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 552.756396][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 554.241612][ T9550] fuse: Bad value for 'fd' [ 554.569561][ T9533] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 554.956373][ T9562] Driver unsupported XDP return value 0 on prog (id 45) dev N/A, expect packet loss! [ 555.788918][ T9573] netlink: 20 bytes leftover after parsing attributes in process `syz.2.973'. [ 556.581752][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 558.664012][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 559.791449][ T5706] usb 3-1: new full-speed USB device number 34 using dummy_hcd [ 559.953670][ T5706] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.953723][ T5706] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 559.953744][ T5706] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 559.956312][ T5706] usb 3-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 559.956339][ T5706] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 559.956359][ T5706] usb 3-1: Product: syz [ 559.956373][ T5706] usb 3-1: Manufacturer: syz [ 559.956583][ T5706] usb 3-1: SerialNumber: syz [ 559.973449][ T5706] usb 3-1: config 0 descriptor?? [ 559.986634][ T5706] radio-si470x 3-1:0.0: could not find interrupt in endpoint [ 559.986717][ T5706] radio-si470x 3-1:0.0: probe with driver radio-si470x failed with error -5 [ 559.987332][ T5706] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 560.741458][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 560.876037][ T9602] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 562.911689][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 562.961018][ T1333] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.961093][ T1333] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.635935][ T43] usb 3-1: USB disconnect, device number 34 [ 564.950423][ T13] bridge_slave_1: left allmulticast mode [ 564.950458][ T13] bridge_slave_1: left promiscuous mode [ 564.950695][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 565.085230][ T13] bridge_slave_0: left allmulticast mode [ 565.085265][ T13] bridge_slave_0: left promiscuous mode [ 565.085493][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 565.987240][ T9679] netlink: 'syz.2.988': attribute type 10 has an invalid length. [ 565.987263][ T9679] netlink: 40 bytes leftover after parsing attributes in process `syz.2.988'. [ 566.744815][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 566.822482][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 566.853611][ T13] bond0 (unregistering): Released all slaves [ 567.011576][ T9456] bridge0: port 1(bridge_slave_0) entered blocking state [ 567.012434][ T9456] bridge0: port 1(bridge_slave_0) entered disabled state [ 567.012632][ T9456] bridge_slave_0: entered allmulticast mode [ 567.014756][ T9456] bridge_slave_0: entered promiscuous mode [ 567.022057][ T9456] bridge0: port 2(bridge_slave_1) entered blocking state [ 567.022181][ T9456] bridge0: port 2(bridge_slave_1) entered disabled state [ 567.022363][ T9456] bridge_slave_1: entered allmulticast mode [ 567.065243][ T9456] bridge_slave_1: entered promiscuous mode [ 567.181684][ T9670] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 567.604665][ T13] hsr_slave_0: left promiscuous mode [ 567.768394][ T5331] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 567.794107][ T13] hsr_slave_1: left promiscuous mode [ 567.794838][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 567.882797][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 567.924878][ T5331] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.924944][ T5331] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 567.924971][ T5331] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 567.927789][ T5331] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 567.927815][ T5331] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 567.927833][ T5331] usb 2-1: Product: syz [ 567.927846][ T5331] usb 2-1: Manufacturer: syz [ 567.927860][ T5331] usb 2-1: SerialNumber: syz [ 568.106541][ T5331] usb 2-1: config 0 descriptor?? [ 568.142685][ T5331] radio-si470x 2-1:0.0: could not find interrupt in endpoint [ 568.142775][ T5331] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -5 [ 568.144576][ T5331] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 569.231782][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 570.668785][ T5706] usb 2-1: USB disconnect, device number 11 [ 571.753613][ T820] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 572.091524][ T820] usb 5-1: Using ep0 maxpacket: 16 [ 572.093899][ T820] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.093922][ T820] usb 5-1: config 0 has no interfaces? [ 572.096573][ T820] usb 5-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 572.096600][ T820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.096620][ T820] usb 5-1: Product: syz [ 572.096633][ T820] usb 5-1: Manufacturer: syz [ 572.096646][ T820] usb 5-1: SerialNumber: syz [ 572.200385][ T820] usb 5-1: config 0 descriptor?? [ 572.420785][ T9723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 572.435250][ T9723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.718419][ T13] team0 (unregistering): Port device team_slave_1 removed [ 574.533235][ T13] team0 (unregistering): Port device team_slave_0 removed [ 574.617916][ T43] usb 5-1: USB disconnect, device number 18 [ 575.726343][ T9456] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 575.756693][ T5260] 8021q: adding VLAN 0 to HW filter on device eth9 [ 575.780924][ T9456] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 575.807437][ T9744] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 576.817208][ T5706] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 577.119428][ T9456] team0: Port device team_slave_0 added [ 577.964080][ T59] Bluetooth: hci2: command 0x041b tx timeout [ 578.003120][ T5706] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.003171][ T5706] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 578.003197][ T5706] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 578.013262][ T9456] team0: Port device team_slave_1 added [ 578.074431][ T5706] usb 5-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 578.074460][ T5706] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 578.074479][ T5706] usb 5-1: Product: syz [ 578.074493][ T5706] usb 5-1: Manufacturer: syz [ 578.074507][ T5706] usb 5-1: SerialNumber: syz [ 578.082226][ T5706] usb 5-1: config 0 descriptor?? [ 578.148907][ T5706] radio-si470x 5-1:0.0: could not find interrupt in endpoint [ 578.149001][ T5706] radio-si470x 5-1:0.0: probe with driver radio-si470x failed with error -5 [ 578.149619][ T5706] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 578.252492][ T9784] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1017'. [ 578.763315][ T9456] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 578.763332][ T9456] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 578.763358][ T9456] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 579.023417][ T9456] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 579.023436][ T9456] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 579.023463][ T9456] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 579.292607][ T9456] hsr_slave_0: entered promiscuous mode [ 579.299855][ T9456] hsr_slave_1: entered promiscuous mode [ 579.505389][ T9802] misc userio: The device must be registered before sending interrupts [ 580.029205][ T43] usb 5-1: USB disconnect, device number 19 [ 581.556091][ T9829] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1028'. [ 584.391462][ T5706] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 584.566009][ T5706] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 584.566062][ T5706] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 584.566096][ T5706] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 584.583990][ T5706] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 584.584019][ T5706] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 584.584038][ T5706] usb 6-1: Product: syz [ 584.584050][ T5706] usb 6-1: Manufacturer: syz [ 584.584063][ T5706] usb 6-1: SerialNumber: syz [ 584.602805][ T5706] usb 6-1: config 0 descriptor?? [ 584.630608][ T5706] radio-si470x 6-1:0.0: could not find interrupt in endpoint [ 584.630688][ T5706] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 584.632281][ T5706] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 586.293031][ T9872] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1036'. [ 587.996227][ T43] usb 6-1: USB disconnect, device number 8 [ 588.646435][ T9456] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 588.958892][ T9456] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 588.977044][ T9456] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 589.051094][ T9456] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 589.063153][ T9456] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 589.295022][ T9456] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 589.366419][ T9456] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 589.490252][ T9456] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 590.970644][ T9456] 8021q: adding VLAN 0 to HW filter on device bond0 [ 591.035146][ T9456] 8021q: adding VLAN 0 to HW filter on device team0 [ 591.056847][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.057064][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 591.129011][ T176] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.129141][ T176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.239329][ T9956] fuse: Bad value for 'rootmode' [ 594.704660][ T36] audit: type=1800 audit(1777779144.118:24): pid=9976 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.1060" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 595.067725][ T9456] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 595.670761][ T9999] misc userio: The device must be registered before sending interrupts [ 596.058598][ T9456] veth0_vlan: entered promiscuous mode [ 596.085638][ T9456] veth1_vlan: entered promiscuous mode [ 596.727691][ T9456] veth0_macvtap: entered promiscuous mode [ 596.768303][ T9456] veth1_macvtap: entered promiscuous mode [ 597.094476][ T9456] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 597.150573][ T9456] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 597.173358][ T42] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.175474][ T42] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.175518][ T42] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.175552][ T42] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 597.310400][ T36] audit: type=1800 audit(1777779146.718:25): pid=10021 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.1070" name="SYSV00000000" dev="tmpfs" ino=2 res=0 errno=0 [ 597.512517][ T43] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 597.603456][T10026] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1072'. [ 597.683568][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 597.690165][ T43] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 597.690188][ T43] usb 6-1: config 0 has no interfaces? [ 597.713663][ T43] usb 6-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 597.713691][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 597.713708][ T43] usb 6-1: Product: syz [ 597.713720][ T43] usb 6-1: Manufacturer: syz [ 597.713732][ T43] usb 6-1: SerialNumber: syz [ 597.768805][ T43] usb 6-1: config 0 descriptor?? [ 597.885120][ T5600] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 597.957178][ T5600] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 597.959438][ T5600] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 597.975025][ T5600] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 598.021606][ T5600] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 598.065027][T10019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.065672][T10019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 598.226068][T10019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 598.226701][T10019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 599.575841][T10050] misc userio: The device must be registered before sending interrupts [ 600.081440][ T176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.081460][ T176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.262061][ T59] Bluetooth: hci4: command tx timeout [ 600.475928][ T5854] usb 6-1: USB disconnect, device number 9 [ 600.892455][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 600.892477][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.002649][T10073] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1081'. [ 602.370268][ T59] Bluetooth: hci4: command tx timeout [ 603.408578][T10091] misc userio: The device must be registered before sending interrupts [ 604.076192][T10103] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1088'. [ 604.430732][ T59] Bluetooth: hci4: command tx timeout [ 605.223651][T10125] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1092'. [ 605.429690][T10131] netlink: zone id is out of range [ 605.429704][T10131] netlink: zone id is out of range [ 605.429711][T10131] netlink: zone id is out of range [ 605.429719][T10131] netlink: zone id is out of range [ 605.429725][T10131] netlink: zone id is out of range [ 605.429733][T10131] netlink: zone id is out of range [ 605.429740][T10131] netlink: zone id is out of range [ 605.429747][T10131] netlink: zone id is out of range [ 605.429754][T10131] netlink: zone id is out of range [ 605.429762][T10131] netlink: zone id is out of range [ 605.620877][T10135] netlink: 120 bytes leftover after parsing attributes in process `syz.5.1095'. [ 605.639613][ T5600] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 605.732449][ T5600] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 605.737550][ T5600] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 605.762870][ T5600] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 605.764618][ T5600] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 606.622906][ T5600] Bluetooth: hci4: command tx timeout [ 607.401026][T10142] misc userio: The device must be registered before sending interrupts [ 608.386723][ T36] audit: type=1800 audit(1777779157.798:26): pid=10165 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.1102" name="SYSV00000000" dev="tmpfs" ino=3 res=0 errno=0 [ 609.313007][ T59] Bluetooth: hci2: command tx timeout [ 609.368734][T10174] netlink: 120 bytes leftover after parsing attributes in process `syz.4.1105'. [ 609.400175][T10177] misc userio: The device must be registered before sending interrupts [ 610.845647][ T1455] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 611.382173][ T59] Bluetooth: hci2: command tx timeout [ 611.829711][T10185] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1108'. [ 612.287762][ T1455] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.480332][ T59] Bluetooth: hci2: command tx timeout [ 613.780818][ T1455] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.826681][T10217] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1114'. [ 614.150703][T10221] netlink: 120 bytes leftover after parsing attributes in process `syz.2.1115'. [ 614.223573][T10223] misc userio: The device must be registered before sending interrupts [ 615.621456][ T59] Bluetooth: hci2: command tx timeout [ 615.874603][ T1455] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 616.059562][T10029] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.063539][T10029] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.063701][T10029] bridge_slave_0: entered allmulticast mode [ 616.100659][T10029] bridge_slave_0: entered promiscuous mode [ 616.192654][T10029] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.192757][T10029] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.192917][T10029] bridge_slave_1: entered allmulticast mode [ 616.206365][T10029] bridge_slave_1: entered promiscuous mode [ 616.620167][T10029] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 616.714588][T10029] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 617.065635][T10029] team0: Port device team_slave_0 added [ 617.129759][T10029] team0: Port device team_slave_1 added [ 617.213312][T10246] misc userio: The device must be registered before sending interrupts [ 618.820866][T10029] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 618.820877][T10029] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 618.820891][T10029] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 618.971495][T10029] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 618.971505][T10029] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 618.971520][T10029] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 621.567335][T10271] misc userio: The device must be registered before sending interrupts [ 622.994727][T10029] hsr_slave_0: entered promiscuous mode [ 623.045453][T10029] hsr_slave_1: entered promiscuous mode [ 623.046073][T10029] debugfs: 'hsr0' already exists in 'hsr' [ 623.046088][T10029] Cannot create hsr debugfs directory [ 623.280221][T10297] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1138'. [ 623.474658][T10302] ================================================================== [ 623.474673][T10302] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 623.474721][T10302] Read of size 8 at addr ffffc90004c42008 by task vhost-10301/10302 [ 623.474738][T10302] [ 623.474761][T10302] CPU: 0 UID: 0 PID: 10302 Comm: vhost-10301 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 623.474782][T10302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 623.474796][T10302] Call Trace: [ 623.474802][T10302] [ 623.474811][T10302] dump_stack_lvl+0xe8/0x150 [ 623.474833][T10302] print_address_description+0x55/0x1e0 [ 623.474854][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.474881][T10302] print_report+0x58/0x70 [ 623.474899][T10302] kasan_report+0x117/0x150 [ 623.474919][T10302] ? rt_spin_lock+0x20e/0x400 [ 623.474946][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.474977][T10302] __list_del_entry_valid_or_report+0xb5/0x190 [ 623.475006][T10302] kcov_remote_start+0x2af/0x710 [ 623.475028][T10302] vhost_run_work_list+0x129/0x1e0 [ 623.475052][T10302] ? __pfx_vhost_run_work_list+0x10/0x10 [ 623.475074][T10302] vhost_task_fn+0x2ef/0x4a0 [ 623.475104][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.475131][T10302] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 623.475158][T10302] ? rt_spin_unlock+0x14f/0x200 [ 623.475186][T10302] ? rt_spin_unlock+0x160/0x200 [ 623.475211][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.475236][T10302] ret_from_fork+0x514/0xb70 [ 623.475258][T10302] ? __pfx_ret_from_fork+0x10/0x10 [ 623.475282][T10302] ? __switch_to+0xc79/0x1410 [ 623.475312][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.475337][T10302] ret_from_fork_asm+0x1a/0x30 [ 623.475367][T10302] [ 623.475374][T10302] [ 623.475378][T10302] The buggy address belongs to a vmalloc virtual mapping [ 623.475394][T10302] Memory state around the buggy address: [ 623.475405][T10302] ffffc90004c41f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 623.475417][T10302] ffffc90004c41f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 623.475430][T10302] >ffffc90004c42000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 623.475439][T10302] ^ [ 623.475448][T10302] ffffc90004c42080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 623.475460][T10302] ffffc90004c42100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 623.475469][T10302] ================================================================== [ 623.475585][T10302] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 623.475598][T10302] CPU: 0 UID: 0 PID: 10302 Comm: vhost-10301 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 623.475624][T10302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 623.475635][T10302] Call Trace: [ 623.475641][T10302] [ 623.475648][T10302] vpanic+0x56c/0xa60 [ 623.475673][T10302] ? __pfx_vpanic+0x10/0x10 [ 623.475696][T10302] panic+0xc5/0xd0 [ 623.475716][T10302] ? __pfx_panic+0x10/0x10 [ 623.475736][T10302] ? preempt_schedule_thunk+0x16/0x30 [ 623.475764][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.475792][T10302] ? preempt_schedule_thunk+0x16/0x30 [ 623.475818][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.475845][T10302] check_panic_on_warn+0x89/0xb0 [ 623.475870][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.475898][T10302] end_report+0x73/0x170 [ 623.475919][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.475945][T10302] kasan_report+0x128/0x150 [ 623.475964][T10302] ? rt_spin_lock+0x20e/0x400 [ 623.475990][T10302] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 623.476022][T10302] __list_del_entry_valid_or_report+0xb5/0x190 [ 623.476051][T10302] kcov_remote_start+0x2af/0x710 [ 623.476072][T10302] vhost_run_work_list+0x129/0x1e0 [ 623.476095][T10302] ? __pfx_vhost_run_work_list+0x10/0x10 [ 623.476117][T10302] vhost_task_fn+0x2ef/0x4a0 [ 623.476146][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.476173][T10302] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 623.476200][T10302] ? rt_spin_unlock+0x14f/0x200 [ 623.476227][T10302] ? rt_spin_unlock+0x160/0x200 [ 623.476252][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.476281][T10302] ret_from_fork+0x514/0xb70 [ 623.476303][T10302] ? __pfx_ret_from_fork+0x10/0x10 [ 623.476323][T10302] ? __switch_to+0xc79/0x1410 [ 623.476351][T10302] ? __pfx_vhost_task_fn+0x10/0x10 [ 623.476378][T10302] ret_from_fork_asm+0x1a/0x30 [ 623.476407][T10302] [ 623.476769][T10302] Kernel Offset: disabled