last executing test programs: 5.819779313s ago: executing program 4 (id=377): sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x20000084) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007440)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)}], 0x1, 0x0, 0x0, 0x40045}], 0x1, 0x14) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x5, 0x1c, 0x7, 0x1, 0x0, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x8922, 0x6, 0x8000, 0xf45, 0x400003, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x100, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x4, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x4, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000300)={r3, &(0x7f0000000100)='}%#-\x00', 0x20100, &(0x7f0000000140)={@align=0xb3, {0x5aa, 0x3, 0x80000000, 0x8b}}, 0x1, &(0x7f0000000280)={@_ha_fsid}, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000002c0)={0x2, 0x1, 0x4}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 4.709939036s ago: executing program 2 (id=380): r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000080)="1d10ea", 0x3}], 0x1) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x1e57, 0xc237, 0x7, 0xa, 0xea, "04ad7d2ed56d7f7f598da7590de9d3000d00", 0x20000006, 0x7}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000040)=0xa) 4.69793841s ago: executing program 0 (id=381): socket$netlink(0x10, 0x3, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000206030000000000000000000d0000000c000300686173683a69700005000400000000000900020073797a31000000000c000780080008400000005d05000500020000000500010006"], 0x50}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x34, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 4.437403082s ago: executing program 3 (id=383): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x2d, 0xff, 0x30, 0x19}, {0xf000, 0x3000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x1, 0x58, 0x3, 0x3}, {0xdddd1000, 0xe000, 0xb, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x21, 0xab, 0x5, 0x81}, {0xdddd0000, 0xffff1000, 0x3, 0x5d, 0x4, 0x40, 0x0, 0xfa, 0x80, 0x7, 0xe, 0x4}, {0xdddd0000, 0x9000, 0x8, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x47, 0x83, 0xf7, 0x82}, {0x0, 0x80a0000, 0x8, 0xa0, 0xb5, 0x8, 0x1, 0xd, 0x88, 0xf, 0x1, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0xb, 0x7e, 0xff, 0x70}, {0xd000, 0xb000, 0xe, 0x5, 0xf, 0x7, 0x3, 0x16, 0x2, 0x3, 0x7, 0xb}, {0xb000, 0x2d}, {0x10000, 0x3ff}, 0x80000031, 0x0, 0x6000, 0x42024, 0x6, 0x9501, 0x3000, [0x6840000000000002, 0x3, 0x91, 0xff]}) 4.294708351s ago: executing program 2 (id=384): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfb, {{@in6=@private0, @in=@empty, 0x0, 0x4, 0x1, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe, 0x4}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x134}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x0) 4.292215423s ago: executing program 4 (id=385): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0xfffffffffffffeee, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b924, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xb}, {0x6, 0xffe0}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x200040e0}, 0x4890) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r5, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c", 0x11, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) 4.268460784s ago: executing program 0 (id=386): sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000400)="c3730b42f33a6888a09cf40d2b30e7e106a25478f8507fe7544db34b57e936242b581ba8fa6a4dc5704d5660a7fb6f76587176db3e1196d6d737aedd64d888b5ecb7bbf9df389ada8ccdf9d65994532ded8288dbc4ebb6b6bded41b3cbc37ba8353c90e94b9db1207ecc04e3d2243d71c51f3e17f5048f6c312a7ff7ed3e55a48f7d0b84f67f80b1e5973bd8db39b66cd0dc3fdc398d0fec54e8d2d3ecea29f453bc4040146fab44ac68997f69d86a966889c83d5fea9dacb5188461e41c626ccd6f1fe89bee123a0f730a418618eb1af87803c9269d001b794f7c9b0f15d3137f6715c3d40407f0d81b2a0882dd0012b8bffbc994b90b402d4994045725f2b4ac8c146f3b85843d9a2a26838e8d42377e6d6f437d0e1108867c0c4897973c4b6fbc0c009cc40978f098a9697c1fb61e3ec2da86b99e3f4f7f485b2d56fb2a67b80c6376508796bb24241625fbb99a344ddf51d700e882ce24b8b31d1b4c8edf1344df197760815362a15d95bbe0a55d01f0c85d039df51a684b9addbfcba4c64cc6f3ce851d09ec1d5f3528122a8fa484cfcc52d9bd34857c3165345402bb8d23cb3e9a93c81001e09391e5999c8340a7d2bfde840adfc9ebb4da499ed8ba4f269cb4e09c8ee9b673658f54062918a00184ec757cefe9f0715245a7ebb4613f2d956c53aa01a391becb2b30c03b2652a63c3ce67967b15450aa29da49dfce04f8ac8f98c2bc92e31741b5d41526d6670469403a0b35fcb3ca8e9252fb07ca20c76dcc2a07c97722094196404707761a50fd5559daf65e331ea38af75cfc7661a4bdfdde151dd43cd0c768b2244211c74cdc02d3cc5909ef59307df8e2df845ea7592244126870226a18c5de4d032e948167bcd86af748d5a015ecb47ef204d0b61d98c2c750626668beac41d92e42fd37c3a232e01bf3e023cc3d9a009bdf7b5c40c8ac8b7397c0527607bec8a730a80faca70385497ecdef21465ca91445b97d38bc0b7c362b5e95f098ad6edb49806e64b4a9e52bfb1be1f25c7c935bcea71e0d08e3f4fda0ce88ad2b20e1a120321c6d72a6e0baedf879909e181aea2f790ee77c505624ab5dbcea2a93b3b376378dc1eaef835f6947fc9ba399f07793a4d72452dc291e6f0b26d5d0186ae621c399ca37f3c708e5f17185dda5551a1af58266c0295de1e6364e48ab0cd45d0f2f20a0879198205e018664ccbfd817f7bd53614b3e595196a31a80b30b85251602cc179d9f522371f69f76615c768a4e9d518e67599c736f396d4a7e69d43511439391a35261069fe2afc3eb023d0396fb099b3af2b976d718053af139549bcf2d5aad17c8940e41bc780693230b568643edefc61f63079de16f4cb7023c4e7146aa4695c0a8715194aa30ce587913a2964662333ac7ee18197a171a6ea723005277eb60e1a029821dffede17f239c2f44fe5a07056ff1bbce8b0a7637b49e2bd74ccec6015b36ee97129734c86b6e029cd342a2867e6c16dcad8cf0a9c309189428c499cecb120fe05e6b7cbbcccc264f58051ee1f46b99a3bc9db69ee17b6cc132be4d39910e3637e17823f4eca36108dbb038494e2b0475433b39e1e6ae7ffc27949b577356046032acd2ae125045dd709941a468c9457a3835b6a863eca59f9ba6e7424ffba68ddcf841db654a96b601906fb870354370aa177610454ecae2d70c6f074bc26631488232d418d8fa76877df22a310530acd53de5e1263aeb08abaac73016acdc3ef65c0035f4401f286343085c100bd8b9535771a786bb10da5ae9951355bbcf3be5b8b11b09869e5d923f98eb5538e9d59307aca92753453ff1a55d8d4feebfaaf0d1661f4cf957a90f09d9423886958488ab45a2a4b5ee710188ec87b27a87f7cf0908840591b137a231a78ecc6ce0978d8a8c5d5cedfe42bccbacff9ce26313345bb5d08810f57ba9ae0ea35e3d6cf3210b0bd6a862daeecac59fbba9b7720111e7d42a59795357207970c475e3622a3502c43d953413dea8a78c09ad4dbab7ff15db0cc37ee227065bd045243631f5d6880416387579b656882208d9cf37c9d577d74e273d0b1e43224bc958e16680b1fb8db7f92fdbc68d241c444da3fccf23379a5b6b75d73c96130464a485e54a8875c5d46a0684b2b906956963b0ed877d3f5aafaa1cb61a7694dc4e892cd3d475d6f206b7d9b4f90baa082df997f561db262ab700ae97322fb7c5c194edcf2ef7a7d4a26dbe3f01efa4c981b4891b3fb45603beb5464b34d434c2b376ca93020ee978afa705e32823021248b84e89e0846f09affa8c32fc9dc4d01cf058b0ee1daa936a6fb4e742496fb06ada4cd57e8b55d47644abffae306c4c1e28bf94208d01909833720e7b1bba483cd684c3c196b2be910abb846ce4c689817447f17755b5b4bc87304014e5539562545b6e136dfa7df1b9997d54678ed27133dd447a040e58befda63a33b3de79bf1f5c42992d84aaa0073f0c4b5fcec9850e931d3405dadffe48101572e37d55545f4b13c142c9502b1e00bc854229bf069fa620989ef34f9ffd75ff8e26e59c2711f05e1b57a7aa0bdeb14f3c76fdd53a322a43ca9fc10751f1ebb643dcf6e8db6e712bc68bf7ddc9e38ce6a244f800da8c8c436e9626fe8a7ac621a51e6947176f450679bbc005823645627668bcee6880a1231de8301931033fcb23a2fa51200aaf02a0c083cadf63c65ef64b22b2e8f16fd05d2ad0f8782b331c00361df3fe98b0b6632996859629e4aab0acc24914a8b71b514b22101a7e08fd413791c52563d85a25d20b863dcd7dabeac3f4f7f39fc04e8f1e78d125549388471a074a7b29a6de5661d938b23850fd5bac23a3eea28187789cf2c13fd41a1db4f3ecd877d3c94b1d4ae0e6a37d2b371bceb4c27a8a9140ea4a47df88a198b7120e653198d5d670f50f754277dd099442b072aff40978710f17e55fa43aba77dd60934222dd2ef966013a1d72c7c9284c56e15a8c6153bcb33c51cb48cf683f9fa9da61638a7a13c1adf0d5a9a731e0973afab8d144421a7b4fadc6bc5beb3f6d2170e9e8007503ff4313e819e09b71fadb67bce50edadefa489426389da3c84d9b15a367720caf84b42d8faebf7768f135f8d069c92bb2c54da1462d9b0d0ccdb3bf0a016332989fc155d20aa7b0059a0508adb67d14c778d06575f6f1b5bff45a735ed240743fd9e5f2ef16d05342b9b36725733abdc66c58f2716c2446cc1916f4607a7366431e2a5a83cbfb5986027b7c6d4dbec540a1d3fe9d6dd3be3f1d6f631617d5f8a4aee4c73999221fed1ea1e0d765761951740467343f1e173c47212a31ce514c119e94c18566e34605d7ab2a1851b6fa63fe40e1396583dc3c0ccaac35bad87515ff7d8d7dea498bee82c968e0010aab12b2b4fd90d31ea6bf077dd622cac2a35e7223fab8a46daa27b66bf6ab1b124340a3c14b65da0596de4ef1c3432a5639a069f1255d0ac584450c459cef30f3b57a45abb2b80a74e01c865a7d1040afcfa56d8552247c73fe837489a1288ba3874f81d0da86d64973d4a8955628b86580b588fc9a44d9bc4fac0b170c5c4f4110d169aadd6b1b49ed5478d6a766bd23f021f002dd889a50cef779dc5f0908328eb88e413a7502d4f99abd9341a2d12519eb12ac5a3b6beb7ea802126757b5d72388c327b6ed8d2daa670825eb5c000c5570b34e3d1a6c901c72e96bc419d450d9c4ae9055015a8100fbf9c384a1ec1a0218addf2685b690bbf70bc08d26bf4b195f5f465d151e83009dfce7fb01b5d87aa12128f7746edcb3e870792cca2b4233b27657839ef25fe5878849ad18884a0caa42dedebe2ca42de3342f4c50a47e13edddbabd6d2d720424efe6a7007aaa07762836805b5f3b54775680134f5582ca4bf51b4b0f7f68b26ba4e573892801a7869294b9f36671bb6eaf10523c3792447afd1d22d2e27c849d4721ba73ce5cf0958697398b2a93b1de8971a7102fe9d5b66e92480b24a85d9caa38e6616c3aca2e79e314451cb3da949fc640f71fe5ed91bb7822502d20aa73", 0xb2f}], 0x1}, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d0009058203"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, 0x0, 0x0) 4.163173802s ago: executing program 1 (id=387): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x34, r1, 0x1, 0x4000, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_TX_MAX_FRAMES={0x8, 0x7, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000084}, 0x4000) 3.926645677s ago: executing program 2 (id=388): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r0, &(0x7f0000000a40)="003ef996", 0x4, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x7, 0x84, 0x2, 0x5, 0x5, 0xf2, 0x0, 0x0, 0xfa, 0x2, 0x3, 0x6, 0x2, 0x2}, 0xe) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x81, 0x4) recvmmsg(r0, &(0x7f0000000840)=[{{&(0x7f0000000280)=@un=@abs, 0x0, &(0x7f0000000540)=[{&(0x7f0000000300)=""/174}, {&(0x7f00000003c0)=""/80}, {&(0x7f00000000c0)=""/3}, {&(0x7f0000000180)=""/48}, {&(0x7f0000000440)=""/242}], 0x0, &(0x7f0000000200)=""/24}, 0x6}, {{&(0x7f00000005c0)=@xdp, 0x0, &(0x7f0000000800)=[{&(0x7f0000000640)=""/60}, {&(0x7f0000000680)=""/110}, {&(0x7f0000000940)=""/97}, {&(0x7f0000000780)=""/83}], 0x0, &(0x7f0000001880)=""/4096}, 0xf8d}], 0x73d, 0x140, 0x0) 3.793894696s ago: executing program 1 (id=389): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x1e00, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000280), &(0x7f0000000240)=r0}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) sendmsg$inet(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 3.785646573s ago: executing program 3 (id=390): sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x7fd) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_FPU(r2, 0x41a0ae8d, &(0x7f0000000280)={'\x00', 0xf, 0x66a, 0x9, 0x0, 0x1, 0x80a4000, 0xd000, '\x00', 0xd5ad}) 3.544080169s ago: executing program 1 (id=391): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c00", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="500001"], 0x6) 3.481620281s ago: executing program 4 (id=392): timer_create(0x0, &(0x7f0000000200)={0x0, 0x33, 0x2}, 0x0) r0 = semget$private(0x0, 0x7, 0x195) semtimedop(r0, &(0x7f0000000200)=[{0x0, 0xffff, 0x2000}, {0x4, 0x3, 0x1800}], 0x2, 0x0) 3.149013764s ago: executing program 3 (id=393): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f024}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0xc048aec8, &(0x7f0000000240)={0x5, 0x0, @ioapic={0xf000, 0x1, 0x7, 0x8001, 0x0, [{0x0, 0x7f, 0xa, '\x00', 0x4}, {0x5, 0x1, 0xfa, '\x00', 0x2}, {0x75, 0x4, 0x3, '\x00', 0x76}, {0xc, 0x1, 0x4, '\x00', 0x96}, {0x1, 0x4, 0x4, '\x00', 0x77}, {0x4, 0x3, 0x6, '\x00', 0xf}, {0x2, 0x9, 0xe1, '\x00', 0x4}, {0x3, 0x3, 0xff, '\x00', 0x38}, {0xa, 0x6, 0x40, '\x00', 0x4}, {0xf, 0xf, 0xb, '\x00', 0xfb}, {0xff, 0x3, 0xa1, '\x00', 0x52}, {0x4, 0x1, 0xd, '\x00', 0x5}, {0x1, 0x0, 0x0, '\x00', 0x2}, {0x14, 0x2, 0x7f, '\x00', 0x8}, {0x76, 0x8, 0x7}, {0x40, 0xb, 0xa, '\x00', 0xb2}, {0x5, 0x7e, 0x70, '\x00', 0x9}, {0x6, 0xff, 0x7, '\x00', 0x9}, {0x8, 0x7, 0xa, '\x00', 0x5}, {0x1, 0x9, 0x80, '\x00', 0x4a}, {0x6, 0x4, 0xff, '\x00', 0x6a}, {0x1, 0x7f, 0x8, '\x00', 0x80}, {0x42, 0x56, 0x4, '\x00', 0x6}, {0x7d, 0x5, 0x4, '\x00', 0x58}]}}) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000180)={0x2, @vbi={0x9, 0xdc, 0x2, 0x32314142, [0x1, 0x1], [0x8, 0x5], 0x1}}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r5, 0x84, 0x14, &(0x7f0000000040)="020000000980ffff", 0x8) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000580)={[0x0, 0x2, 0x6079, 0x7, 0x8000000000000001, 0x0, 0x9b55, 0x0, 0x9, 0x9, 0x9, 0x2, 0xffffffff, 0x72, 0x9e7, 0x8000000000000001], 0xffffffff, 0x100000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400005}, 0x94) 2.99672079s ago: executing program 1 (id=394): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000200)={@private0, 0x800, 0x0, 0x1, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x3, 0x1}, 0x20) 2.782672211s ago: executing program 2 (id=395): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) syz_open_dev$tty1(0xc, 0x4, 0x2) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x70bd2a, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) r2 = dup(r0) write$binfmt_elf32(r2, &(0x7f0000000740)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x8, 0x53, 0x8, 0x7, 0x2, 0x6, 0x3, 0x110, 0x38, 0x108, 0xbe8, 0x8001, 0x20, 0x1, 0x6, 0x0, 0x8}, [{0x2, 0x8000, 0x0, 0x4, 0xa, 0x101, 0x6c, 0x80000001}], "", ['\x00']}, 0x158) bind$inet(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x2}}, 0x20) 2.6916639s ago: executing program 1 (id=396): sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x802}, 0x20000084) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007440)=[{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)}], 0x1, 0x0, 0x0, 0x40045}], 0x1, 0x14) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x0, 0x12a3, 0x6, 0x1, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x8, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x5, 0x1c, 0x7, 0x1, 0x0, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0xc7c, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x1, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0xfffff801, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0x9, 0x8, 0x3fc, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x4e, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e55, 0x4005, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d26, 0x10000, 0x1, 0x2, 0x8922, 0x6, 0x8000, 0xf45, 0x400003, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1e, 0x9, 0x100, 0x3, 0x9d82, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x4, 0xc, 0xffffffff, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x4, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000300)={r3, &(0x7f0000000100)='}%#-\x00', 0x20100, &(0x7f0000000140)={@align=0xb3, {0x5aa, 0x3, 0x80000000, 0x8b}}, 0x1, &(0x7f0000000280)={@_ha_fsid}, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) r4 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000002c0)={0x2, 0x1, 0x4}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x31}}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2.662089605s ago: executing program 3 (id=397): io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x38b1, 0x1c080, 0x2, 0x20002f7}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x2140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ptrace(0x10, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.time\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x13, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x60, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r3, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) 2.305989689s ago: executing program 0 (id=398): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f0000000000)={0x1, 0xffffff81}) 2.185509886s ago: executing program 4 (id=399): r0 = io_uring_setup(0x285e, &(0x7f0000000340)={0x0, 0x75a4, 0x10000, 0x3, 0x80004f}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000002100)=0xfff00000, 0x4) cachestat(r1, 0x0, &(0x7f0000000040), 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) dup(r2) 2.073115677s ago: executing program 0 (id=400): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000001300)={0x2, 0xe21, @multicast2}, 0x10) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/udp\x00') pread64(r1, &(0x7f0000000080)=""/96, 0x60, 0x2100) 1.846386339s ago: executing program 3 (id=401): bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) socket$l2tp(0x2, 0x2, 0x73) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100000008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) clock_adjtime(0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000440)=0x6) close(0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) syz_emit_ethernet(0x56, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffff1780c206050e86dd6001000100202cfffe800000000000000000000000000018ff0200000000000000000000000000010402000000000000070000000003028e07000500"/86], 0x0) 1.815705355s ago: executing program 4 (id=402): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/address_bits', 0x82002, 0x105) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x8, 0x9, 0x3, 0xe4, 0x40, 0x3, 0x0, 0x30, 0x19}, {0xeeeb1000, 0x3000, 0xe, 0x0, 0x40, 0x5, 0x7d, 0x9, 0x58, 0x3, 0x3, 0x1}, {0xdddd1000, 0xe000, 0xe, 0x5, 0x3, 0x7, 0xfe, 0x89, 0x1, 0xab, 0x5, 0x81}, {0x6000, 0x8000000, 0x3, 0xa, 0x4, 0x43, 0x3, 0xfb, 0x80, 0x7, 0xe}, {0x0, 0x9000, 0x10, 0x1, 0x3, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x82}, {0x0, 0x80a0000, 0x8, 0xa0, 0xb1, 0x8, 0xc, 0xd, 0x88, 0xf, 0x4, 0xfd}, {0x54000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x81, 0xff, 0x70}, {0xd000, 0x1000, 0xe, 0x5, 0xf, 0x7, 0x1, 0x18, 0x2, 0x3, 0x7, 0x9}, {0xb000, 0x2d}, {0x10000, 0x7fff}, 0x80000031, 0x0, 0x6000, 0x42024, 0xb, 0x1, 0x3000, [0x6840000000000002, 0x3, 0x10de, 0xff]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000001b00)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) 1.784647033s ago: executing program 0 (id=403): sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x7fd) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, &(0x7f0000000280)={'\x00', 0xf, 0x66a, 0x9, 0x0, 0x1, 0x80a4000, 0xd000, '\x00', 0xd5ad}) 1.52592522s ago: executing program 2 (id=404): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c00", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="500001"], 0x6) 331.16658ms ago: executing program 3 (id=405): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000000)=0x5) ppoll(&(0x7f0000000040)=[{r0, 0x200}], 0x1, 0x0, 0x0, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f00000000c0)={0x40, 0x802, 0x28964710, 0xfffffff7, 0x8, "1d4ab803374503053b00", 0x7fffffff, 0x10001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@RTM_GETMDB={0x18, 0x56, 0x13d, 0x70bd2a, 0x25dfdbfd}, 0x18}}, 0x24048000) 279.806616ms ago: executing program 0 (id=406): ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa8", 0x7) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x1, 0x3e, 0x2000000, 0x0, 0x2004cc, 0x0, 0xa1b, 0x8, 0x5, 0x0, 0x3, 0x2, 0x1], 0x10000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x70000, 0x30000, 0x0, 0x2, 0x2, 0x7, 0x3, 0x7, 0x0, 0x8, 0x9, 0x1}, {0xe000, 0x10000, 0xc, 0x0, 0x22, 0x0, 0xfd, 0x0, 0x7, 0xff}, {0xb000, 0x8080000, 0xc, 0x3, 0x27, 0xc4, 0x0, 0x0, 0x8, 0xfd, 0x1, 0x3}, {0x4000, 0xffffffff, 0x18592cbc7c573fc6, 0x9, 0x1, 0x9, 0x9, 0x7, 0x8, 0xf, 0x8}, {0x200000, 0xeeee8000, 0xb, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3f, 0x6}, {0xb000, 0x0, 0x0, 0x76, 0x2, 0x1, 0x2, 0x80, 0x0, 0xff, 0x6, 0x1}, {0xa000, 0xeeee0000, 0x3, 0x4, 0xc, 0x0, 0xa1, 0x2, 0x0, 0x0, 0x4}, {0x2, 0x50000, 0xc, 0x3, 0x9, 0x7, 0x9, 0x40, 0x26, 0x0, 0x0, 0xf}, {0x80a0000, 0x88cc}, {0x60000, 0xfffc}, 0x10001, 0x0, 0x0, 0x110, 0xe, 0xf801, 0xb000, [0x80000004, 0x0, 0x10000, 0xfffffffffffdffff]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 206.164114ms ago: executing program 1 (id=407): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f024}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r4, 0xc048aec8, &(0x7f0000000240)={0x5, 0x0, @ioapic={0xf000, 0x1, 0x7, 0x8001, 0x0, [{0x0, 0x7f, 0xa, '\x00', 0x4}, {0x5, 0x1, 0xfa, '\x00', 0x2}, {0x75, 0x4, 0x3, '\x00', 0x76}, {0xc, 0x1, 0x4, '\x00', 0x96}, {0x1, 0x4, 0x4, '\x00', 0x77}, {0x4, 0x3, 0x6, '\x00', 0xf}, {0x2, 0x9, 0xe1, '\x00', 0x4}, {0x3, 0x3, 0xff, '\x00', 0x38}, {0xa, 0x6, 0x40, '\x00', 0x4}, {0xf, 0xf, 0xb, '\x00', 0xfb}, {0xff, 0x3, 0xa1, '\x00', 0x52}, {0x4, 0x1, 0xd, '\x00', 0x5}, {0x1, 0x0, 0x0, '\x00', 0x2}, {0x14, 0x2, 0x7f, '\x00', 0x8}, {0x76, 0x8, 0x7}, {0x40, 0xb, 0xa, '\x00', 0xb2}, {0x5, 0x7e, 0x70, '\x00', 0x9}, {0x6, 0xff, 0x7, '\x00', 0x9}, {0x8, 0x7, 0xa, '\x00', 0x5}, {0x1, 0x9, 0x80, '\x00', 0x4a}, {0x6, 0x4, 0xff, '\x00', 0x6a}, {0x1, 0x7f, 0x8, '\x00', 0x80}, {0x42, 0x56, 0x4, '\x00', 0x6}, {0x7d, 0x5, 0x4, '\x00', 0x58}]}}) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000180)={0x2, @vbi={0x9, 0xdc, 0x2, 0x32314142, [0x1, 0x1], [0x8, 0x5], 0x1}}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r5, 0x84, 0x14, &(0x7f0000000040)="020000000980ffff", 0x8) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000580)={[0x0, 0x2, 0x6079, 0x7, 0x8000000000000001, 0x0, 0x9b55, 0x0, 0x9, 0x9, 0x9, 0x2, 0xffffffff, 0x72, 0x9e7, 0x8000000000000001], 0xffffffff, 0x100000}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400005}, 0x94) 133.224211ms ago: executing program 4 (id=408): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close_range(r2, 0xffffffffffffffff, 0x3f00000000000000) 0s ago: executing program 2 (id=409): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r1, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f00000004c0)={r2, 0x0, 0x4, 0x0, 0x2, [], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000280)={r5, 0x0, 0x8001, 0x0, 0x0, [], [0x0, 0x0, 0x1, 0x2], [0x0, 0x0, 0x8, 0x8000], [0x0, 0x3, 0x400000006]}) r6 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r7, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f00000004c0)={r8, 0x0, 0x4, 0x0, 0x2, [], [0x0, 0x0, 0x0, 0x10000], [0x0, 0x0, 0xfffffffc], [0x1]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.142' (ED25519) to the list of known hosts. [ 91.316091][ T5590] cgroup: Unknown subsys name 'net' [ 91.539115][ T5590] cgroup: Unknown subsys name 'cpuset' [ 91.612076][ T5590] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.933010][ T1252] cfg80211: failed to load regulatory.db [ 93.605578][ T5590] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.698712][ T5609] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.710927][ T5611] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.728887][ T5611] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.737022][ T5611] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.751612][ T5611] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.755569][ T5611] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.755636][ T5609] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.757721][ T5611] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.766490][ T59] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.779568][ T59] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.832373][ T59] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.854723][ T5611] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.857999][ T5611] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.885504][ T5609] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.927417][ T5614] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.943406][ T4919] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.963346][ T4919] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.986278][ T4919] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.987626][ T4919] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.988450][ T4919] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 98.115350][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 98.142328][ T59] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 98.143546][ T59] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 98.149415][ T59] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 98.155099][ T59] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 99.932827][ T5614] Bluetooth: hci0: command tx timeout [ 100.081490][ T5614] Bluetooth: hci1: command tx timeout [ 100.092499][ T5614] Bluetooth: hci3: command tx timeout [ 100.161495][ T5614] Bluetooth: hci2: command tx timeout [ 100.251408][ T5614] Bluetooth: hci4: command tx timeout [ 100.748733][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.749919][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.750072][ T5606] bridge_slave_0: entered allmulticast mode [ 100.762131][ T5606] bridge_slave_0: entered promiscuous mode [ 100.825875][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.825962][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.826113][ T5606] bridge_slave_1: entered allmulticast mode [ 100.828046][ T5606] bridge_slave_1: entered promiscuous mode [ 100.969372][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.969584][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.969764][ T5607] bridge_slave_0: entered allmulticast mode [ 100.972107][ T5607] bridge_slave_0: entered promiscuous mode [ 101.022648][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.023199][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.023350][ T5616] bridge_slave_0: entered allmulticast mode [ 101.025543][ T5616] bridge_slave_0: entered promiscuous mode [ 101.039160][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.039888][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.040116][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.040603][ T5607] bridge_slave_1: entered allmulticast mode [ 101.056353][ T5607] bridge_slave_1: entered promiscuous mode [ 101.117608][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.117722][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.117855][ T5616] bridge_slave_1: entered allmulticast mode [ 101.119661][ T5616] bridge_slave_1: entered promiscuous mode [ 101.134976][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.176196][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.176337][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.176767][ T5605] bridge_slave_0: entered allmulticast mode [ 101.178681][ T5605] bridge_slave_0: entered promiscuous mode [ 101.273527][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.273668][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.273840][ T5605] bridge_slave_1: entered allmulticast mode [ 101.276049][ T5605] bridge_slave_1: entered promiscuous mode [ 101.278238][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.278375][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.278505][ T5608] bridge_slave_0: entered allmulticast mode [ 101.280442][ T5608] bridge_slave_0: entered promiscuous mode [ 101.362434][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.385890][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.386035][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.386160][ T5608] bridge_slave_1: entered allmulticast mode [ 101.388119][ T5608] bridge_slave_1: entered promiscuous mode [ 101.400707][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.412418][ T5606] team0: Port device team_slave_0 added [ 101.436839][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.477857][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.480005][ T5606] team0: Port device team_slave_1 added [ 101.514530][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.605465][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.610576][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.658355][ T5607] team0: Port device team_slave_0 added [ 101.692623][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.695533][ T5616] team0: Port device team_slave_0 added [ 101.696813][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.696829][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.697368][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.765417][ T5607] team0: Port device team_slave_1 added [ 101.800588][ T5616] team0: Port device team_slave_1 added [ 101.808357][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.808370][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.808391][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.861275][ T5605] team0: Port device team_slave_0 added [ 101.926501][ T5605] team0: Port device team_slave_1 added [ 101.928554][ T5608] team0: Port device team_slave_0 added [ 101.956121][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.956137][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.956156][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.001458][ T5614] Bluetooth: hci0: command tx timeout [ 102.016505][ T5608] team0: Port device team_slave_1 added [ 102.017272][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.017283][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.017303][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.019578][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.019589][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.019609][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.125297][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.125310][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.125330][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.171538][ T5614] Bluetooth: hci3: command tx timeout [ 102.171571][ T5614] Bluetooth: hci1: command tx timeout [ 102.242399][ T59] Bluetooth: hci2: command tx timeout [ 102.321510][ T59] Bluetooth: hci4: command tx timeout [ 102.594632][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.594645][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.594665][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.686301][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.686315][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.686335][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.687386][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.687397][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.687416][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.724248][ T5606] hsr_slave_0: entered promiscuous mode [ 102.748969][ T5606] hsr_slave_1: entered promiscuous mode [ 102.802551][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.802565][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.802585][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.957641][ T5607] hsr_slave_0: entered promiscuous mode [ 102.958643][ T5607] hsr_slave_1: entered promiscuous mode [ 102.959451][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 102.959545][ T5607] Cannot create hsr debugfs directory [ 102.985728][ T5616] hsr_slave_0: entered promiscuous mode [ 102.986859][ T5616] hsr_slave_1: entered promiscuous mode [ 102.987797][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 102.987814][ T5616] Cannot create hsr debugfs directory [ 103.069511][ T5605] hsr_slave_0: entered promiscuous mode [ 103.070546][ T5605] hsr_slave_1: entered promiscuous mode [ 103.071259][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 103.071277][ T5605] Cannot create hsr debugfs directory [ 103.143152][ T5608] hsr_slave_0: entered promiscuous mode [ 103.146532][ T5608] hsr_slave_1: entered promiscuous mode [ 103.147214][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 103.147232][ T5608] Cannot create hsr debugfs directory [ 104.092753][ T59] Bluetooth: hci0: command tx timeout [ 104.123539][ T5606] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 104.175893][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.184228][ T5606] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 104.227638][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.242036][ T5614] Bluetooth: hci3: command tx timeout [ 104.242394][ T59] Bluetooth: hci1: command tx timeout [ 104.242585][ T5606] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 104.296148][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.322404][ T59] Bluetooth: hci2: command tx timeout [ 104.329293][ T5606] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 104.365975][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.401621][ T59] Bluetooth: hci4: command tx timeout [ 104.508104][ T5616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.528095][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.545349][ T5616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.586913][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.601015][ T5616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.646773][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.660539][ T5616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.717896][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.899035][ T5605] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.956448][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.978683][ T5605] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 105.017269][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.021402][ T5605] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 105.067310][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.104343][ T5605] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.147718][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.328669][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.376900][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.393939][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.436700][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.454864][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.494914][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.527317][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.557631][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.596588][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.756512][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.796874][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.812063][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.835075][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.837698][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.840817][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.899471][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.915746][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.957525][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.007353][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.007575][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.065989][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.068340][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.088432][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.161445][ T59] Bluetooth: hci0: command tx timeout [ 106.261064][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.306882][ T1116] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.307049][ T1116] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.332591][ T5614] Bluetooth: hci3: command tx timeout [ 106.332652][ T59] Bluetooth: hci1: command tx timeout [ 106.337582][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.397352][ T1116] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.397507][ T1116] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.401495][ T59] Bluetooth: hci2: command tx timeout [ 106.481505][ T59] Bluetooth: hci4: command tx timeout [ 106.508289][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.566053][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.602028][ T3402] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.602171][ T3402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.680109][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.680256][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.787256][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.880036][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.896181][ T3402] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.896341][ T3402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.972735][ T1116] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.972880][ T1116] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.094166][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.198891][ T3390] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.206031][ T3390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.296662][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.296797][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.617461][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.539363][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.995714][ T5616] veth0_vlan: entered promiscuous mode [ 109.016071][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.124902][ T5616] veth1_vlan: entered promiscuous mode [ 109.230131][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.267476][ T5606] veth0_vlan: entered promiscuous mode [ 109.286254][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.348574][ T5606] veth1_vlan: entered promiscuous mode [ 109.406453][ T5605] veth0_vlan: entered promiscuous mode [ 109.413188][ T5616] veth0_macvtap: entered promiscuous mode [ 109.457441][ T5616] veth1_macvtap: entered promiscuous mode [ 109.487275][ T5605] veth1_vlan: entered promiscuous mode [ 109.559748][ T5607] veth0_vlan: entered promiscuous mode [ 109.590258][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.593456][ T5606] veth0_macvtap: entered promiscuous mode [ 109.627958][ T5608] veth0_vlan: entered promiscuous mode [ 109.630837][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.633024][ T5607] veth1_vlan: entered promiscuous mode [ 109.650094][ T5606] veth1_macvtap: entered promiscuous mode [ 109.699336][ T3390] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.721084][ T5608] veth1_vlan: entered promiscuous mode [ 109.731072][ T67] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.746695][ T67] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.767775][ T67] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.768488][ T5605] veth0_macvtap: entered promiscuous mode [ 109.800757][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.880296][ T5605] veth1_macvtap: entered promiscuous mode [ 109.902348][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.035051][ T67] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.074075][ T67] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.125504][ T5607] veth0_macvtap: entered promiscuous mode [ 110.150572][ T67] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.212505][ T67] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.217681][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.313152][ T5607] veth1_macvtap: entered promiscuous mode [ 110.361176][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.385350][ T5608] veth0_macvtap: entered promiscuous mode [ 110.520484][ T5608] veth1_macvtap: entered promiscuous mode [ 110.521270][ T3402] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.521288][ T3402] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.543747][ T3390] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.665616][ T3390] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.738996][ T3390] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.770823][ T3390] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.784368][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.884260][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.945291][ T3402] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.945311][ T3402] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.019003][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.144444][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.147988][ T3366] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.148009][ T3366] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.243336][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.257354][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.273455][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.333123][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.421191][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.525626][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.566666][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.640114][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.729200][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.729221][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.651052][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.651074][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.073988][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.074011][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.199847][ T1116] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.199861][ T1116] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.315514][ T147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.315532][ T147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.894267][ T3366] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.894288][ T3366] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.186400][ T147] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.186420][ T147] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.061858][ T1831] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 116.328921][ T1831] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 116.328954][ T1831] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.476806][ T1831] usb 4-1: config 0 descriptor?? [ 116.534895][ T1831] cp210x 4-1:0.0: cp210x converter detected [ 116.740567][ T1831] usb 4-1: cp210x converter now attached to ttyUSB0 [ 116.982673][ T1831] usb 4-1: USB disconnect, device number 2 [ 117.053800][ T1831] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 117.055735][ T1831] cp210x 4-1:0.0: device disconnected [ 117.759369][ T5836] netlink: 100 bytes leftover after parsing attributes in process `syz.3.17'. [ 119.845651][ T59] Bluetooth: hci3: command 0x0406 tx timeout [ 126.950861][ T5854] Illegal XDP return value 4294967294 on prog (id 7) dev syz_tun, expect packet loss! [ 127.137900][ T5862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.24'. [ 127.360832][ T5868] netlink: 100 bytes leftover after parsing attributes in process `syz.2.27'. [ 127.608968][ T5764] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 127.966637][ T5764] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 127.966667][ T5764] usb 4-1: can't read configurations, error -61 [ 128.285353][ T5764] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 128.514505][ T5764] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 128.514544][ T5764] usb 4-1: can't read configurations, error -61 [ 128.556235][ T5764] usb usb4-port1: attempt power cycle [ 128.633857][ T5882] ======================================================= [ 128.633857][ T5882] WARNING: The mand mount option has been deprecated and [ 128.633857][ T5882] and is ignored by this kernel. Remove the mand [ 128.633857][ T5882] option from the mount to silence this warning. [ 128.633857][ T5882] ======================================================= [ 128.976577][ T5764] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 129.004223][ T5764] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 129.004262][ T5764] usb 4-1: can't read configurations, error -61 [ 129.083114][ T5892] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 129.141571][ T5764] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 129.168199][ T5764] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 129.168239][ T5764] usb 4-1: can't read configurations, error -61 [ 129.168661][ T5764] usb usb4-port1: unable to enumerate USB device [ 129.442811][ T5614] Bluetooth: hci4: command 0x0406 tx timeout [ 129.651922][ T5907] netlink: 8 bytes leftover after parsing attributes in process `syz.0.39'. [ 130.089656][ T5910] fuse: Bad value for 'fd' [ 131.124653][ T5928] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.149372][ T5928] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.237547][ T5933] netlink: 8 bytes leftover after parsing attributes in process `syz.1.50'. [ 131.283546][ T5931] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.283701][ T5931] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.284081][ T5931] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.284244][ T5931] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.353350][ T5931] bridge0: entered promiscuous mode [ 131.353382][ T5931] bridge0: entered allmulticast mode [ 131.550926][ T5939] lo speed is unknown, defaulting to 1000 [ 131.551002][ T5939] lo speed is unknown, defaulting to 1000 [ 131.554538][ T5939] lo speed is unknown, defaulting to 1000 [ 131.556083][ T5939] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 131.556108][ T5939] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 131.556142][ T5939] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 131.559318][ T5939] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 131.567661][ T5939] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 131.695941][ T5939] lo speed is unknown, defaulting to 1000 [ 131.697851][ T5939] lo speed is unknown, defaulting to 1000 [ 131.699766][ T5939] lo speed is unknown, defaulting to 1000 [ 131.702355][ T5939] lo speed is unknown, defaulting to 1000 [ 131.704276][ T5939] lo speed is unknown, defaulting to 1000 [ 132.147940][ T5951] netlink: 24 bytes leftover after parsing attributes in process `syz.1.55'. [ 132.284258][ T5951] netlink: 24 bytes leftover after parsing attributes in process `syz.1.55'. [ 133.253249][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.253346][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.691539][ T5592] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 133.842754][ T5592] usb 5-1: Using ep0 maxpacket: 16 [ 133.844606][ T5592] usb 5-1: config 1 has an invalid descriptor of length 240, skipping remainder of the config [ 133.844630][ T5592] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 133.844669][ T5592] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 133.848359][ T5592] usb 5-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 133.848388][ T5592] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 133.848410][ T5592] usb 5-1: Product: syz [ 133.848425][ T5592] usb 5-1: Manufacturer: syz [ 133.848440][ T5592] usb 5-1: SerialNumber: syz [ 135.119293][ T5971] syz.2.62 (5971) used greatest stack depth: 18440 bytes left [ 135.178041][ T5969] fuse: Bad value for 'fd' [ 135.655806][ T5592] usb 5-1: 0:1 : does not exist [ 135.655909][ T5592] usb 5-1: BAAD HEADPHONE p_chmask mismatch [ 135.979585][ T1831] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 136.819830][ T5592] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 136.837578][ T1831] usb 1-1: config 0 has an invalid interface number: 255 but max is 0 [ 136.837607][ T1831] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.837626][ T1831] usb 1-1: config 0 has no interface number 0 [ 136.837657][ T1831] usb 1-1: too many endpoints for config 0 interface 255 altsetting 123: 169, using maximum allowed: 30 [ 136.837698][ T1831] usb 1-1: config 0 interface 255 altsetting 123 has 0 endpoint descriptors, different from the interface descriptor's value: 169 [ 136.837726][ T1831] usb 1-1: config 0 interface 255 has no altsetting 0 [ 136.903915][ T1831] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 136.903945][ T1831] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 136.903966][ T1831] usb 1-1: Product: syz [ 136.903980][ T1831] usb 1-1: Manufacturer: syz [ 136.903994][ T1831] usb 1-1: SerialNumber: syz [ 136.953942][ T1831] usb 1-1: config 0 descriptor?? [ 137.096077][ T5592] usb 5-1: USB disconnect, device number 2 [ 137.284875][ T59] Bluetooth: hci4: unexpected event 0x03 length: 1 < 11 [ 137.350694][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 137.532543][ T1831] usb 1-1: USB disconnect, device number 2 [ 139.034596][ T6001] fuse: Invalid rootmode [ 139.191562][ T59] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 139.191616][ T59] CPU: 1 UID: 0 PID: 59 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 139.191643][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 139.191657][ T59] Workqueue: hci4 hci_rx_work [ 139.191714][ T59] Call Trace: [ 139.191724][ T59] [ 139.191733][ T59] dump_stack_lvl+0xe8/0x150 [ 139.191773][ T59] sysfs_create_dir_ns+0x271/0x2a0 [ 139.191810][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 139.191837][ T59] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 139.191876][ T59] ? rt_spin_unlock+0x160/0x200 [ 139.191905][ T59] kobject_add_internal+0x631/0xd10 [ 139.191954][ T59] kobject_add+0x163/0x240 [ 139.191995][ T59] ? __pfx_kobject_add+0x10/0x10 [ 139.192038][ T59] ? get_device_parent+0x370/0x3a0 [ 139.192070][ T59] device_add+0x408/0xbb0 [ 139.192101][ T59] hci_conn_add_sysfs+0xd5/0x210 [ 139.192134][ T59] le_conn_complete_evt+0x10e6/0x16b0 [ 139.192168][ T59] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 139.192191][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 139.192222][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 139.192262][ T59] ? skb_pull_data+0xfb/0x200 [ 139.192302][ T59] hci_le_conn_complete_evt+0x187/0x470 [ 139.192346][ T59] hci_event_packet+0x659/0xef0 [ 139.192383][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 139.192405][ T59] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 139.192436][ T59] ? __pfx_hci_event_packet+0x10/0x10 [ 139.192491][ T59] ? rt_spin_unlock+0x14f/0x200 [ 139.192526][ T59] ? hci_send_to_monitor+0xe2/0x590 [ 139.192554][ T59] hci_rx_work+0x3ee/0x1040 [ 139.192590][ T59] ? process_scheduled_works+0xa70/0x1860 [ 139.192618][ T59] process_scheduled_works+0xb5d/0x1860 [ 139.192679][ T59] ? __pfx_process_scheduled_works+0x10/0x10 [ 139.192712][ T59] ? assign_work+0x3d5/0x5e0 [ 139.192750][ T59] worker_thread+0xa53/0xfc0 [ 139.192807][ T59] kthread+0x388/0x470 [ 139.192837][ T59] ? __pfx_worker_thread+0x10/0x10 [ 139.192860][ T59] ? __pfx_kthread+0x10/0x10 [ 139.192893][ T59] ret_from_fork+0x514/0xb70 [ 139.192922][ T59] ? __pfx_ret_from_fork+0x10/0x10 [ 139.192948][ T59] ? __switch_to+0xc79/0x1410 [ 139.192985][ T59] ? __pfx_kthread+0x10/0x10 [ 139.193016][ T59] ret_from_fork_asm+0x1a/0x30 [ 139.193062][ T59] [ 139.195101][ T59] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 139.195147][ T59] Bluetooth: hci4: failed to register connection device [ 139.368581][ T5845] udevd[5845]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.255/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 140.016894][ T5735] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 141.030784][ T5735] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 141.030843][ T5735] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 141.030870][ T5735] usb 4-1: config 0 interface 0 has no altsetting 0 [ 141.035175][ T5735] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 141.035205][ T5735] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 141.035227][ T5735] usb 4-1: Product: syz [ 141.035243][ T5735] usb 4-1: Manufacturer: syz [ 141.035258][ T5735] usb 4-1: SerialNumber: syz [ 141.106652][ T5735] usb 4-1: config 0 descriptor?? [ 141.167084][ T5735] hub 4-1:0.0: bad descriptor, ignoring hub [ 141.167126][ T5735] hub 4-1:0.0: probe with driver hub failed with error -5 [ 141.210763][ T5735] usb 4-1: selecting invalid altsetting 0 [ 141.442811][ T5735] usb 4-1: USB disconnect, device number 7 [ 141.568569][ T6033] udevd[6033]: setting owner of /dev/snd/controlC3 to uid=0, gid=29 failed: No such file or directory [ 141.742518][ T1831] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 141.908564][ T1831] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 141.908594][ T1831] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 141.908613][ T1831] usb 2-1: config 0 has no interface number 0 [ 141.908646][ T1831] usb 2-1: too many endpoints for config 0 interface 255 altsetting 123: 169, using maximum allowed: 30 [ 141.908685][ T1831] usb 2-1: config 0 interface 255 altsetting 123 has 0 endpoint descriptors, different from the interface descriptor's value: 169 [ 141.908714][ T1831] usb 2-1: config 0 interface 255 has no altsetting 0 [ 141.996116][ T1831] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 141.996139][ T1831] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 141.996154][ T1831] usb 2-1: Product: syz [ 141.996164][ T1831] usb 2-1: Manufacturer: syz [ 141.996175][ T1831] usb 2-1: SerialNumber: syz [ 142.104484][ T1831] usb 2-1: config 0 descriptor?? [ 142.345381][ T1252] usb 2-1: USB disconnect, device number 2 [ 142.417616][ T5735] usb 4-1: new low-speed USB device number 8 using dummy_hcd [ 142.568584][ T5735] usb 4-1: Invalid ep0 maxpacket: 64 [ 142.569805][ T5860] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 142.730213][ T5735] usb 4-1: new low-speed USB device number 9 using dummy_hcd [ 142.730590][ T5860] usb 5-1: Using ep0 maxpacket: 8 [ 142.733297][ T5860] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 142.733329][ T5860] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 142.733369][ T5860] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 142.733395][ T5860] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.799691][ T5860] usb 5-1: config 0 descriptor?? [ 143.087646][ T5860] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 143.240424][ T6040] iowarrior 5-1:0.0: Error -90 while submitting URB [ 143.246721][ T1831] usb 5-1: USB disconnect, device number 3 [ 143.351062][ T6049] loop5: detected capacity change from 0 to 7 [ 143.410763][ T6049] Dev loop5: unable to read RDB block 7 [ 143.410809][ T6049] loop5: unable to read partition table [ 143.411160][ T6049] loop5: partition table beyond EOD, truncated [ 143.411180][ T6049] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 145.447268][ T5614] Bluetooth: hci4: command 0x0406 tx timeout [ 146.346869][ T6072] syz.2.95 uses obsolete (PF_INET,SOCK_PACKET) [ 147.404696][ T6093] loop5: detected capacity change from 0 to 7 [ 147.432385][ T6093] Dev loop5: unable to read RDB block 7 [ 147.432452][ T6093] loop5: unable to read partition table [ 147.432629][ T6093] loop5: partition table beyond EOD, truncated [ 147.432685][ T6093] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 147.587560][ T6096] capability: warning: `syz.1.105' uses deprecated v2 capabilities in a way that may be insecure [ 148.084793][ T5592] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 148.128015][ T1831] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 149.068129][ T5592] usb 5-1: config index 0 descriptor too short (expected 39, got 27) [ 149.068182][ T5592] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 149.068204][ T5592] usb 5-1: config 0 interface 0 has no altsetting 0 [ 149.074195][ T5592] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 149.074227][ T5592] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 149.074248][ T5592] usb 5-1: Product: syz [ 149.074263][ T5592] usb 5-1: Manufacturer: syz [ 149.074278][ T5592] usb 5-1: SerialNumber: syz [ 149.194305][ T5592] usb 5-1: config 0 descriptor?? [ 149.229357][ T1831] usb 1-1: Using ep0 maxpacket: 16 [ 149.235797][ T1831] usb 1-1: unable to get BOS descriptor or descriptor too short [ 149.247650][ T1831] usb 1-1: config 1 descriptor has 1 excess byte, ignoring [ 149.247710][ T1831] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 16 [ 149.272574][ T1831] usb 1-1: New USB device found, idVendor=0499, idProduct=105c, bcdDevice= 0.40 [ 149.272604][ T1831] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.272626][ T1831] usb 1-1: Product: syz [ 149.272641][ T1831] usb 1-1: Manufacturer: syz [ 149.272655][ T1831] usb 1-1: SerialNumber: syz [ 149.321862][ T5592] hub 5-1:0.0: bad descriptor, ignoring hub [ 149.321896][ T5592] hub 5-1:0.0: probe with driver hub failed with error -5 [ 149.426375][ T5592] usb 5-1: selecting invalid altsetting 0 [ 149.489806][ T6103] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 150.037662][ T1831] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 150.452329][ T1831] usb 1-1: USB disconnect, device number 3 [ 150.896497][ T5592] usb 5-1: USB disconnect, device number 4 [ 151.328870][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 151.576725][ T5943] udevd[5943]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 151.874546][ T6132] input: syz0 as /devices/virtual/input/input6 [ 152.635417][ T6151] kvm: emulating exchange as write [ 152.961985][ T5735] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 153.165793][ T5735] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 153.165854][ T5735] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 153.165879][ T5735] usb 4-1: config 0 interface 0 has no altsetting 0 [ 153.168646][ T5735] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 153.168676][ T5735] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 153.168697][ T5735] usb 4-1: Product: syz [ 153.168712][ T5735] usb 4-1: Manufacturer: syz [ 153.168728][ T5735] usb 4-1: SerialNumber: syz [ 153.264200][ T5735] usb 4-1: config 0 descriptor?? [ 153.316675][ T5735] hub 4-1:0.0: bad descriptor, ignoring hub [ 153.316715][ T5735] hub 4-1:0.0: probe with driver hub failed with error -5 [ 153.349322][ T5735] usb 4-1: selecting invalid altsetting 0 [ 153.792678][ T5735] usb 4-1: USB disconnect, device number 10 [ 154.546524][ T6171] cgroup: fork rejected by pids controller in /syz3 [ 157.254019][ T6203] netlink: 16 bytes leftover after parsing attributes in process `syz.4.143'. [ 158.479580][ T6221] binder: BINDER_SET_CONTEXT_MGR already set [ 158.479594][ T6221] binder: 6219:6221 ioctl 4018620d 200000004a80 returned -16 [ 158.694663][ T3402] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 158.805218][ T5614] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 158.852866][ T5614] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 158.867264][ T5614] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 158.886984][ T5614] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 158.888001][ T5614] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 159.008204][ T6210] lo speed is unknown, defaulting to 1000 [ 159.397093][ T3402] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.975973][ T6233] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 160.156886][ T3402] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.899358][ T3402] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.988924][ T5860] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 161.093779][ T6223] lo speed is unknown, defaulting to 1000 [ 161.112693][ T59] Bluetooth: hci3: command tx timeout [ 161.170527][ T5860] usb 1-1: Using ep0 maxpacket: 8 [ 161.186268][ T5860] usb 1-1: unable to get BOS descriptor or descriptor too short [ 161.203518][ T5860] usb 1-1: config 255 has an invalid interface number: 56 but max is 0 [ 161.203546][ T5860] usb 1-1: config 255 has no interface number 0 [ 161.203580][ T5860] usb 1-1: config 255 interface 56 has no altsetting 0 [ 161.242157][ T5860] usb 1-1: New USB device found, idVendor=413c, idProduct=8181, bcdDevice=e3.ba [ 161.242188][ T5860] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.242209][ T5860] usb 1-1: Product: syz [ 161.242224][ T5860] usb 1-1: Manufacturer: syz [ 161.242239][ T5860] usb 1-1: SerialNumber: syz [ 161.385670][ T6261] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 161.655739][ T5860] usb 1-1: USB disconnect, device number 4 [ 162.974383][ T59] Bluetooth: hci0: command 0x0401 tx timeout [ 163.329542][ T59] Bluetooth: hci3: command tx timeout [ 163.819009][ T6289] Zero length message leads to an empty skb [ 164.024629][ T3402] bridge_slave_1: left allmulticast mode [ 164.057808][ T3402] bridge_slave_1: left promiscuous mode [ 164.083743][ T3402] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.335732][ T3402] bridge_slave_0: left allmulticast mode [ 164.335772][ T3402] bridge_slave_0: left promiscuous mode [ 164.389350][ T3402] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.263242][ T820] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 165.432332][ T820] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 109, changing to 7 [ 165.444915][ T820] usb 5-1: New USB device found, idVendor=08e4, idProduct=0163, bcdDevice= 0.40 [ 165.444946][ T820] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 165.444966][ T820] usb 5-1: Product: syz [ 165.444981][ T820] usb 5-1: Manufacturer: syz [ 165.444996][ T820] usb 5-1: SerialNumber: syz [ 165.551838][ T59] Bluetooth: hci3: command tx timeout [ 165.748941][ T820] usb 5-1: found format II with max.bitrate = 9, frame size=4 [ 165.748982][ T820] usb 5-1: 1:1 : invalid UAC_FORMAT_TYPE desc [ 165.777727][ T820] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 165.918347][ T820] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 166.099178][ T820] usb 5-1: USB disconnect, device number 5 [ 167.013019][ T6035] udevd[6035]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 167.104826][ T3402] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 167.188435][ T3402] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 167.232454][ T3402] bond0 (unregistering): Released all slaves [ 167.346080][ T6288] syz_tun: entered allmulticast mode [ 167.371826][ T5264] 8021q: adding VLAN 0 to HW filter on device eth1 [ 167.416158][ T6288] syz_tun: left allmulticast mode [ 167.573546][ T6317] fuse: Unknown parameter 'user_id00000000000000000000' [ 167.775133][ T59] Bluetooth: hci3: command tx timeout [ 170.487237][ T5264] 8021q: adding VLAN 0 to HW filter on device eth2 [ 170.653377][ T6223] bridge0: port 1(bridge_slave_0) entered blocking state [ 170.653896][ T6223] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.654166][ T6223] bridge_slave_0: entered allmulticast mode [ 170.657042][ T6223] bridge_slave_0: entered promiscuous mode [ 170.689487][ T6223] bridge0: port 2(bridge_slave_1) entered blocking state [ 170.689675][ T6223] bridge0: port 2(bridge_slave_1) entered disabled state [ 170.689949][ T6223] bridge_slave_1: entered allmulticast mode [ 170.737204][ T6223] bridge_slave_1: entered promiscuous mode [ 170.770499][ T6362] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 171.120549][ T6223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 171.167835][ T6223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 171.907322][ T6223] team0: Port device team_slave_0 added [ 172.036158][ T6223] team0: Port device team_slave_1 added [ 172.091614][ T5592] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 172.260278][ T5592] usb 3-1: config 0 has an invalid descriptor of length 169, skipping remainder of the config [ 172.260334][ T5592] usb 3-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 172.260361][ T5592] usb 3-1: config 0 interface 0 has no altsetting 0 [ 172.298427][ T5592] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 172.298460][ T5592] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 172.298482][ T5592] usb 3-1: Product: syz [ 172.298497][ T5592] usb 3-1: Manufacturer: syz [ 172.298512][ T5592] usb 3-1: SerialNumber: syz [ 172.365944][ T5592] usb 3-1: config 0 descriptor?? [ 172.712166][ T3402] hsr_slave_0: left promiscuous mode [ 172.762349][ T3402] hsr_slave_1: left promiscuous mode [ 172.784693][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 172.784789][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 172.831564][ T3402] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 172.831587][ T3402] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 172.940904][ T5592] snd-usb-audio 3-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 172.972380][ T5592] usb 3-1: USB disconnect, device number 2 [ 173.020529][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 173.082521][ T3402] veth1_macvtap: left promiscuous mode [ 173.082693][ T3402] veth0_macvtap: left promiscuous mode [ 173.082953][ T3402] veth1_vlan: left promiscuous mode [ 173.083186][ T3402] veth0_vlan: left promiscuous mode [ 174.400615][ T3402] team0 (unregistering): Port device team_slave_1 removed [ 174.464589][ T3402] team0 (unregistering): Port device team_slave_0 removed [ 174.842881][ T6223] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 174.842894][ T6223] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.842915][ T6223] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 174.855619][ T5264] 8021q: adding VLAN 0 to HW filter on device eth3 [ 174.941988][ T6223] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 174.942006][ T6223] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 174.942036][ T6223] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 175.488850][ T6223] hsr_slave_0: entered promiscuous mode [ 175.499675][ T6223] hsr_slave_1: entered promiscuous mode [ 175.514400][ T6223] debugfs: 'hsr0' already exists in 'hsr' [ 175.514423][ T6223] Cannot create hsr debugfs directory [ 177.039198][ T37] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 177.213894][ T37] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 177.213952][ T37] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 177.213990][ T37] usb 5-1: config 0 interface 0 has no altsetting 0 [ 177.262645][ T37] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 177.262677][ T37] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 177.262698][ T37] usb 5-1: Product: syz [ 177.262713][ T37] usb 5-1: Manufacturer: syz [ 177.262729][ T37] usb 5-1: SerialNumber: syz [ 177.316446][ T37] usb 5-1: config 0 descriptor?? [ 178.710429][ T5264] 8021q: adding VLAN 0 to HW filter on device eth4 [ 178.757168][ T37] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 178.775537][ T37] usb 5-1: USB disconnect, device number 6 [ 178.951265][ T6476] syz_tun: entered allmulticast mode [ 179.030113][ T6471] syz_tun: left allmulticast mode [ 179.051321][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 181.655097][ T6484] bridge0: entered promiscuous mode [ 181.655131][ T6484] bridge0: entered allmulticast mode [ 183.065011][ T6535] netlink: 'syz.1.230': attribute type 11 has an invalid length. [ 183.425915][ T38] audit: type=1326 audit(1779153333.614:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6541 comm="syz.2.233" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5be941ce59 code=0x0 [ 183.922110][ T6558] netlink: 24 bytes leftover after parsing attributes in process `syz.0.234'. [ 183.978591][ T6556] bridge0: entered promiscuous mode [ 183.978646][ T6556] bridge0: entered allmulticast mode [ 185.478558][ T6223] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 185.633110][ T6223] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 185.634709][ T6223] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 185.793995][ T6223] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 185.797022][ T6223] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 185.916078][ T6223] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 185.922175][ T6223] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 186.055905][ T6223] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 186.378945][ T820] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 186.553497][ T820] usb 2-1: config index 0 descriptor too short (expected 39, got 27) [ 186.553547][ T820] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 186.553569][ T820] usb 2-1: config 0 interface 0 has no altsetting 0 [ 186.595937][ T820] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 186.595967][ T820] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 186.595988][ T820] usb 2-1: Product: syz [ 186.596003][ T820] usb 2-1: Manufacturer: syz [ 186.596019][ T820] usb 2-1: SerialNumber: syz [ 186.637485][ T820] usb 2-1: config 0 descriptor?? [ 186.701970][ T820] hub 2-1:0.0: bad descriptor, ignoring hub [ 186.702014][ T820] hub 2-1:0.0: probe with driver hub failed with error -5 [ 186.735346][ T820] usb 2-1: selecting invalid altsetting 0 [ 186.820339][ T6223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 187.019292][ T6223] 8021q: adding VLAN 0 to HW filter on device team0 [ 187.108160][ T147] bridge0: port 1(bridge_slave_0) entered blocking state [ 187.108815][ T147] bridge0: port 1(bridge_slave_0) entered forwarding state [ 187.218459][ T3366] bridge0: port 2(bridge_slave_1) entered blocking state [ 187.218717][ T3366] bridge0: port 2(bridge_slave_1) entered forwarding state [ 187.690517][ T820] usb 2-1: USB disconnect, device number 3 [ 188.546402][ T5943] udevd[5943]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 189.001547][ T820] usb 2-1: new low-speed USB device number 4 using dummy_hcd [ 189.171962][ T820] usb 2-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 189.171999][ T820] usb 2-1: config 1 interface 0 has no altsetting 0 [ 189.600273][ T820] usb 2-1: New USB device found, idVendor=11ff, idProduct=3331, bcdDevice= 0.40 [ 189.600309][ T820] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 189.641231][ T820] usb 2-1: can't set config #1, error -71 [ 189.656180][ T820] usb 2-1: USB disconnect, device number 4 [ 189.820831][ T6223] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 190.995397][ T6223] veth0_vlan: entered promiscuous mode [ 191.042311][ T6223] veth1_vlan: entered promiscuous mode [ 191.165591][ T6223] veth0_macvtap: entered promiscuous mode [ 191.178548][ T1252] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 191.187142][ T6223] veth1_macvtap: entered promiscuous mode [ 191.248152][ T6223] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 191.272612][ T6223] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 191.337168][ T1252] usb 2-1: Using ep0 maxpacket: 32 [ 191.339286][ T1252] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 191.339320][ T1252] usb 2-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 191.339347][ T1252] usb 2-1: config 0 interface 0 has no altsetting 0 [ 191.339383][ T1252] usb 2-1: New USB device found, idVendor=046d, idProduct=0a07, bcdDevice= 0.00 [ 191.339408][ T1252] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 191.511796][ T1087] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.523705][ T1087] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.546898][ T1252] usb 2-1: config 0 descriptor?? [ 191.612729][ T1087] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 191.642277][ T1087] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 192.632406][ T6711] netlink: 24 bytes leftover after parsing attributes in process `syz.0.261'. [ 192.709411][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x3 [ 192.709453][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x0 [ 192.709481][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x0 [ 192.709519][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x0 [ 192.709547][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x0 [ 192.709572][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x0 [ 192.709600][ T1252] lg-g15 0003:046D:0A07.0001: unknown main item tag 0x6 [ 193.073503][ T1252] lg-g15 0003:046D:0A07.0001: hidraw0: USB HID v1.01 Device [HID 046d:0a07] on usb-dummy_hcd.1-1/input0 [ 193.156469][ T1252] usb 2-1: USB disconnect, device number 5 [ 193.472969][ T6716] fido_id[6716]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 193.771642][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 193.771664][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.210836][ T3366] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 194.210860][ T3366] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 194.732493][ T6740] siw: device registration error -23 [ 195.080565][ T6746] process 'syz.3.148' launched './file1' with NULL argv: empty string added [ 195.400518][ T5592] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 195.861083][ T5592] usb 3-1: config index 0 descriptor too short (expected 39, got 27) [ 195.861143][ T5592] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 195.861161][ T5592] usb 3-1: config 0 interface 0 has no altsetting 0 [ 195.892690][ T5592] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 195.892720][ T5592] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 195.892742][ T5592] usb 3-1: Product: syz [ 195.892758][ T5592] usb 3-1: Manufacturer: syz [ 195.892773][ T5592] usb 3-1: SerialNumber: syz [ 195.953015][ T5592] usb 3-1: config 0 descriptor?? [ 195.978700][ T5592] hub 3-1:0.0: bad descriptor, ignoring hub [ 195.978740][ T5592] hub 3-1:0.0: probe with driver hub failed with error -5 [ 196.013045][ T5592] usb 3-1: selecting invalid altsetting 0 [ 196.303586][ T5592] usb 3-1: USB disconnect, device number 3 [ 196.559582][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 196.559659][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 197.277338][ T6768] netlink: 24 bytes leftover after parsing attributes in process `syz.1.273'. [ 197.437446][ T5592] usb 3-1: new low-speed USB device number 4 using dummy_hcd [ 197.602304][ T5592] usb 3-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 197.602340][ T5592] usb 3-1: config 1 interface 0 has no altsetting 0 [ 197.782545][ T5592] usb 3-1: New USB device found, idVendor=11ff, idProduct=3331, bcdDevice= 0.40 [ 197.782591][ T5592] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 197.819903][ T5592] usb 3-1: can't set config #1, error -71 [ 197.840060][ T5592] usb 3-1: USB disconnect, device number 4 [ 199.312854][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x495a [ 199.322711][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1016 [ 199.333755][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x1000048ad [ 199.333841][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 199.360072][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x61c6 [ 199.363907][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x2a74 [ 199.363969][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 199.366170][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x85b [ 199.366230][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 199.441036][ T6800] kvm_intel: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x3187 [ 199.442493][ T6800] kvm: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x3187 [ 199.445866][ T6800] kvm_intel: kvm [6799]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x5149 [ 200.474979][ T6817] kvm_intel: kvm [6816]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x3187 [ 200.478405][ T6817] kvm_intel: kvm [6816]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x5149 [ 201.174810][ T6821] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 201.418415][ T6827] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 204.372650][ T6868] kvm_intel: kvm [6867]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x3187 [ 204.375459][ T6868] kvm_intel: kvm [6867]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x5149 [ 205.788018][ T37] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 205.972645][ T37] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 205.972696][ T37] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 205.972720][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.020027][ T37] usb 2-1: config 0 descriptor?? [ 206.064515][ T37] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 207.086464][ T6921] kvm_pr_unimpl_wrmsr: 35 callbacks suppressed [ 207.086488][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x495a [ 207.090754][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1016 [ 207.122745][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x1000048ad [ 207.122832][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 207.132007][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x61c6 [ 207.150188][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x2a74 [ 207.150354][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 207.155115][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x85b [ 207.155278][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 207.170890][ T6921] kvm_intel: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x3187 [ 207.173412][ T6921] kvm: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x186) = 0x3187 [ 207.176960][ T6921] kvm_intel: kvm [6920]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x1d9) = 0x5149 [ 208.815522][ T5592] usb 2-1: USB disconnect, device number 6 [ 209.065589][ T59] Bluetooth: hci4: Ignoring HCI_Connection_Complete for existing connection [ 209.671077][ T820] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 209.848142][ T820] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 209.848178][ T820] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 209.848201][ T820] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 209.848246][ T820] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 209.848271][ T820] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 209.915757][ T820] usb 3-1: config 0 descriptor?? [ 210.408817][ T820] plantronics 0003:047F:FFFF.0002: reserved main item tag 0xd [ 210.408932][ T820] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 210.408961][ T820] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0 [ 210.662562][ T820] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 210.691127][ T820] usb 3-1: USB disconnect, device number 5 [ 210.862524][ T6979] fido_id[6979]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 211.433321][ T5592] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 211.595466][ T5592] usb 4-1: Using ep0 maxpacket: 8 [ 211.597926][ T5592] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 211.597957][ T5592] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 211.597995][ T5592] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 211.598012][ T5592] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 211.606000][ T5592] usb 4-1: config 0 descriptor?? [ 211.984295][ T5592] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 212.108705][ T6990] iowarrior 4-1:0.0: Error -90 while submitting URB [ 212.127595][ T820] usb 4-1: USB disconnect, device number 11 [ 214.323691][ T37] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 214.493809][ T37] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 214.493845][ T37] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 214.493868][ T37] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 214.493912][ T37] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 214.493936][ T37] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.588619][ T37] usb 1-1: config 0 descriptor?? [ 215.050828][ T37] plantronics 0003:047F:FFFF.0003: reserved main item tag 0xd [ 215.050868][ T37] plantronics 0003:047F:FFFF.0003: unknown main item tag 0x0 [ 215.149821][ T37] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 215.269192][ T5592] usb 1-1: USB disconnect, device number 5 [ 215.369563][ T7051] fido_id[7051]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 215.859866][ T5737] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 216.021969][ T5737] usb 4-1: Using ep0 maxpacket: 8 [ 216.025439][ T5737] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 216.025463][ T5737] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 216.025490][ T5737] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 216.025507][ T5737] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.044675][ T5737] usb 4-1: config 0 descriptor?? [ 216.311866][ T5737] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 216.525036][ T7054] iowarrior 4-1:0.0: Error -90 while submitting URB [ 216.566469][ T5610] usb 4-1: USB disconnect, device number 12 [ 219.476401][ T5592] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 219.640862][ T5592] usb 1-1: Using ep0 maxpacket: 8 [ 219.667721][ T5592] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 219.667757][ T5592] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 219.667794][ T5592] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 219.667811][ T5592] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.717135][ T5592] usb 1-1: config 0 descriptor?? [ 219.976718][ T5592] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 220.182256][ T7116] iowarrior 1-1:0.0: Error -90 while submitting URB [ 220.184959][ T37] usb 1-1: USB disconnect, device number 6 [ 220.943079][ T5737] lo speed is unknown, defaulting to 1000 [ 223.265392][ T7174] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 223.330761][ T59] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 223.330799][ T59] CPU: 0 UID: 0 PID: 59 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 223.330824][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 223.330839][ T59] Workqueue: hci1 hci_rx_work [ 223.330877][ T59] Call Trace: [ 223.330886][ T59] [ 223.330896][ T59] dump_stack_lvl+0xe8/0x150 [ 223.330926][ T59] sysfs_create_dir_ns+0x271/0x2a0 [ 223.330962][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 223.330990][ T59] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 223.331030][ T59] ? rt_spin_unlock+0x160/0x200 [ 223.331057][ T59] kobject_add_internal+0x631/0xd10 [ 223.331101][ T59] kobject_add+0x163/0x240 [ 223.331139][ T59] ? __pfx_kobject_add+0x10[ 223.331139][ T59] ? __pfx_kobject_add+0x10/0x10 [ 223.331180][ T59] ? get_device_parent+0x370/0x3a0 [ 223.331211][ T59] device_add+0x408/0xbb0 [ 223.331241][ T59] hci_conn_add_sysfs+0xd5/0x210 [ 223.331273][ T59] le_conn_complete_evt+0x10e6/0x16b0 [ 223.331314][ T59] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 223.331338][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 223.331369][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 223.331407][ T59] ? skb_pull_data+0xfb/0x200 [ 223.331446][ T59] hci_le_conn_complete_evt+0x187/0x470 [ 223.331490][ T59] hci_event_packet+0x659/0xef0 [ 223.331528][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 223.331550][ T59] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 223.331581][ T59] ? __pfx_hci_event_packet+0x10/0x10 [ 223.331609][ T59] ? rt_spin_unlock+0x14f/0x200 [ 223.331643][ T59] ? hci_send_to_monitor+0xe2/0x590 [ 223.331671][ T59] hci_rx_work+0x3ee/0x1040 [ 223.331708][ T59] ? process_scheduled_works+0xa70/0x1860 [ 223.331741][ T59] process_scheduled_works+0xb5d/0x1860 [ 223.331812][ T59] ? __pfx_process_scheduled_works+0x10/0x10 [ 223.331843][ T59] ? assign_work+0x3d5/0x5e0 [ 223.331875][ T59] worker_thread+0xa53/0xfc0 [ 223.331932][ T59] kthread+0x388/0x470 [ 223.331964][ T59] ? __pfx_worker_thread+0x10/0x10 [ 223.331987][ T59] ? __pfx_kthread+0x10/0x10 [ 223.332019][ T59] ret_from_fork+0x514/0xb70 [ 223.332048][ T59] ? __pfx_ret_from_fork+0x10/0x10 [ 223.332073][ T59] ? __switch_to+0xc79/0x1410 [ 223.332112][ T59] ? __pfx_kthread+0x10/0x10 [ 223.332144][ T59] ret_from_fork_asm+0x1a/0x30 [ 223.332192][ T59] [ 223.339428][ T59] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 223.339478][ T59] Bluetooth: hci1: failed to register connection device [ 223.448579][ T59] ================================================================== [ 223.448598][ T59] BUG: KASAN: slab-use-after-free in l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.448645][ T59] Read of size 8 at addr ffff88801a1867b0 by task kworker/u9:0/59 [ 223.448664][ T59] [ 223.448676][ T59] CPU: 0 UID: 0 PID: 59 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 223.448701][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 223.448716][ T59] Workqueue: hci1 hci_rx_work [ 223.448745][ T59] Call Trace: [ 223.448754][ T59] [ 223.448765][ T59] dump_stack_lvl+0xe8/0x150 [ 223.448792][ T59] print_address_description+0x55/0x1e0 [ 223.448818][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.448844][ T59] print_report+0x58/0x70 [ 223.448865][ T59] kasan_report+0x117/0x150 [ 223.448891][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.448923][ T59] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.448952][ T59] l2cap_connect_cfm+0x368/0x1560 [ 223.448981][ T59] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 223.449004][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 223.449034][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 223.449062][ T59] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 223.449091][ T59] ? mutex_lock_nested+0x152/0x1d0 [ 223.449112][ T59] ? hci_connect_cfm+0x2c/0x140 [ 223.449142][ T59] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 223.449166][ T59] hci_connect_cfm+0x95/0x140 [ 223.449200][ T59] le_conn_complete_evt+0x1134/0x16b0 [ 223.449230][ T59] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 223.449252][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 223.449280][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 223.449309][ T59] ? skb_pull_data+0xfb/0x200 [ 223.449342][ T59] hci_le_conn_complete_evt+0x187/0x470 [ 223.449376][ T59] hci_event_packet+0x659/0xef0 [ 223.449406][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 223.449427][ T59] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 223.449458][ T59] ? __pfx_hci_event_packet+0x10/0x10 [ 223.449484][ T59] ? rt_spin_unlock+0x14f/0x200 [ 223.449512][ T59] ? hci_send_to_monitor+0xe2/0x590 [ 223.449536][ T59] hci_rx_work+0x3ee/0x1040 [ 223.449566][ T59] ? process_scheduled_works+0xa70/0x1860 [ 223.449591][ T59] process_scheduled_works+0xb5d/0x1860 [ 223.449640][ T59] ? __pfx_process_scheduled_works+0x10/0x10 [ 223.449668][ T59] ? assign_work+0x3d5/0x5e0 [ 223.449693][ T59] worker_thread+0xa53/0xfc0 [ 223.449732][ T59] kthread+0x388/0x470 [ 223.449761][ T59] ? __pfx_worker_thread+0x10/0x10 [ 223.449782][ T59] ? __pfx_kthread+0x10/0x10 [ 223.449816][ T59] ret_from_fork+0x514/0xb70 [ 223.449836][ T59] ? __pfx_ret_from_fork+0x10/0x10 [ 223.449852][ T59] ? __switch_to+0xc79/0x1410 [ 223.449877][ T59] ? __pfx_kthread+0x10/0x10 [ 223.449899][ T59] ret_from_fork_asm+0x1a/0x30 [ 223.449926][ T59] [ 223.449932][ T59] [ 223.449944][ T59] Allocated by task 59: [ 223.449951][ T59] kasan_save_track+0x3e/0x80 [ 223.449966][ T59] __kasan_kmalloc+0x93/0xb0 [ 223.449980][ T59] __kmalloc_noprof+0x3e7/0x7b0 [ 223.449996][ T59] sk_prot_alloc+0xe7/0x210 [ 223.450014][ T59] sk_alloc+0x3a/0x390 [ 223.450032][ T59] bt_sock_alloc+0x3b/0x310 [ 223.450052][ T59] l2cap_sock_new_connection_cb+0xf1/0x2f0 [ 223.450069][ T59] l2cap_connect_cfm+0x368/0x1560 [ 223.450084][ T59] hci_connect_cfm+0x95/0x140 [ 223.450105][ T59] le_conn_complete_evt+0x1134/0x16b0 [ 223.450121][ T59] hci_le_conn_complete_evt+0x187/0x470 [ 223.450143][ T59] hci_event_packet+0x659/0xef0 [ 223.450160][ T59] hci_rx_work+0x3ee/0x1040 [ 223.450178][ T59] process_scheduled_works+0xb5d/0x1860 [ 223.450192][ T59] worker_thread+0xa53/0xfc0 [ 223.450207][ T59] kthread+0x388/0x470 [ 223.450225][ T59] ret_from_fork+0x514/0xb70 [ 223.450240][ T59] ret_from_fork_asm+0x1a/0x30 [ 223.450258][ T59] [ 223.450261][ T59] Freed by task 7179: [ 223.450268][ T59] kasan_save_track+0x3e/0x80 [ 223.450281][ T59] kasan_save_free_info+0x46/0x50 [ 223.450301][ T59] __kasan_slab_free+0x5c/0x80 [ 223.450315][ T59] kfree+0x1c5/0x6c0 [ 223.450327][ T59] __sk_destruct+0x74b/0x9d0 [ 223.450345][ T59] l2cap_sock_cleanup_listen+0xe0/0x440 [ 223.450362][ T59] l2cap_sock_release+0x6e/0x270 [ 223.450377][ T59] sock_close+0xc3/0x240 [ 223.450388][ T59] __fput+0x461/0xa70 [ 223.450409][ T59] task_work_run+0x1d9/0x270 [ 223.450430][ T59] exit_to_user_mode_loop+0xf3/0x4d0 [ 223.450448][ T59] do_syscall_64+0x33e/0xf80 [ 223.450468][ T59] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.450511][ T59] [ 223.450516][ T59] The buggy address belongs to the object at ffff88801a186000 [ 223.450516][ T59] which belongs to the cache kmalloc-2k of size 2048 [ 223.450534][ T59] The buggy address is located 1968 bytes inside of [ 223.450534][ T59] freed 2048-byte region [ffff88801a186000, ffff88801a186800) [ 223.450554][ T59] [ 223.450559][ T59] The buggy address belongs to the physical page: [ 223.450582][ T59] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1a180 [ 223.450602][ T59] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 223.450628][ T59] flags: 0x80000000000040(head|node=0|zone=1) [ 223.450654][ T59] page_type: f5(slab) [ 223.450668][ T59] raw: 0080000000000040 ffff88801a011000 dead000000000100 dead000000000122 [ 223.450682][ T59] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 223.450697][ T59] head: 0080000000000040 ffff88801a011000 dead000000000100 dead000000000122 [ 223.450710][ T59] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 223.450724][ T59] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 223.450737][ T59] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 223.450745][ T59] page dumped because: kasan: bad access detected [ 223.450758][ T59] page_owner tracks the page as allocated [ 223.450763][ T59] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5607, tgid 5607 (syz-executor), ts 105436625546, free_ts 105378434367 [ 223.450790][ T59] post_alloc_hook+0x231/0x280 [ 223.450806][ T59] get_page_from_freelist+0x27c8/0x2840 [ 223.450825][ T59] __alloc_frozen_pages_noprof+0x18d/0x380 [ 223.450845][ T59] allocate_slab+0x77/0x660 [ 223.450866][ T59] refill_objects+0x33c/0x3d0 [ 223.450885][ T59] __pcs_replace_empty_main+0x373/0x720 [ 223.450907][ T59] __kmalloc_node_track_caller_noprof+0x60b/0x7e0 [ 223.450924][ T59] __alloc_skb+0x2c1/0x7d0 [ 223.450962][ T59] inet6_ifinfo_notify+0x70/0x120 [ 223.450986][ T59] addrconf_notify+0xca0/0x1050 [ 223.451016][ T59] notifier_call_chain+0x1ad/0x3d0 [ 223.451041][ T59] __dev_notify_flags+0x1a9/0x310 [ 223.451063][ T59] netif_change_flags+0xe8/0x1a0 [ 223.451086][ T59] do_setlink+0xfa5/0x45a0 [ 223.451110][ T59] rtnl_newlink+0x15ad/0x1bb0 [ 223.451131][ T59] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 223.451153][ T59] page last free pid 5616 tgid 5616 stack trace: [ 223.451165][ T59] __free_frozen_pages+0xfa6/0x10f0 [ 223.451186][ T59] __slab_free+0x252/0x2a0 [ 223.451206][ T59] qlist_free_all+0x99/0x100 [ 223.451223][ T59] kasan_quarantine_reduce+0x148/0x160 [ 223.451240][ T59] __kasan_slab_alloc+0x22/0x80 [ 223.451259][ T59] __kmalloc_node_noprof+0x328/0x7f0 [ 223.451286][ T59] qdisc_alloc+0x92/0x9f0 [ 223.451303][ T59] qdisc_create_dflt+0x8e/0x4e0 [ 223.451320][ T59] dev_activate+0x378/0x1150 [ 223.451337][ T59] __dev_open+0x67a/0x830 [ 223.451351][ T59] __dev_change_flags+0x2fa/0x7e0 [ 223.451368][ T59] netif_change_flags+0x88/0x1a0 [ 223.451386][ T59] do_setlink+0xfa5/0x45a0 [ 223.451403][ T59] rtnl_newlink+0x15ad/0x1bb0 [ 223.451419][ T59] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 223.451435][ T59] netlink_rcv_skb+0x232/0x4b0 [ 223.451453][ T59] [ 223.451457][ T59] Memory state around the buggy address: [ 223.451465][ T59] ffff88801a186680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 223.451475][ T59] ffff88801a186700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 223.451486][ T59] >ffff88801a186780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 223.451494][ T59] ^ [ 223.451504][ T59] ffff88801a186800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 223.451516][ T59] ffff88801a186880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 223.451524][ T59] ================================================================== [ 223.455423][ T59] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 223.455447][ T59] CPU: 0 UID: 0 PID: 59 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 223.455474][ T59] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 223.455490][ T59] Workqueue: hci1 hci_rx_work [ 223.455523][ T59] Call Trace: [ 223.455532][ T59] [ 223.455541][ T59] vpanic+0x56c/0xa60 [ 223.455572][ T59] ? __pfx_vpanic+0x10/0x10 [ 223.455598][ T59] ? __pfx___schedule+0x10/0x10 [ 223.455638][ T59] panic+0xc5/0xd0 [ 223.455663][ T59] ? __pfx_panic+0x10/0x10 [ 223.455690][ T59] ? preempt_schedule_common+0x82/0xd0 [ 223.455720][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.455748][ T59] check_panic_on_warn+0x89/0xb0 [ 223.455778][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.455804][ T59] end_report+0x73/0x170 [ 223.455826][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.455852][ T59] kasan_report+0x128/0x150 [ 223.455876][ T59] ? l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.455906][ T59] l2cap_sock_new_connection_cb+0x208/0x2f0 [ 223.455933][ T59] l2cap_connect_cfm+0x368/0x1560 [ 223.455961][ T59] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 223.455982][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 223.456012][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 223.456040][ T59] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 223.456070][ T59] ? mutex_lock_nested+0x152/0x1d0 [ 223.456091][ T59] ? hci_connect_cfm+0x2c/0x140 [ 223.456123][ T59] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 223.456144][ T59] hci_connect_cfm+0x95/0x140 [ 223.456175][ T59] le_conn_complete_evt+0x1134/0x16b0 [ 223.456202][ T59] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 223.456223][ T59] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 223.456252][ T59] ? lockdep_hardirqs_on+0x7a/0x110 [ 223.456282][ T59] ? skb_pull_data+0xfb/0x200 [ 223.456317][ T59] hci_le_conn_complete_evt+0x187/0x470 [ 223.456354][ T59] hci_event_packet+0x659/0xef0 [ 223.456383][ T59] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 223.456411][ T59] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 223.456442][ T59] ? __pfx_hci_event_packet+0x10/0x10 [ 223.456469][ T59] ? rt_spin_unlock+0x14f/0x200 [ 223.456497][ T59] ? hci_send_to_monitor+0xe2/0x590 [ 223.456521][ T59] hci_rx_work+0x3ee/0x1040 [ 223.456553][ T59] ? process_scheduled_works+0xa70/0x1860 [ 223.456578][ T59] process_scheduled_works+0xb5d/0x1860 [ 223.456628][ T59] ? __pfx_process_scheduled_works+0x10/0x10 [ 223.456657][ T59] ? assign_work+0x3d5/0x5e0 [ 223.456683][ T59] worker_thread+0xa53/0xfc0 [ 223.456721][ T59] kthread+0x388/0x470 [ 223.456750][ T59] ? __pfx_worker_thread+0x10/0x10 [ 223.456771][ T59] ? __pfx_kthread+0x10/0x10 [ 223.456800][ T59] ret_from_fork+0x514/0xb70 [ 223.456827][ T59] ? __pfx_ret_from_fork+0x10/0x10 [ 223.456850][ T59] ? __switch_to+0xc79/0x1410 [ 223.456884][ T59] ? __pfx_kthread+0x10/0x10 [ 223.456914][ T59] ret_from_fork_asm+0x1a/0x30 [ 223.456952][ T59] [ 223.457838][ T59] Kernel Offset: disabled