last executing test programs: 32.845525291s ago: executing program 1 (id=5): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x5, 0x8100, 0x4000}, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, r3, 0x1, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x15c, 0x1a, 0x713, 0x0, 0x25dfdbff, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x4d2, 0x2b}, @in=@dev={0xac, 0x14, 0x14, 0x38}, {0x5, 0x0, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x100, 0x1}, {}, 0x70bd2c, 0x3505, 0xa, 0x4, 0x0, 0x54}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "210466d38547aa140db9a200000000c538c7cb7a"}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 32.617578196s ago: executing program 1 (id=6): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="2e00000010008108040f80ecdb4cb92e0a480e0007000000e8bd6efb250314000e000100240248ff050005001200", 0x2e}], 0x1}, 0x40880) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) add_key(0x0, 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6", 0x504, 0xffffffffffffffff) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000a40)={0x44, &(0x7f0000000700)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, &(0x7f0000000740)={0x14, &(0x7f0000000040)={0x0, 0xe, 0xf6, {0xf6, 0x11, "1d4adef2395df2a645972324027f707d148523f1a17581e4fd3f06519b2b4f604ab65ecba7cdf2eed64ab4dee57370240e6ee75fdccae4078c275241b62cb6b772f50e43fc2823e01540926de36e83aa61b3c0c2d8cfc92dd6f84a28f4b0ec61b41fb430a93a0f1dbe8e783eff3fbce5b20e79a7e873bfe7e3a2e6d94588bb86e629650e374a9264edcc0212c200280fb05a4dcb70790999c880e5d12f376d6f82437586e5733e96769ec01c72e21e0b2c7baaaf12a4a036db938e6f10443510fb16d9fafabd4436fa68f0ddabe4aa3d3d2ae25cbcf7ce5f23af40a426bf084e7f77d84e97d67a709ffb0670f103dd48fb790c76"}}, &(0x7f0000000140)={0x0, 0x3, 0xac, @string={0xac, 0x3, "f09215c1cd21cb7253ad5d834d69e65b52e6088e221525e9b2cc797bc2ded22202a82e558759bf2d52d42b328fc2b262c7f62b7b230d565939f06f2b4c260357390065b4815a334d255e113e123922084514d9f64161d5dff50a2aae72f34c9900ee6073ebcbcc95ce14279e64a3653b8adbb5dfdc46dbe6b8a6ac0fb826b93c3a2de56f36f3486f1fa80e928ef420ef22c64278860d8dcb3d53106e67654c6c999aa584cfd5bc2e5bce"}}}, &(0x7f0000000f40)={0x1c, &(0x7f0000000780)={0x40, 0x9, 0xcd, "e3d2e8eb82ce06d4c09626c9135f1a0c666a8fbe4402e3d29790873c0ac59a8f8a3f795201ac681265cc93738dba3316bd78845a791fd1d56e6275da0638b26bf47dc66fe6146fb082aa85b68c602da326c938099cf977e7ce3f8e04dc209166f4d074f43153c3b5ece3dbac61b756647c6fafeaef4f1b656553ec69baaafb44c40666e54bbf292b0ef861003d243f4d0c6a71b9c551a8a91cd12d255cbd11d8fa9dc04977591083fca5ab86e8dc107f20bde84388a11839e3bc25f0dfe368e051b9bfb69c2048a0a541db77e0"}, &(0x7f0000000ac0)={0xa1, 0x1, 0x400, "45844e7a02a6fd04f1191258e05a01b6577e84d97796814741637d6f2e3d8083d9804f3891477b8dff077e130879376fee1da7261440a8bc2dea561d075666339702922591ebc56339d52609cf44cc1ae011783103e9c6747e69cdc5c64c80b8ef4eb09c941056df67df5573b6c9e4700a44f5d382b999555433a51274a835af6a03ace324aae64f42c6f898aa6b591fd1784bad3d2f527a5caf9f4911318d7cceca6eb27589bd1dddc087900bf5948f5ecc6be2bdae3e14a5f71228c3f97abb9d54fdbcc52fc827146952041a6c3bc618e00cd9d3efa099afe6eff37d88832ba7fa4496e0406bd6e3ae39a8fe02fa31ed37630666743b3b8ceb7b7839a2963226e4f1465ed2aa679c6c579aed8596ca81b4af9aa105fe370456cd94b213a8271568bd97129a9fc75b1a5abed0041c758d042fc12cdee07b7c607a69dfd40e058416bc0bca7a7b3297e2ca3263e23c1eda44124a4c4b28ff901e445cfc18b4ecc2eea4072623d9e93bc1e253d35318be0cffbc1802e07df0790d64244973f83f3e618f08a5469b5cb7c04e99c4878b079755867ae9f96b7c750cda58b3b7d2c3af90bd4e900fc7e20199ba64e3a0bbcdf520cc1b1b88ef8ab1504e41c321b20d13b8458bb3931ca18a7ffe4bda2fedf7820c3a112c76b273adcbf5b331be9304ff217d0550babee028b4c31085e47d549f9c2c9859962c4eb28f0ff0ff637e6ae1d826b221ccd98e28f5a525737d679c980c2fb06f8ae1a3c99caa7bda3b91013c3a7900424a22cf652ab38aa68a0d45e85edf17a895964472e10336cf4f25d95ed08cd1da65c29da16d3f5dd1c026c7c43bb2dc536a1fbd0e0ec2f96ff37381a228be14f04a4f1a19a37624b7fecf0b6a47c71b9da86b1a4cb830119053d6f23f5b384e5f7d6e7df7f7216c9d80e2e75de688a4484d02c8470dde56ef2abb230a297b1766af5ca4519b15a99d7fd1b2d527c1c0385784454ccf5f80b16459ab1ba6bd602c7167566906c4040ba891bd51088cc8444de971d52f9272f310de58fb2eef5fbc12c5f539a563a01e8add647d4bcfbb35a2351b8fc7fdd44112604c1f0d4fa22216b30a0f39201be594f2dd364cbae46060e17e863a1e691eed3904f096c8f5e038b1f60c1ba1c5e71501aae248134cf0e3e4d2b6541d311229b6b5402cf4bf57136b7af3ab8a0238ca811210c1d7f34515a14e881ce5790067f24dacb68110affed2bb2a65a9b07e06bef53552c2601aee815470e63729375f25e47328dfd9b63c6fc734a7770116adc964f66e1d642c40f9ebdd71610140ac8667fd1af1521ec47f99aa114041382c4995671c73c8628fafedc295f812c2516c94a1792ee8e41140bf072e2232d4c92265abd8bebf41a961e164cd2b0d7804e7d01fe110310edfaaa03224c956fa7e1776ae81a8d958278e3b0114fe1657f14e8c"}, &(0x7f0000000f00)={0x21, 0x0, 0x4, "cafc8437"}}) 30.982570832s ago: executing program 0 (id=16): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000a0000000060a010400000000000000000100000208000b400000000078000480340001800b000100657874686472000024000280080001400000000c080003400000000208000440000000220500020007000000400001800c00010062697477697365003000028008000340000000020800014000000014080002400000000d0c000780080001001f00020008000640000000020900010073797a30"], 0x114}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xcc, 0x15, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0x88, 0x8, "a32afe6c897a366ac883e505c87474273119494ac572f658b9f6c33582030f7794f3ee3d043ad771fae842bd9ebdbdcd8a87f33572b8dcde29d53b36ca899dd20e9f8deea368ea0708bea68761f9e0adfae04f9ef434d91d773c3f0946bfd94a51f4713b00c1e6a356554ade99be728ed3cc9a06afcbbcab436209120a40c79f734ec0c2"}]}, 0xcc}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040) 30.854403667s ago: executing program 0 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000280)=ANY=[@ANYBLOB="34010000170001002cbd7000fbdbdf25ac1414bb000000000000000000000000000004d56c000000fc0200"/52, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe800000000000000000000000000038ffffffff0000000000000000000000004e2200074e2200050200200033000000", @ANYRES32=0x0, @ANYRES16=r0, @ANYBLOB="0500000000000000010001000000000007000000000000000000000001000000060000000000000004000000000000000f000000000000000100000000000000ffffffff0000000000800000000000000400000000000000000000000000000003000000000020000000000300000000ec00000005000000010000002d"], 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x24000040) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r1, 0x5) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200), 0x6819c27ec6d84443, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f00000002c0)={'macvlan1\x00', @random="0100061f8145"}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000240)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r2, 0x3ba0, &(0x7f00000004c0)={0x48, 0xb, r3, 0x0, r5}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="02c90012000e00050017420a008000000200020a0040"], 0x17) r6 = accept4(r1, 0x0, 0x0, 0x800) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x8240) r7 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="00920000e9b8169325e222c0d5ed569c3ed7430100010058494877a1c110f28fee8fcd68ea55869b9d605b28d33b1b3fb064bdca0800000004e82803a73758958b8b8b489e89c9dd1d8bd695abd18a8d090707df36f240007add15e4e6e031aa7554319be6c9062456a8ee33f392878b4514fc122ba0c49d38d8b7242cdef0038b1f9348a7302e24a23b4ec6926deb4efce4b1d53e6222c86ac2c5f4a60cdba39544bd13baa75f24c7cd5feef4fd5bfb644011d5d63d40728b754e3d7b2814dd83525a394069215d5ba9e008ca4993e346182ad947b6000000000000007487c3f93a6643cd4e720777bb2ad971394598337156a87289143d22b2dd6d126214cf143e46dbd768598ff15eb67de9c1e6aae2562e24ed4fac26b3f87d8f4a9c191fded4e050fbeebdf8d52af8e7cdb8819ab9d63d7198b56c2c2fd2cf46094d938c70947857d4fb39a64d466ad4d5e41862ada0e4182a746187b8f922d3dcf65411b83238abda8599ad96ed44420000000000002a829e2b763720f83d524719fa7f45a2b5367c42660000000000", @ANYRES16=0x0, @ANYBLOB="20002abd7000fedbdf255a0000000c009900070000003c000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x14) 30.612432116s ago: executing program 3 (id=20): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) recvmsg(r0, &(0x7f00000006c0)={&(0x7f0000000000)=@phonet, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000080)=""/110, 0x6e}, {&(0x7f0000000100)=""/233, 0xe9}, {&(0x7f0000000200)=""/159, 0x9f}, {&(0x7f00000002c0)=""/137, 0x89}, {&(0x7f0000000380)=""/136, 0x88}, {&(0x7f0000000440)=""/29, 0x1d}, {&(0x7f0000000480)=""/32, 0x20}, {&(0x7f00000004c0)=""/255, 0xff}], 0x8, &(0x7f0000000640)=""/108, 0x6c}, 0x40000000) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f0000000700), &(0x7f0000000740)=0x4) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000780)={0x89, 0x52, 0x3, 0x4a, 0x3, 0xff, 0xf, 0x5, 0x0, 0x10, 0x4, 0xa, 0x6, 0x7}, 0xe) r1 = accept$nfc_llcp(0xffffffffffffffff, 0x0, &(0x7f00000007c0)) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000800)={'wlan0\x00'}) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000840)={0x0, @l2={0x1f, 0x4, @any, 0xd000, 0x1}, @tipc=@name={0x1e, 0x2, 0x2, {{0x0, 0x4}, 0x2}}, @l2tp={0x2, 0x0, @broadcast, 0x3}, 0xea, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0x80000001, 0x1}) r2 = fspick(0xffffffffffffffff, &(0x7f00000008c0)='./file0\x00', 0x1) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000980)='./file0\x00', 0x101000, 0x52) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000900)='\\&,+\x00', &(0x7f0000000940)='./file0\x00', r3) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000009c0)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) inotify_add_watch(r4, &(0x7f0000000a00)='./file0\x00', 0x40000121) fstat(r2, &(0x7f0000000a40)) ioctl$KVM_SET_TSC_KHZ_cpu(r4, 0xaea2, 0x1) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000ac0)={0x3380, 0x26b, 0x2, {0xb, @raw_data="aa601897c2ca123b7f17c60ff38db5c80e8f96997910f935ad0e1d8192ffebe282ae83d783c1d25ed6b025a4bf303a7355cbea01b42364c624740218aa6defa6814f47c1e5d65059bdca1d0456581121a21334004223d426e172eaec7f8f8f2152fb166df78c7d737f6cd15d30de4d5e8395cd40494f95ccc38064c5230d1ca94b04e6132407aab09188825fac9f102ddfcb73f78057e7c8ba8b427fbb7090420a1489cb2d1207b9c94ea9c8c4a4dcea7196a8f99337908138f971d4eb09374e09eb22ec0c5e2faa"}, 0x8}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000000bc0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r4, 0xc0182101, &(0x7f0000000c40)={r5, 0xf799, 0x7}) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r4, 0xc0182101, &(0x7f0000000c80)={r5, 0x100, 0x3}) ioctl$HIDIOCSFEATURE(r4, 0xc0404806, &(0x7f0000000cc0)="45902a0101bba1b06ca038959a7ff6a6cd9376183f87b1f5220847483eb34db9f6dba301a4454c93a96c7852ff86833da0395f337ebfc718bb7d44adc05558e12b9c33b24a00831ea33ac9e1229adfc3afe7c6f2704c2cbaea339c15be2211ef17784836b9e0f82f88b3bc0b144b2cfd3c") accept4$nfc_llcp(r1, &(0x7f0000000d40), &(0x7f0000000dc0)=0x60, 0x0) mount(&(0x7f0000000e00)=@sg0, &(0x7f0000000e40)='./file0\x00', &(0x7f0000000e80)='cgroup2\x00', 0x800, &(0x7f0000000ec0)='\x00') r6 = openat(r0, &(0x7f0000000f00)='./file0\x00', 0x12b002, 0x82) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$BLKBSZGET(r6, 0x80081270, &(0x7f0000000f40)) ioctl$MON_IOCQ_URB_LEN(r4, 0x9201) write(r6, &(0x7f0000000f80)="d2c23f2fe648089421b45d8ad8e9ab00d3cb199306aa", 0x16) r7 = syz_usb_connect$midi(0x5, 0x84, &(0x7f0000000fc0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0xe41, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x1, 0x1, 0xa, 0xd0, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x4, 0x1, 0x3, 0x10, 0x55, [@ms_header={0x7, 0x24, 0x1, 0xb7d, 0x7}, @midi_out_jack={0xd, 0x24, 0x3, 0x2, 0xfc, 0x3, [{0x6, 0x4}, {0x72, 0x6}, {0x1, 0x7f}], 0x7}], [{{0x9, 0x5, 0xf, 0x10, 0x10, 0x5, 0xcc, 0xa, {0x4}}}, {{0x9, 0x5, 0xd, 0x10, 0x8, 0xf, 0x4, 0x9, {0xa, 0x25, 0x1, 0x6, "19f006e6a171"}}}, {{0x9, 0x5, 0xe, 0x3, 0x400, 0x7f, 0xfb, 0x40, {0x14, 0x25, 0x1, 0x10, "ed25a1cd5e44f66db9983d6003bae839"}}}, {{0x9, 0x5, 0x6, 0x4, 0x40, 0x76, 0xc3, 0x7, {0x6, 0x25, 0x1, 0x2, "c020"}}}]}}}}}]}}, &(0x7f0000001240)={0xa, &(0x7f0000001080)={0xa, 0x6, 0x310, 0x4, 0x8, 0xf, 0x8, 0xa6}, 0x2c, &(0x7f00000010c0)={0x5, 0xf, 0x2c, 0x3, [@ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x85, 0x2, 0x8, 0xf00, 0x83, [0x30, 0xff3f00]}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x2, 0xf, 0x9feb, [0x3ff0]}]}, 0x3, [{0x4, &(0x7f0000001100)=@lang_id={0x4, 0x3, 0xc09}}, {0x94, &(0x7f0000001140)=@string={0x94, 0x3, "4be9405045ba0c175efd3f5454bfaed0556999fc5f34297c9b5ce457881ee581438586ac12ed4303a4d0ffdac7f4367067b9327a28f639e5749d00bc18df3277a98b22c56d6a3b93ef9f6054178efd5d6f40d77243e1a4879156d85d4776d9643a6d5ad9508a3603bb657d3c063935162b56c0a026eac87fbbac2d54420b72a76f78b02283f173d6dc26ac961fc1fb0380bd"}}, {0x2c, &(0x7f0000001200)=@string={0x2c, 0x3, "91b5512777761c00ef27db48eee2293700008fcae7d12fb346c92c019c0876607f1b35b9ebeb5be61962"}}]}) syz_usb_control_io$uac1(r7, &(0x7f0000001380)={0x14, &(0x7f0000001280)={0x20, 0xb, 0xe, {0xe, 0x8, "fe1d3c4fc180250ee3cdb3ba"}}, &(0x7f00000012c0)={0x0, 0x3, 0x92, @string={0x92, 0x3, "e0f6c1aae1fde1200d44de22ba208e722c22c7f123233acc042c3aeb3f4aeed31eff3559a5977aef2fe80374f2b5c76824fe7b00e7a461d701cdd77b2d41e67788ffac1568ecebef723f4354f2bd88a29f0f37ddd03d227ae8e27c143c1c64fc6b302e1fd4ddaef92ecd7f8b52c04e49c3f49e1969f8baeba9ba7687069734db0a6067df4bdbde348b2185dea3dafab8"}}}, &(0x7f0000001600)={0x44, &(0x7f00000013c0)={0x40, 0x16, 0x4f, "3c436793f0b76b74038077e1431a9b9cca4c4e647e06f2713955d4b0ef427aee07d692e0c2be782df874fa6e20a212e0579f1e5de706c669b555c591c636e340f5d942ff787ca96710f6aab6d0964f"}, &(0x7f0000001440)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000001480)={0x0, 0x8, 0x1}, &(0x7f00000014c0)={0x20, 0x81, 0x1, '\a'}, &(0x7f0000001500)={0x20, 0x82, 0x1, "d5"}, &(0x7f0000001540)={0x20, 0x83, 0x2, "9c82"}, &(0x7f0000001580)={0x20, 0x84, 0x2, "e37f"}, &(0x7f00000015c0)={0x20, 0x85, 0x3, 'ooo'}}) r8 = fsopen(&(0x7f0000001680)='debugfs\x00', 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r8, 0x4, &(0x7f00000016c0)='/dev/sg0\x00', &(0x7f0000001700)='./file0\x00', r6) 30.570685413s ago: executing program 1 (id=21): syz_open_dev$evdev(&(0x7f0000000000), 0x4cc6, 0x84803) 30.492589795s ago: executing program 1 (id=22): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0003010300f40904000000010100000a24010300030201020904010000010200"], 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000140), 0x4, 0xac502) 29.101500465s ago: executing program 0 (id=29): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000001bc0), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000001c00)={0x800, 0x7fffffff, 0x1, {0x9, @pix_mp={0x4, 0x6, 0x31364d4e, 0x3, 0x0, [{0x3, 0x4}, {0x3, 0xb4}, {0x3, 0x8001}, {0x9eb9, 0x80000001}, {0x2, 0x2}, {0x9, 0x10000}, {0x7, 0x6}, {0x1, 0x80000000}], 0x1d, 0xd9, 0x4, 0x2, 0x5}}, 0x10000}) r1 = inotify_init() openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x400142, 0x8a) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000), 0x103081, 0x0) write(r2, &(0x7f0000000040)="393424cdd8839bbce4f2b14d1e9c9fe2f5140ec1328ed03641671651ccfbd7afaf8dca9f500ff358e1f294c67a81c6c8fb08a45ef0796c7fa390b833a8b0f6b1fe3ee836b17444cc89f8cbfd00", 0x4d) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) inotify_add_watch(r1, &(0x7f0000005780)='./file0\x00', 0x9600006d) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$SEG6_CMD_GET_TUNSRC(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r6, 0x1, 0x70bd23, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000050}, 0x4000) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) read$dsp(r2, &(0x7f00000001c0)=""/81, 0x51) connect$inet6(r4, &(0x7f0000000080), 0x1c) shutdown(r4, 0x1) r7 = fcntl$dupfd(r4, 0x0, r4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x3b) recvmmsg(r7, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}, 0x400}], 0x1, 0x40000002, 0x0) fcntl$notify(r3, 0x402, 0x21) setxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f0000000000), 0x0, 0x0, 0x0) 29.01890233s ago: executing program 1 (id=31): r0 = syz_open_dev$evdev(&(0x7f00000005c0), 0x3214, 0x200) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r0) syz_usb_connect$hid(0x0, 0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040710408060000000000010902200001010080fa0904000002ffffff0007058102000200"], 0x0) ioctl$EVIOCRMFF(r0, 0x4004550d, 0x0) 28.959337441s ago: executing program 3 (id=32): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000140)={0x1}, 0x4) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x304) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc_mnt\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) 28.884119494s ago: executing program 0 (id=34): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) (async) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) write(r1, 0x0, 0x0) (async) write(r1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x1}}, './tracing/events/sched/filter\x00'}) mount(0x0, &(0x7f0000000100)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x2240, 0x0) read$FUSE(r2, &(0x7f0000003800)={0x2020}, 0x2020) r3 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r3, &(0x7f0000000040)={0xa, 0x0, 0x3, @empty, 0x4, 0x4}, 0x20) read$FUSE(r2, 0x0, 0x0) 28.714136406s ago: executing program 0 (id=36): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000024000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 28.659046948s ago: executing program 0 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000280)=ANY=[@ANYBLOB="34010000170001002cbd7000fbdbdf25ac1414bb000000000000000000000000000004d56c000000fc0200"/52, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe800000000000000000000000000038ffffffff0000000000000000000000004e2200074e2200050200200033000000", @ANYRES32=0x0, @ANYRES16=r0, @ANYBLOB="0500000000000000010001000000000007000000000000000000000001000000060000000000000004000000000000000f000000000000000100000000000000ffffffff0000000000800000000000000400000000000000000000000000000003000000000020000000000300000000ec00000005000000010000002d"], 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x24000040) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r1, 0x5) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200), 0x6819c27ec6d84443, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f00000002c0)={'macvlan1\x00', @random="0100061f8145"}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000240)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r2, 0x3ba0, &(0x7f00000004c0)={0x48, 0xb, r3, 0x0, r5}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="02c90012000e00050017420a008000000200020a0040"], 0x17) r6 = accept4(r1, 0x0, 0x0, 0x800) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x8240) r7 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="00920000e9b8169325e222c0d5ed569c3ed7430100010058494877a1c110f28fee8fcd68ea55869b9d605b28d33b1b3fb064bdca0800000004e82803a73758958b8b8b489e89c9dd1d8bd695abd18a8d090707df36f240007add15e4e6e031aa7554319be6c9062456a8ee33f392878b4514fc122ba0c49d38d8b7242cdef0038b1f9348a7302e24a23b4ec6926deb4efce4b1d53e6222c86ac2c5f4a60cdba39544bd13baa75f24c7cd5feef4fd5bfb644011d5d63d40728b754e3d7b2814dd83525a394069215d5ba9e008ca4993e346182ad947b6000000000000007487c3f93a6643cd4e720777bb2ad971394598337156a87289143d22b2dd6d126214cf143e46dbd768598ff15eb67de9c1e6aae2562e24ed4fac26b3f87d8f4a9c191fded4e050fbeebdf8d52af8e7cdb8819ab9d63d7198b56c2c2fd2cf46094d938c70947857d4fb39a64d466ad4d5e41862ada0e4182a746187b8f922d3dcf65411b83238abda8599ad96ed44420000000000002a829e2b763720f83d524719fa7f45a2b5367c42660000000000", @ANYRES16=0x0, @ANYBLOB="20002abd7000fedbdf255a0000000c009900070000003c000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x14) 28.641685328s ago: executing program 3 (id=38): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01084800000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30"], 0xf0}}, 0x0) 28.458749208s ago: executing program 3 (id=39): syz_usb_connect$uac1(0x7, 0x71, &(0x7f0000000040)=ANY=[@ANYBLOB="12011001000000406b1d010140000102030109025f0003010300f40904000000010100000a24010300030201020904010000010200"], 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab1204000000000000010902240001b30000040904410c17ff5d810009050f1f05e13f000009058303"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000140), 0x4, 0xac502) 28.400906231s ago: executing program 2 (id=40): r0 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2, 0x11, r0, 0x0) 28.350129884s ago: executing program 2 (id=41): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090484000003e102"], 0x0) syz_usb_disconnect(r0) syz_open_dev$evdev(&(0x7f0000000000), 0x4cc6, 0x84803) 27.409306325s ago: executing program 1 (id=42): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="c0000000190001000000000010000000e0000002000000000000000000000000ac1414bb00000000000000000000000000000000000000000a00008006000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000002ee0000000000001910be1a000000000000000000000000000000000000000008000000000000000000000000000000fdfffffffffeffff000000000000000000000000000000000000000000000000000000000000000000000000b86b6e00000100010000000008001f0001"], 0xc0}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000000308010200000000000000000200000a0500030006000000060002407896000014000480080004"], 0x38}, 0x1, 0x0, 0x0, 0x4000844}, 0x20008002) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) io_setup(0x1, 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402", @ANYRESOCT, @ANYRES32, @ANYBLOB="1f1b1d36"], 0x0) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x7}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r4, &(0x7f0000001300)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000001e6c01dc80000000000000040000000060800024000000004"], 0x28}}, 0x0) sendto$inet6(r3, &(0x7f00000001c0)='O', 0x1, 0x80, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) shutdown(r3, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000003c0)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7c, &(0x7f0000000180), &(0x7f0000000440)=0x8) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{0x6, 0x8, 0x40, 0x7fff0000}, {0xa4, 0x51, 0x7b, 0x40000}, {0x6, 0xc5, 0x4, 0xfdfffffd}]}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x80) r6 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000002480), 0x0, &(0x7f0000000700)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, r3, r1, r3, 0xffffffffffffffff, r2, 0xffffffffffffffff, r5, r3]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r4, r0, 0xffffffffffffffff, 0xffffffffffffffff, r1]}}, @cred={{0x1c}}], 0xa8}, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='nfs4\x00', 0x0, &(0x7f00000001c0)='\x01') r7 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r7, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0xfffffffffffffee3, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x42}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000640)=""/164, 0xa4}, {&(0x7f0000000940)=""/4084, 0xff4}, {&(0x7f00000003c0)=""/142, 0x8e}, {&(0x7f0000003880)=""/191, 0xbf}], 0x4}, 0x1}], 0x3, 0x0, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r8, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x4e20, 0x3, @ipv4={'\x00', '\xff\xff', @remote}}}, 0x88, 0xc, 0x9, 0x1, 0xa4, 0x1, 0x1}, 0x98) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000080)={r2, 0x7, 0x3, 0x8}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) 27.187771749s ago: executing program 3 (id=43): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000007c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002cbd7000ffdbdf252100000008000300", @ANYRES32=r3, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x4000000, 0x20040000}, 0x4044000) 27.083210765s ago: executing program 3 (id=44): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f00000004c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000008c0)={r1, 0xffffffff}) r2 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x40) ioctl$EVIOCGMASK(r3, 0x80015b1a, 0x0) ioctl$EVIOCRMFF(r0, 0x550c, 0x0) 26.840565477s ago: executing program 2 (id=45): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000024000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 26.769608349s ago: executing program 2 (id=46): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x101800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f0000000140)={0x1}, 0x4) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x304) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/kcore\x00', 0x0, 0x0) 26.540688589s ago: executing program 2 (id=47): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01086000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c0001800800014000000004440000000e0a01010000000000000000020000000900020073797a31000000000900010073797a30"], 0xf0}}, 0x0) 26.371153276s ago: executing program 2 (id=48): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r2, &(0x7f0000000400)='PASV\r\n', 0x6) r3 = accept4(r0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000500)='227 Entering Passive Mode (127,0,0,1,19,136)', 0x2c) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000600)={0x1, 'lo\x00'}, 0x18) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000000)=@req3={0x0, 0x7, 0x8, 0x49, 0x3, 0xf, 0x7}, 0x1c) r5 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r5, &(0x7f0000000700)={0x2, 0x1388, @loopback}, 0x10) 0s ago: executing program 32 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000280)=ANY=[@ANYBLOB="34010000170001002cbd7000fbdbdf25ac1414bb000000000000000000000000000004d56c000000fc0200"/52, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe800000000000000000000000000038ffffffff0000000000000000000000004e2200074e2200050200200033000000", @ANYRES32=0x0, @ANYRES16=r0, @ANYBLOB="0500000000000000010001000000000007000000000000000000000001000000060000000000000004000000000000000f000000000000000100000000000000ffffffff0000000000800000000000000400000000000000000000000000000003000000000020000000000300000000ec00000005000000010000002d"], 0x134}, 0x1, 0x0, 0x0, 0x10}, 0x24000040) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r1, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r1, 0x5) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200), 0x6819c27ec6d84443, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f00000002c0)={'macvlan1\x00', @random="0100061f8145"}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000240)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ACCESS_REPLACE_IOAS(r2, 0x3ba0, &(0x7f00000004c0)={0x48, 0xb, r3, 0x0, r5}) syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="02c90012000e00050017420a008000000200020a0040"], 0x17) r6 = accept4(r1, 0x0, 0x0, 0x800) syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x8240) r7 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000500)='./dev\x00', &(0x7f0000000600)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/ttyUSB0\x00', 0x0, 0x0) syz_usb_control_io(r7, 0x0, 0x0) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="00920000e9b8169325e222c0d5ed569c3ed7430100010058494877a1c110f28fee8fcd68ea55869b9d605b28d33b1b3fb064bdca0800000004e82803a73758958b8b8b489e89c9dd1d8bd695abd18a8d090707df36f240007add15e4e6e031aa7554319be6c9062456a8ee33f392878b4514fc122ba0c49d38d8b7242cdef0038b1f9348a7302e24a23b4ec6926deb4efce4b1d53e6222c86ac2c5f4a60cdba39544bd13baa75f24c7cd5feef4fd5bfb644011d5d63d40728b754e3d7b2814dd83525a394069215d5ba9e008ca4993e346182ad947b6000000000000007487c3f93a6643cd4e720777bb2ad971394598337156a87289143d22b2dd6d126214cf143e46dbd768598ff15eb67de9c1e6aae2562e24ed4fac26b3f87d8f4a9c191fded4e050fbeebdf8d52af8e7cdb8819ab9d63d7198b56c2c2fd2cf46094d938c70947857d4fb39a64d466ad4d5e41862ada0e4182a746187b8f922d3dcf65411b83238abda8599ad96ed44420000000000002a829e2b763720f83d524719fa7f45a2b5367c42660000000000", @ANYRES16=0x0, @ANYBLOB="20002abd7000fedbdf255a0000000c009900070000003c000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x14) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.147' (ED25519) to the list of known hosts. [ 72.428027][ T5604] cgroup: Unknown subsys name 'net' [ 72.523859][ T5604] cgroup: Unknown subsys name 'cpuset' [ 72.527178][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.213801][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.559930][ T5618] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.569788][ T5620] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.577350][ T5620] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.587762][ T5626] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.588990][ T5626] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.589992][ T5620] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.613210][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.614231][ T4932] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.621603][ T5620] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.622438][ T5620] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.632905][ T5626] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.662172][ T5626] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.668268][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.684818][ T5626] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.685971][ T5626] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.714171][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.718225][ T5618] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.718803][ T5618] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.720165][ T5618] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.734768][ T5618] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.267520][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.267790][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.267913][ T5616] bridge_slave_0: entered allmulticast mode [ 78.269908][ T5616] bridge_slave_0: entered promiscuous mode [ 78.318309][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.318427][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.318556][ T5616] bridge_slave_1: entered allmulticast mode [ 78.320172][ T5616] bridge_slave_1: entered promiscuous mode [ 78.353956][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.354134][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.354268][ T5614] bridge_slave_0: entered allmulticast mode [ 78.355862][ T5614] bridge_slave_0: entered promiscuous mode [ 78.390757][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.390889][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.391010][ T5615] bridge_slave_0: entered allmulticast mode [ 78.392519][ T5615] bridge_slave_0: entered promiscuous mode [ 78.394118][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.394235][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.394359][ T5614] bridge_slave_1: entered allmulticast mode [ 78.396075][ T5614] bridge_slave_1: entered promiscuous mode [ 78.455122][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.455187][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.455299][ T5615] bridge_slave_1: entered allmulticast mode [ 78.456518][ T5615] bridge_slave_1: entered promiscuous mode [ 78.476970][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.477186][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.477287][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.477422][ T5613] bridge_slave_0: entered allmulticast mode [ 78.481052][ T5613] bridge_slave_0: entered promiscuous mode [ 78.484864][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.484992][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.485116][ T5613] bridge_slave_1: entered allmulticast mode [ 78.487014][ T5613] bridge_slave_1: entered promiscuous mode [ 78.548650][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.574894][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.590368][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.594382][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.598102][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.603045][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.631448][ T5618] Bluetooth: hci0: command tx timeout [ 78.648343][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.663826][ T5616] team0: Port device team_slave_0 added [ 78.678964][ T5613] team0: Port device team_slave_0 added [ 78.681423][ T5614] team0: Port device team_slave_0 added [ 78.697478][ T5616] team0: Port device team_slave_1 added [ 78.699386][ T5613] team0: Port device team_slave_1 added [ 78.700576][ T5618] Bluetooth: hci3: command tx timeout [ 78.700752][ T5618] Bluetooth: hci2: command tx timeout [ 78.703001][ T5614] team0: Port device team_slave_1 added [ 78.734851][ T5615] team0: Port device team_slave_0 added [ 78.771524][ T5615] team0: Port device team_slave_1 added [ 78.783255][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.783272][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.783294][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.790585][ T5626] Bluetooth: hci1: command tx timeout [ 78.842925][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.842944][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.842968][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.843674][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.843687][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.843716][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.845232][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.845247][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.845271][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.847071][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.847086][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.847109][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.848214][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.848227][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.848251][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.849818][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.849831][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.849854][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.862640][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.862656][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.862679][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.045393][ T5615] hsr_slave_0: entered promiscuous mode [ 79.046521][ T5615] hsr_slave_1: entered promiscuous mode [ 79.056579][ T5613] hsr_slave_0: entered promiscuous mode [ 79.057623][ T5613] hsr_slave_1: entered promiscuous mode [ 79.058408][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 79.058483][ T5613] Cannot create hsr debugfs directory [ 79.121403][ T5614] hsr_slave_0: entered promiscuous mode [ 79.122465][ T5614] hsr_slave_1: entered promiscuous mode [ 79.123747][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 79.123766][ T5614] Cannot create hsr debugfs directory [ 79.136672][ T5616] hsr_slave_0: entered promiscuous mode [ 79.137727][ T5616] hsr_slave_1: entered promiscuous mode [ 79.138454][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 79.138471][ T5616] Cannot create hsr debugfs directory [ 79.635497][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.646519][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.647659][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.652827][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.653697][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.659959][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.661700][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.665909][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.795700][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.798952][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.799726][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.804412][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.807454][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.820094][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.822217][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.840638][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.879649][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.956993][ T5614] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.961917][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.963112][ T5614] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.979632][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.981937][ T5614] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.995630][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.998482][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.006135][ T5614] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.016974][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.043129][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.043231][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.091128][ T125] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.091234][ T125] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.141368][ T5616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.145067][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.149923][ T5616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.162365][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.164738][ T5616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.168697][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.188021][ T5616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.200037][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.359522][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.431859][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.465885][ T125] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.466007][ T125] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.499536][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.518743][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.518840][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.571833][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.589609][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.636036][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.636169][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.662845][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.683897][ T125] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.683992][ T125] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.705906][ T5626] Bluetooth: hci0: command tx timeout [ 80.716609][ T125] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.716730][ T125] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.718999][ T125] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.719125][ T125] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.780533][ T5626] Bluetooth: hci2: command tx timeout [ 80.780569][ T5626] Bluetooth: hci3: command tx timeout [ 80.860530][ T5618] Bluetooth: hci1: command tx timeout [ 81.182830][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.381723][ T5615] veth0_vlan: entered promiscuous mode [ 81.417153][ T5615] veth1_vlan: entered promiscuous mode [ 81.538973][ T5615] veth0_macvtap: entered promiscuous mode [ 81.556648][ T5615] veth1_macvtap: entered promiscuous mode [ 81.601073][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.606186][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.650966][ T1167] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.716062][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.836058][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.837524][ T125] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.837934][ T125] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.954962][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.954989][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.038653][ T5613] veth0_vlan: entered promiscuous mode [ 82.123332][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.128669][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.128692][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.164108][ T5613] veth1_vlan: entered promiscuous mode [ 82.235054][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.315519][ T5615] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 82.346231][ T5613] veth0_macvtap: entered promiscuous mode [ 82.379772][ T5613] veth1_macvtap: entered promiscuous mode [ 82.500743][ T5762] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.503193][ T5614] veth0_vlan: entered promiscuous mode [ 82.556565][ T5764] i2c i2c-0: Frontend requested software zigzag, but didn't set the frequency step size [ 82.562416][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.584212][ T5614] veth1_vlan: entered promiscuous mode [ 82.614345][ T5616] veth0_vlan: entered promiscuous mode [ 82.624588][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.680752][ T5616] veth1_vlan: entered promiscuous mode [ 82.701076][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.701972][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.780967][ T5618] Bluetooth: hci0: command tx timeout [ 82.839014][ T5614] veth0_macvtap: entered promiscuous mode [ 82.861130][ T5618] Bluetooth: hci3: command tx timeout [ 82.861167][ T5618] Bluetooth: hci2: command tx timeout [ 82.885911][ T5614] veth1_macvtap: entered promiscuous mode [ 82.923485][ T5616] veth0_macvtap: entered promiscuous mode [ 82.941069][ T5626] Bluetooth: hci1: command tx timeout [ 82.960841][ T125] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.979751][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.979773][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.982350][ T60] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.995200][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.999386][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.012725][ T5616] veth1_macvtap: entered promiscuous mode [ 83.093649][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.093673][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.153358][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.207669][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.232592][ T125] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.233003][ T125] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.233182][ T125] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.271635][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.273262][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.273302][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.273333][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.273365][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.365664][ T5775] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4'. [ 83.448660][ T1098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.448684][ T1098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.450559][ T5619] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 83.564521][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.564544][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.604485][ T5619] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 83.607763][ T5619] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 83.607822][ T5619] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.621945][ T125] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.621966][ T125] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.664598][ T5619] usb 2-1: config 0 descriptor?? [ 83.682198][ T5619] pwc: Askey VC010 type 2 USB webcam detected. [ 83.687786][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.687808][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.898586][ T5782] f2fs: Unknown parameter 'c/mprm' [ 84.022996][ T5789] process 'syz.0.8' launched './file2' with NULL argv: empty string added [ 84.089334][ T5619] pwc: recv_control_msg error -32 req 02 val 2b00 [ 84.091552][ T5619] pwc: recv_control_msg error -32 req 02 val 2700 [ 84.106750][ T5619] pwc: recv_control_msg error -32 req 02 val 2c00 [ 84.115740][ T5619] pwc: recv_control_msg error -32 req 04 val 1000 [ 84.116517][ T5619] pwc: recv_control_msg error -32 req 04 val 1300 [ 84.119923][ T5619] pwc: recv_control_msg error -32 req 04 val 1400 [ 84.140981][ T5619] pwc: recv_control_msg error -32 req 02 val 2000 [ 84.142242][ T5619] pwc: recv_control_msg error -32 req 02 val 2100 [ 84.147312][ T5619] pwc: recv_control_msg error -32 req 04 val 1500 [ 84.313427][ T5798] sg_write: data in/out 399324/22 bytes for SCSI command 0x0-- guessing data in; [ 84.313427][ T5798] program syz.3.13 not setting count and/or reply_len properly [ 84.575688][ T5619] pwc: recv_control_msg error -71 req 02 val 2600 [ 84.576200][ T5619] pwc: recv_control_msg error -71 req 02 val 2900 [ 84.577859][ T5619] pwc: recv_control_msg error -71 req 02 val 2800 [ 84.578671][ T5619] pwc: recv_control_msg error -71 req 04 val 1100 [ 84.579542][ T5619] pwc: recv_control_msg error -71 req 04 val 1200 [ 84.627531][ T5619] pwc: Registered as video103. [ 84.637942][ T5619] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 84.662676][ T5619] usb 2-1: USB disconnect, device number 2 [ 84.680838][ T5704] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 84.833018][ T5704] usb 3-1: New USB device found, idVendor=0471, idProduct=0608, bcdDevice= 0.00 [ 84.834247][ T5704] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.834312][ T5704] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 84.834356][ T5704] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.862199][ T5626] Bluetooth: hci0: command tx timeout [ 84.941740][ T5626] Bluetooth: hci3: command tx timeout [ 85.020553][ T5626] Bluetooth: hci1: command tx timeout [ 85.082798][ T5812] netlink: 24 bytes leftover after parsing attributes in process `syz.3.19'. [ 85.110668][ T5704] usb 3-1: USB disconnect, device number 2 [ 85.227078][ T5619] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.371117][ T5619] usb 1-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 85.372063][ T5619] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 85.372082][ T5619] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 85.372107][ T5619] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.420952][ T5619] spcp8x5 1-1:1.0: SPCP8x5 converter detected [ 85.428675][ T5619] usb 1-1: SPCP8x5 converter now attached to ttyUSB0 [ 85.480344][ T48] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 85.590311][ T5704] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 85.630360][ T48] usb 4-1: Using ep0 maxpacket: 8 [ 85.632888][ T48] usb 4-1: New USB device found, idVendor=0e41, idProduct=3000, bcdDevice= 0.40 [ 85.635705][ T48] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0xE has an invalid bInterval 127, changing to 10 [ 85.638425][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.638451][ T48] usb 4-1: Product: 떑❑癷⟯䣛㜩 [ 85.638466][ T48] usb 4-1: Manufacturer: 偀멅ᜌﵞ吿뽔킮楕ﲙ㑟簩岛埤Ẉ臥蕃겆̓키瀶륧稲鵴밀眲让씢橭錻鿯呠踗巽䁯狗螤嚑巘癇擙洺詐̶斻㱽㤆ᘵ嘫ꃀ翈겻吭ୂꝲ硯⊰홳⛜隬섟ϻ부 [ 85.638490][ T48] usb 4-1: SerialNumber: syz [ 85.750502][ T5808] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 85.751133][ T5808] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 85.752746][ T5808] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 85.791587][ T5704] usb 2-1: Using ep0 maxpacket: 8 [ 85.792370][ T5704] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 85.793758][ T5704] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 85.793782][ T5704] usb 2-1: config 179 has no interface number 0 [ 85.793825][ T5704] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 85.793881][ T5704] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 85.793909][ T5704] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 85.793934][ T5704] usb 2-1: config 179 interface 65 has no altsetting 0 [ 85.793969][ T5704] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.900873][ T5704] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input6 [ 85.948028][ T4968] input input6: unable to receive magic message: -110 [ 85.961620][ T5807] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 85.963556][ T4968] input input6: unable to receive magic message: -32 [ 85.973427][ T10] usb 1-1: USB disconnect, device number 2 [ 86.001188][ T4968] input input6: unable to receive magic message: -32 [ 86.034792][ T10] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 86.041613][ T4968] input input6: unable to receive magic message: -32 [ 86.046655][ T10] spcp8x5 1-1:1.0: device disconnected [ 86.131560][ T5818] input input6: unable to receive magic message: -110 [ 86.188032][ T48] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 86.207873][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 86.210510][ T989] usb 2-1: USB disconnect, device number 3 [ 86.210619][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 86.408540][ T48] usb 4-1: USB disconnect, device number 2 [ 86.535561][ T5623] udevd[5623]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 86.619611][ T5834] netlink: 24 bytes leftover after parsing attributes in process `syz.2.28'. [ 86.955696][ T9] cfg80211: failed to load regulatory.db [ 87.197817][ T5855] netlink: 24 bytes leftover after parsing attributes in process `syz.3.38'. [ 87.441771][ T989] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 87.460973][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 87.530341][ T48] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 87.591422][ T989] usb 2-1: New USB device found, idVendor=0471, idProduct=0608, bcdDevice= 0.00 [ 87.592883][ T989] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 87.592938][ T989] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 87.592974][ T989] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.612253][ T9] usb 1-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 87.613509][ T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 87.613540][ T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 87.613577][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.634204][ T9] spcp8x5 1-1:1.0: SPCP8x5 converter detected [ 87.645902][ T9] usb 1-1: SPCP8x5 converter now attached to ttyUSB0 [ 87.730412][ T5619] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.750331][ T48] usb 4-1: Using ep0 maxpacket: 8 [ 87.756134][ T48] usb 4-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 87.757323][ T48] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 87.757342][ T48] usb 4-1: config 179 has no interface number 0 [ 87.757367][ T48] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 87.757383][ T48] usb 4-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 87.757400][ T48] usb 4-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 87.757416][ T48] usb 4-1: config 179 interface 65 has no altsetting 0 [ 87.757436][ T48] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.785667][ T48] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input7 [ 87.803419][ T989] usb 2-1: USB disconnect, device number 4 [ 87.865642][ T4968] input input7: unable to receive magic message: -110 [ 87.885537][ T4968] input input7: unable to receive magic message: -32 [ 87.888157][ T4968] input input7: unable to receive magic message: -32 [ 87.891950][ T4968] input input7: unable to receive magic message: -32 [ 87.911160][ T5619] usb 3-1: Using ep0 maxpacket: 16 [ 87.916191][ T5619] usb 3-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 87.921484][ T5619] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 87.921508][ T5619] usb 3-1: config 0 has no interface number 0 [ 87.943286][ T5619] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.943313][ T5619] usb 3-1: Product: syz [ 87.943327][ T5619] usb 3-1: Manufacturer: syz [ 87.943369][ T5619] usb 3-1: SerialNumber: syz [ 87.953977][ T5619] usb 3-1: config 0 descriptor?? [ 87.971591][ T5619] hub 3-1:0.132: bad descriptor, ignoring hub [ 87.971622][ T5619] hub 3-1:0.132: probe with driver hub failed with error -5 [ 87.971783][ T5824] input input7: unable to receive magic message: -32 [ 88.003130][ T5619] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.132/input/input8 [ 88.022809][ T4968] input input7: unable to receive magic message: -110 [ 88.059017][ T4968] input input7: unable to receive magic message: -71 [ 88.059768][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -1 [ 88.061653][ T5856] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 88.062433][ T5856] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 88.065293][ T5856] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 88.067458][ T989] usb 4-1: USB disconnect, device number 3 [ 88.067583][ C1] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 88.377222][ T5867] netlink: 8 bytes leftover after parsing attributes in process `syz.1.42'. [ 88.610824][ T989] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 88.761532][ T989] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 88.762593][ T989] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 88.762618][ T989] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 88.762633][ T989] usb 2-1: config 220 has no interface number 2 [ 88.762692][ T989] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 88.762709][ T989] usb 2-1: config 220 interface 0 has no altsetting 0 [ 88.762720][ T989] usb 2-1: config 220 interface 76 has no altsetting 0 [ 88.762730][ T989] usb 2-1: config 220 interface 1 has no altsetting 0 [ 88.764831][ T989] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.764862][ T989] usb 2-1: Product: syz [ 88.764875][ T989] usb 2-1: Manufacturer: syz [ 88.764884][ T989] usb 2-1: SerialNumber: syz [ 89.094048][ T989] usb 2-1: selecting invalid altsetting 0 [ 89.101667][ T989] uvcvideo 2-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 89.101699][ T989] uvcvideo 2-1:220.0: No valid video chain found. [ 89.105965][ T5704] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 89.115162][ T989] usb 2-1: selecting invalid altsetting 0 [ 89.115192][ T989] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 89.121553][ T989] usb 2-1: USB disconnect, device number 5 [ 89.246972][ T5879] netlink: 24 bytes leftover after parsing attributes in process `syz.2.47'. [ 89.250679][ T5704] usb 4-1: Using ep0 maxpacket: 8 [ 89.253425][ T5704] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 89.254566][ T5704] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 89.254612][ T5704] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 89.254632][ T5704] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 89.254653][ T5704] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 89.254674][ T5704] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 89.254711][ T5704] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.384645][ T60] IPVS: starting estimator thread 0... [ 89.465274][ T5704] usb 4-1: GET_CAPABILITIES returned 0 [ 89.465453][ T5704] usbtmc 4-1:16.0: can't read capabilities [ 89.470751][ T5882] IPVS: using max 27 ests per chain, 64800 per kthread [ 89.578808][ T5886] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 95.414742][ C1] sched: DL replenish lagged too much [ 135.742207][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 135.806274][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 168.602311][ T5618] Bluetooth: hci3: command 0x0406 tx timeout [ 194.933256][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.942700][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 202.246218][ T5624] Bluetooth: hci3: command 0x0406 tx timeout [ 202.405513][ T5624] Bluetooth: hci2: command 0x0406 tx timeout [ 202.405564][ T5624] Bluetooth: hci0: command 0x0406 tx timeout [ 202.405606][ T5624] Bluetooth: hci1: command 0x0406 tx timeout [ 236.998306][ T31] INFO: task kworker/1:3:5619 blocked for more than 143 seconds. [ 236.998337][ T31] Not tainted syzkaller #0 [ 236.998349][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 236.998359][ T31] task:kworker/1:3 state:D stack:22336 pid:5619 tgid:5619 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 236.998425][ T31] Workqueue: usb_hub_wq hub_event [ 236.998455][ T31] Call Trace: [ 236.998464][ T31] [ 236.998479][ T31] __schedule+0x17dd/0x5940 [ 236.998545][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 236.998581][ T31] ? __pfx___schedule+0x10/0x10 [ 236.998623][ T31] ? schedule+0x90/0x2b0 [ 236.998657][ T31] schedule+0x164/0x2b0 [ 236.998687][ T31] schedule_preempt_disabled+0x13/0x30 [ 236.998716][ T31] __mutex_lock+0x7c4/0x15a0 [ 236.998744][ T31] ? __mutex_lock+0x5cd/0x15a0 [ 236.998770][ T31] ? hub_event+0x618/0x4d30 [ 236.998793][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 236.998823][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 236.998856][ T31] ? pm_runtime_barrier+0x140/0x1c0 [ 236.998889][ T31] hub_event+0x618/0x4d30 [ 236.998909][ T31] ? __lock_acquire+0x747/0x2de0 [ 236.998946][ T31] ? __lock_acquire+0x747/0x2de0 [ 236.998975][ T31] ? look_up_lock_class+0x57/0x110 [ 236.999008][ T31] ? register_lock_class+0x31/0x2e0 [ 236.999052][ T31] ? trace_hrtimer_start+0x82/0x200 [ 236.999085][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 236.999121][ T31] ? __pfx_hub_event+0x10/0x10 [ 236.999151][ T31] ? rcu_is_watching+0x16/0xb0 [ 236.999176][ T31] ? process_scheduled_works+0x97a/0x1630 [ 236.999202][ T31] process_scheduled_works+0xc3d/0x1630 [ 236.999261][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 236.999293][ T31] ? assign_work+0x3cf/0x5d0 [ 236.999324][ T31] worker_thread+0xa47/0xfb0 [ 236.999365][ T31] ? __kthread_parkme+0x71/0x1f0 [ 236.999403][ T31] kthread+0x38b/0x480 [ 236.999433][ T31] ? __pfx_worker_thread+0x10/0x10 [ 236.999456][ T31] ? __pfx_kthread+0x10/0x10 [ 236.999486][ T31] ret_from_fork+0x514/0xb70 [ 236.999519][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 236.999556][ T31] ? __switch_to+0xc89/0x1420 [ 236.999585][ T31] ? __pfx_kthread+0x10/0x10 [ 236.999616][ T31] ret_from_fork_asm+0x1a/0x30 [ 236.999663][ T31] [ 236.999697][ T31] [ 236.999697][ T31] Showing all locks held in the system: [ 236.999706][ T31] locks held by kthreadd/2: 2, last CPU#0: [ 236.999722][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 236.999785][ T31] #1: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 236.999839][ T31] locks held by kworker/R-kvfre/6: 1, on CPU#1: [ 236.999854][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 236.999911][ T31] locks held by kworker/0:0/9: 4, on CPU#0: [ 236.999925][ T31] #0: ffff88813ff43140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 236.999978][ T31] #1: ffffc900000e7c40 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.000031][ T31] #2: ffffffff9046ad40 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0xa40 [ 237.000090][ T31] #3: ffff88807fd907a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x8d/0x160 [ 237.011520][ T31] locks held by kworker/0:1/10: 4, last CPU#0: [ 237.011546][ T31] #0: ffff88805bb5e540 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.011610][ T31] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.011678][ T31] #2: ffff88802633d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 237.011738][ T31] #3: ffff88807d29c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 237.011796][ T31] locks held by kworker/u8:0/12: 3, last CPU#0: [ 237.011810][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.011865][ T31] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.011918][ T31] #2: ffff888067f507a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.011976][ T31] locks held by kworker/u8:1/13: 4, last CPU#0: [ 237.011991][ T31] #0: ffff88807d222140 ((wq_completion)wg-kex-wg0#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012049][ T31] #1: ffffc90000127c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012102][ T31] #2: ffff88807a5ad440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 237.012161][ T31] #3: ffff88807d29aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 237.012219][ T31] locks held by kworker/R-mm_pe/14: 1, on CPU#1: [ 237.012233][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.012292][ T31] locks held by khungtaskd/31: 1, last CPU#0: [ 237.012307][ T31] #0: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 237.012358][ T31] locks held by kworker/R-write/33: 1, on CPU#1: [ 237.012373][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.012429][ T31] locks held by kworker/u8:2/36: 3, last CPU#0: [ 237.012444][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012496][ T31] #1: ffffc90000ac7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012559][ T31] #2: ffff888067c807a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.012617][ T31] locks held by kworker/1:1/48: 3, last CPU#1: [ 237.012632][ T31] #0: ffff88805bae9540 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012691][ T31] #1: ffffc90000b97c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012758][ T31] #2: ffff888025c05440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 237.012817][ T31] locks held by kworker/u8:3/50: 4, last CPU#0: [ 237.012831][ T31] #0: ffff888029e52940 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012884][ T31] #1: ffffc90000bb7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.012938][ T31] #2: ffff888025c05440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 237.012996][ T31] #3: ffff88807d29dc58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 237.013054][ T31] locks held by kworker/u8:4/60: 3, last CPU#0: [ 237.013068][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013122][ T31] #1: ffffc9000201fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013175][ T31] #2: ffff888067cf07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.013235][ T31] locks held by kworker/u8:5/125: 5, last CPU#0: [ 237.013250][ T31] #0: ffff8880202ed940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013303][ T31] #1: ffffc90002da7c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013356][ T31] #2: ffff8880340820e8 (&type->s_umount_key#34){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 237.013418][ T31] #3: ffff888034080c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x1f1/0x4e0 [ 237.013479][ T31] #4: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.013546][ T31] locks held by kworker/u8:6/127: 3, last CPU#0: [ 237.013562][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013616][ T31] #1: ffffc90002db7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013669][ T31] #2: ffff88802d4ac258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 237.013734][ T31] locks held by kworker/1:2/989: 4, on CPU#1: [ 237.013749][ T31] #0: ffff88805bb5e540 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013807][ T31] #1: ffffc90004cafc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.013873][ T31] #2: ffff88802633d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 237.013932][ T31] #3: ffff88807d29c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 237.013990][ T31] locks held by kworker/u8:7/1011: 3, last CPU#0: [ 237.014005][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014057][ T31] #1: ffffc90004d5fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014110][ T31] #2: ffff88805a6407a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.014168][ T31] locks held by kworker/u8:8/1098: 3, last CPU#0: [ 237.014183][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014236][ T31] #1: ffffc9000502fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014289][ T31] #2: ffff8880550807a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.014347][ T31] locks held by kworker/u8:9/1102: 3, last CPU#0: [ 237.014361][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014415][ T31] #1: ffffc9000507fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014469][ T31] #2: ffff88805a5507a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.014534][ T31] locks held by kworker/u8:10/1167: 3, last CPU#0: [ 237.014549][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014603][ T31] #1: ffffc9000522fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014656][ T31] #2: ffff88807fd907a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.014713][ T31] locks held by kworker/0:2/1236: 3, last CPU#0: [ 237.014728][ T31] #0: ffff88805bb5dd40 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014787][ T31] #1: ffffc9000555fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014853][ T31] #2: ffff88802cbe3ea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 237.014923][ T31] locks held by kworker/R-ipv6_/3196: 3, on CPU#0: [ 237.014937][ T31] #0: ffff88802bcff940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.014991][ T31] #1: ffffc9000dc27c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.015046][ T31] #2: ffffffff9046ad40 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 237.015109][ T31] locks held by kworker/R-bat_e/3227: 4, last CPU#1: [ 237.015123][ T31] #0: ffff88803305c140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.015178][ T31] #1: ffffc9000dca7c20 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.015233][ T31] #2: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 237.015292][ T31] #3: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 237.015344][ T31] locks held by kworker/u8:11/3761: 3, last CPU#0: [ 237.015358][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.015411][ T31] #1: ffffc9000e4a7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.015466][ T31] #2: ffff88807fc407a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 237.015533][ T31] locks held by kworker/R-ext4-/4946: 1, on CPU#1: [ 237.015547][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.015604][ T31] locks held by acpid/4968: 2, on CPU#1: [ 237.015618][ T31] #0: ffff888052aa3158 (&mousedev->mutex#2){+.+.}-{4:4}, at: mousedev_open_device+0x27/0x150 [ 237.015679][ T31] #1: ffff888012dc42b8 (&dev->mutex#2){+.+.}-{4:4}, at: input_open_device+0x4f/0x560 [ 237.015738][ T31] locks held by klogd/4972: 2, last CPU#0: [ 237.015752][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.015809][ T31] #1: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 237.015859][ T31] locks held by udevd/4983: 2, last CPU#0: [ 237.015874][ T31] #0: ffffffff8f6f2998 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 237.015925][ T31] #1: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.015983][ T31] locks held by dhcpcd/5277: 2, last CPU#0: [ 237.015997][ T31] #0: ffffffff8f6f2998 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 [ 237.016048][ T31] #1: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.016106][ T31] locks held by dhcpcd/5278: 2, last CPU#0: [ 237.016120][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.016178][ T31] #1: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: is_bpf_text_address+0x26/0x2b0 [ 237.016238][ T31] locks held by crond/5356: 1, last CPU#0: [ 237.016253][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.016312][ T31] locks held by getty/5378: 2, on CPU#0: [ 237.016327][ T31] #0: ffff88803651c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 237.016387][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 237.016446][ T31] locks held by syz-executor/5615: 3, last CPU#0: [ 237.016461][ T31] #0: ffff88805ac02808 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 [ 237.016516][ T31] #1: ffff888034264378 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock+0x1f/0x70 [ 237.016583][ T31] #2: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.016640][ T31] locks held by syz-executor/5616: 1, last CPU#0: [ 237.016654][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.016712][ T31] locks held by kworker/u9:2/5618: 7, on CPU#0: [ 237.016726][ T31] #0: ffff888036d03140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.016779][ T31] #1: ffffc900042e7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.016832][ T31] #2: ffff888012b1cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 237.016891][ T31] #3: ffff888012b1c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 237.016945][ T31] #4: ffffffff905f17c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 237.016995][ T31] #5: ffff888033e532f8 (_T->lock#5){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x630 [ 237.017054][ T31] #6: ffffffff8ef62b68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x388/0x760 [ 237.017108][ T31] locks held by kworker/1:3/5619: 4, on CPU#1: [ 237.017123][ T31] #0: ffff88801eef6140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017176][ T31] #1: ffffc900042f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017229][ T31] #2: ffff888029e6f1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 [ 237.017278][ T31] #3: ffff888029eab568 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x618/0x4d30 [ 237.017328][ T31] locks held by kworker/u9:3/5620: 5, on CPU#1: [ 237.017343][ T31] #0: ffff888077aec940 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017397][ T31] #1: ffffc90004307c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017449][ T31] #2: ffff888028c10ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 237.017507][ T31] #3: ffff888028c100b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 237.017568][ T31] #4: ffffffff905f17c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 237.017620][ T31] locks held by kworker/u9:5/5626: 5, on CPU#1: [ 237.017635][ T31] #0: ffff888077aeb140 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017687][ T31] #1: ffffc90004357c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.017741][ T31] #2: ffff888028c0cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 237.017798][ T31] #3: ffff888028c0c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 237.017850][ T31] #4: ffffffff905f17c0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 237.017902][ T31] locks held by udevd/5627: 5, last CPU#0: [ 237.017917][ T31] #0: ffff888052aa2110 (&evdev->mutex){+.+.}-{4:4}, at: evdev_open+0x2da/0x5d0 [ 237.017975][ T31] #1: ffff888012dc42b8 (&dev->mutex#2){+.+.}-{4:4}, at: input_open_device+0x4f/0x560 [ 237.018032][ T31] #2: ffff888029eab568 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_port_resume+0x274/0x1f00 [ 237.018091][ T31] #3: ffff888029e6c090 (&hub->status_mutex){+.+.}-{4:4}, at: hub_ext_port_status+0x52/0x840 [ 237.018147][ T31] #4: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.018207][ T31] locks held by kworker/R-wg-cr/5678: 1, on CPU#1: [ 237.018221][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.018276][ T31] locks held by kworker/R-wg-cr/5680: 1, last CPU#1: [ 237.018291][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018347][ T31] locks held by kworker/R-wg-cr/5681: 1, on CPU#1: [ 237.018361][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018417][ T31] locks held by kworker/R-wg-cr/5682: 1, on CPU#1: [ 237.018432][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.018486][ T31] locks held by kworker/R-wg-cr/5683: 1, on CPU#1: [ 237.018500][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018565][ T31] locks held by kworker/R-wg-cr/5684: 1, on CPU#0: [ 237.018579][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018634][ T31] locks held by kworker/R-wg-cr/5685: 1, on CPU#1: [ 237.018649][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018705][ T31] locks held by kworker/R-wg-cr/5686: 1, on CPU#1: [ 237.018720][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018776][ T31] locks held by kworker/R-wg-cr/5687: 1, on CPU#0: [ 237.018790][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018846][ T31] locks held by kworker/R-wg-cr/5688: 1, on CPU#1: [ 237.018861][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.018915][ T31] locks held by kworker/R-wg-cr/5689: 1, on CPU#1: [ 237.018929][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc0b/0x10e0 [ 237.018988][ T31] locks held by kworker/1:4/5696: 3, last CPU#1: [ 237.019002][ T31] #0: ffff888036a42540 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019061][ T31] #1: ffffc900049b7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019128][ T31] #2: ffff888079734888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 237.019187][ T31] locks held by kworker/0:4/5703: 3, last CPU#0: [ 237.019202][ T31] #0: ffff888036a42540 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019262][ T31] #1: ffffc90004a67c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019328][ T31] #2: ffff888079733ea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 237.019386][ T31] locks held by kworker/1:5/5704: 3, last CPU#1: [ 237.019401][ T31] #0: ffff888035cd3d40 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019461][ T31] #1: ffffc90004a77c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019537][ T31] #2: ffff888033ea5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 237.019598][ T31] locks held by kworker/0:5/5712: 2, last CPU#0: [ 237.019613][ T31] #0: ffff88813ff41d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019668][ T31] #1: ffffc90004b57c40 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019723][ T31] locks held by kworker/0:6/5723: 3, on CPU#0: [ 237.019738][ T31] #0: ffff88813ff41d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019792][ T31] #1: ffffc90004c37c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019845][ T31] #2: ffffffff9046ad40 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x80 [ 237.019905][ T31] locks held by kworker/0:7/5776: 4, last CPU#0: [ 237.019920][ T31] #0: ffff888034accd40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.019979][ T31] #1: ffffc90004eefc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.020044][ T31] #2: ffff888035095440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 237.020103][ T31] #3: ffff88807d298330 (&handshake->lock){++++}-{4:4}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 237.652744][ T31] locks held by kworker/1:6/5801: 3, last CPU#1: [ 237.652763][ T31] #0: ffff888034accd40 ((wq_completion)wg-kex-wg2#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.652829][ T31] #1: ffffc90004f2fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.652897][ T31] #2: ffff888035095440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 237.652960][ T31] locks held by syz.3.44/5871: 2, last CPU#0: [ 237.652985][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.653044][ T31] #1: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 237.653098][ T31] locks held by kworker/u8:12/5889: 3, last CPU#0: [ 237.653114][ T31] #0: ffff88813fe04140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.653167][ T31] #1: ffffc9000505fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.653222][ T31] #2: ffff88807d0ce258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 237.653279][ T31] locks held by kworker/u8:13/5890: 4, last CPU#0: [ 237.653294][ T31] #0: ffff88803633b140 ((wq_completion)wg-kex-wg0#7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.653352][ T31] #1: ffffc9000506fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 237.653407][ T31] #2: ffff888034911440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 237.653463][ T31] #3: ffff888079736640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 237.653519][ T31] locks held by kworker/u8:14/5891: 1, on CPU#1: [ 237.653534][ T31] #0: ffffffff8edf92a0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 237.653590][ T31] locks held by syz-executor/5893: 2, last CPU#0: [ 237.653604][ T31] #0: ffffffff8f0acdb0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 237.664626][ T31] #1: ffffffff8ef5c7a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 237.664692][ T31] [ 237.664698][ T31] ============================================= [ 237.664698][ T31] [ 237.664707][ T31] NMI backtrace for cpu 0 [ 237.664721][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 237.664744][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.664756][ T31] Call Trace: [ 237.664764][ T31] [ 237.664773][ T31] dump_stack_lvl+0xe8/0x150 [ 237.664803][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 237.664831][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 237.664861][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 237.664890][ T31] sys_info+0x135/0x170 [ 237.664912][ T31] watchdog+0x1058/0x10d0 [ 237.664949][ T31] ? watchdog+0x209/0x10d0 [ 237.664993][ T31] kthread+0x38b/0x480 [ 237.665022][ T31] ? __pfx_watchdog+0x10/0x10 [ 237.665048][ T31] ? __pfx_kthread+0x10/0x10 [ 237.665078][ T31] ret_from_fork+0x514/0xb70 [ 237.665110][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 237.665138][ T31] ? __switch_to+0xc89/0x1420 [ 237.665165][ T31] ? __pfx_kthread+0x10/0x10 [ 237.665194][ T31] ret_from_fork_asm+0x1a/0x30 [ 237.665238][ T31] [ 237.665247][ T31] Sending NMI from CPU 0 to CPUs 1: [ 237.665277][ C1] NMI backtrace for cpu 1 [ 237.665292][ C1] CPU: 1 UID: 0 PID: 3227 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 237.665312][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.665323][ C1] Workqueue: bat_events batadv_dat_purge [ 237.665348][ C1] RIP: 0010:nft_do_chain+0x7f6/0x1b10 [ 237.665369][ C1] Code: 28 84 c0 0f 85 4f 05 00 00 45 0f b6 3f 89 df 44 89 fe e8 2d 67 ab f7 44 39 fb 0f 84 96 0b 00 00 e8 0f 65 ab f7 4c 8b 7c 24 10 <8b> 9c 24 c0 00 00 00 bf ff ff ff ff 89 de e8 f7 69 ab f7 83 fb ff [ 237.665383][ C1] RSP: 0018:ffffc90000a18620 EFLAGS: 00000246 [ 237.665398][ C1] RAX: 1bb18b4c6aa8a900 RBX: ffffffff8d2e2580 RCX: 8000000000000101 [ 237.665411][ C1] RDX: 0000000000000002 RSI: ffffffff8e59e74c RDI: ffffffff8c6f0580 [ 237.665423][ C1] RBP: ffffc90000a18870 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 237.665436][ C1] R10: dffffc0000000000 R11: fffffbfff2137670 R12: ffff88807bb8df90 [ 237.665448][ C1] R13: dffffc0000000000 R14: ffff88807bb8df90 R15: 1ffff1100f771bf2 [ 237.665461][ C1] FS: 0000000000000000(0000) GS:ffff88812495b000(0000) knlGS:0000000000000000 [ 237.665482][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 237.665495][ C1] CR2: 00007f3de91f3ff8 CR3: 00000000789ac000 CR4: 00000000003526f0 [ 237.665511][ C1] Call Trace: [ 237.665517][ C1] [ 237.665531][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 237.665553][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 237.665589][ C1] nft_do_chain_inet+0x360/0x4b0 [ 237.665609][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 237.665626][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 237.665652][ C1] ? nf_nat_ipv4_local_in+0x21f/0x720 [ 237.665676][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 237.665693][ C1] nf_hook_slow+0xc5/0x220 [ 237.665719][ C1] NF_HOOK+0x21f/0x3c0 [ 237.665736][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 237.665754][ C1] ? NF_HOOK+0x9e/0x3c0 [ 237.665769][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 237.665787][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 237.665807][ C1] ? ip_local_deliver+0x113/0x190 [ 237.665825][ C1] NF_HOOK+0x336/0x3c0 [ 237.665842][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 237.665858][ C1] ? NF_HOOK+0x9e/0x3c0 [ 237.665873][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 237.665891][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 237.665907][ C1] ? ip_rcv_core+0x88d/0xd50 [ 237.665925][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 237.665942][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 237.665958][ C1] process_backlog+0xa6b/0x18b0 [ 237.665986][ C1] ? process_backlog+0x3de/0x18b0 [ 237.666016][ C1] __napi_poll+0xaa/0x330 [ 237.666040][ C1] net_rx_action+0x61d/0xf50 [ 237.666070][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 237.666093][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 237.666121][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 237.666151][ C1] handle_softirqs+0x226/0x860 [ 237.666172][ C1] ? do_softirq+0x77/0xd0 [ 237.666193][ C1] ? batadv_dat_purge+0x2d7/0x3c0 [ 237.666212][ C1] do_softirq+0x77/0xd0 [ 237.666230][ C1] [ 237.666235][ C1] [ 237.666241][ C1] __local_bh_enable_ip+0x100/0x140 [ 237.666261][ C1] batadv_dat_purge+0x2d7/0x3c0 [ 237.666283][ C1] ? process_scheduled_works+0x97a/0x1630 [ 237.666302][ C1] process_scheduled_works+0xc3d/0x1630 [ 237.666333][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 237.666351][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 237.666374][ C1] ? assign_work+0x3af/0x5d0 [ 237.666394][ C1] rescuer_thread+0x7c5/0x10e0 [ 237.666417][ C1] ? rescuer_thread+0xb8/0x10e0 [ 237.666446][ C1] kthread+0x38b/0x480 [ 237.666476][ C1] ? __pfx_rescuer_thread+0x10/0x10 [ 237.666496][ C1] ? __pfx_kthread+0x10/0x10 [ 237.666519][ C1] ret_from_fork+0x514/0xb70 [ 237.666542][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 237.666564][ C1] ? __switch_to+0xc89/0x1420 [ 237.666585][ C1] ? __pfx_kthread+0x10/0x10 [ 237.666608][ C1] ret_from_fork_asm+0x1a/0x30 [ 237.666637][ C1] [ 237.667273][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 240.741007][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 240.750144][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 240.760220][ T31] Call Trace: [ 240.763545][ T31] [ 240.766511][ T31] vpanic+0x56d/0xa70 [ 240.770537][ T31] ? __pfx_vpanic+0x10/0x10 [ 240.775074][ T31] ? console_srcu_read_unlock+0x3a/0x60 [ 240.780661][ T31] panic+0xc5/0xd0 [ 240.784419][ T31] ? __pfx_panic+0x10/0x10 [ 240.788891][ T31] ? wq_watchdog_touch+0xf9/0x160 [ 240.793944][ T31] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 240.800137][ T31] watchdog+0x10cc/0x10d0 [ 240.804511][ T31] ? watchdog+0x209/0x10d0 [ 240.808969][ T31] kthread+0x38b/0x480 [ 240.813075][ T31] ? __pfx_watchdog+0x10/0x10 [ 240.817781][ T31] ? __pfx_kthread+0x10/0x10 [ 240.822402][ T31] ret_from_fork+0x514/0xb70 [ 240.827035][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 240.832182][ T31] ? __switch_to+0xc89/0x1420 [ 240.836895][ T31] ? __pfx_kthread+0x10/0x10 [ 240.841514][ T31] ret_from_fork_asm+0x1a/0x30 [ 240.846327][ T31] [ 240.849507][ T31] Kernel Offset: disabled [ 240.853835][ T31] Rebooting in 86400 seconds..