last executing test programs: 5.21550073s ago: executing program 2 (id=3): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102400, 0x19000) syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') 4.172014103s ago: executing program 1 (id=2): syz_usb_connect(0x0, 0x29c, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000841b7420da040d39bb2d0102030109028a020100000000090408f80af179fa020f24020205000d000cf67df8e6988f0724014004000009050c0340"], 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(r0, 0xe, &(0x7f0000000100)={0x8, 0x4b55}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x8000000001, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019340)=""/102392, 0x18ff8) r4 = getpid() r5 = syz_pidfd_open(r4, 0x0) process_mrelease(r5, 0x0) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) r7 = socket$inet6(0xa, 0x2, 0x3a) syz_usb_connect$uac1(0x1, 0x0, 0x0, &(0x7f0000000980)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xd4, 0x5, 0xbd, 0x20, 0x8e}, 0x5, &(0x7f0000000480)={0x5, 0xf, 0x5}, 0x7, [{0x2, &(0x7f00000004c0)=@string={0x2}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x427}}, {0x69, &(0x7f0000000600)=@string={0x69, 0x3, "c2f03459a8d5364298fc9bdf8bc1276437bead11538f279ea60b46e81c2c72533fc3ee341377e06050dd6f024c8bc9709d18b0f0678b9cb36fd92e0305123d804656bdeb278ae707ad008a42c0a0a2d4afd3bf6405d50f35bd286f388bcc8a1b1dee0cbb516997"}}, {0xf5, &(0x7f0000000700)=@string={0xf5, 0x3, "d15cbf9d80522e0ed7ea798beb16a4d5529dd3e4fedeccc234517794ed6a3a8125572b9de61da1ec2b85443ab46b280cf99edd7ad68d8bf5247ad05b626d5ac9b835c7a148b363679e3fc47a5d62a717ba75ec5cde13d271994b56eba7ef739d737369b50d7a570bb23a3eb3f6d6ed8eae2d45bc46d7a790ec17b5d7c5dae69ad73640b92cd8926c9f508d6461cbd46b38281305787d188ecec86beb20b60934829fff7aa90fd1440fea5ecff8a087e4b4e47a5d7b44066f3f8f24caacb78dcdd8c88a0625a5fc1b0168b717c52db9e17451557b2908f394b55ff15621a3fe1c8a3a17bcbad6cd5a739493d1f69f13fc9854b5"}}, {0x46, &(0x7f0000000800)=@string={0x46, 0x3, "d7d0743e8f02c71ae0f0e98670dd93f063bdafce28198fcf11dc4b2365b2259bd679d78544119661650231684c70b6ffd9c42b05f20703ca0d63e63676f7163ec3bd16f6"}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x447}}, {0x77, &(0x7f00000008c0)=@string={0x77, 0x3, "ef7ad05cff2104e019622de2f6c29b82b68a849d901a904ec4ca0f1e4d982150ed84bc384e5e4a40fa9dd7a9f7cedca8479d36d2c6f4dbff24ee2b99ea7a8a7dfc75b001cf99b50f3f43ac6c8252297371f76178f19c1f79e5bfc750b1ac84c301abfb3bbe2ae3a43e47fa805fcb867fd3909ab3ce"}}]}) setsockopt$inet6_int(r7, 0x29, 0x42, 0x0, 0x0) recvmsg(r7, 0x0, 0x40002020) 3.465924141s ago: executing program 2 (id=6): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602ffa100000e000a000f000000028000001294", 0x2e}], 0x1}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$unix(0x1, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd700000dcdf250700000008000300", @ANYRES32=r6, @ANYBLOB="0c00990040000000560000001400040073797a6b616c6c657230000000000000080005000a000000"], 0x44}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) 2.853127922s ago: executing program 2 (id=8): openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) 2.834947952s ago: executing program 3 (id=4): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001e40)=""/104, 0x68}], 0x1}, 0x2}], 0x1, 0x40000000, 0x0) sendmmsg$inet6(r0, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)='3', 0x1}, {&(0x7f0000000100)="127d589163267e4b0eda2e4186729989fdd2e24baac09a37b374a16c27a136d37e08121d3864d6559759e5bfba0a1c8b2c7d20228827e09902302ddc29760ee36ce64699", 0x44}], 0x2}}], 0x1, 0x20e8086) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 2.415675549s ago: executing program 0 (id=9): pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) 2.115111734s ago: executing program 0 (id=10): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000200)="9902000012006b9c9e3fe3d86e6c1d0000147ea60864160af36504b68675f8001d000a00a0e69ee517d24460bc24eab556a705251e6182949a36c2151fef08d8cdbf9367b41ad206000000f408000300040100000800050000000000", 0x5c}, {&(0x7f00000000c0)="d557fc16674b56c0a96a733c232d6790c63ca969a688b06e3da58f3c4568bf0a77bdff6f41d7890e18defe94ef1a392dc00dea94a1bfe64982de7cf1c91e1103cc1840210cbb57222bc2bfa30369992a6bc5156c00aeadd359a7991ad1de01feec401dba6d7694a14785839d3c2d67188cd07827c934897de4676743c192c4a4b24f7f8747141a1325d29da89694574c32eba56e5bbc8f80376f3325dd89937e990089294183a4829e21849004c538378d41066cb7de399450b3544067", 0xbd}, {&(0x7f0000000280)="5e191aea3468a5eab1c3d6024b43dece099475c81c53aa9244d866f68b8e31e93b41b432fb0454234620a25706bfb6f01ce01093b7ff634785d8b345ef8f7a928034820bbd37467d1049ac7a724c153c358d6f7efd919bb918734e846598b03733a6f4bbce06471d3a440e14dae67170cbfea76bc33481c28ec2cfad1f3d83ddece3006d5bb30dc4288dd40bd476cc7f94d143c56e54ed4d84b9c1ecc87fc035c7c992767edcfe2218bc6542a6a3a9b879e8aa6d652d277ee640cc15d2e9efe30584ed57ab208ca4db6cf63381804a5ee5950020", 0xd4}, {&(0x7f00000017c0)="fd7617adb877574c4a4489fcaccde0c97bdb2d9d89dba8ab9fc9ebbdcedc770661e1971989a787890de32eebe4008ac8bfafa034add91f6ea4acc741521abecc6cbb4fcfeb61d7d08a8911e59550055d17897194afc1ffd04c18c2506d41bec374a6e5b1ed5fd07db55483fef2dc9ad8ae7c6044b08a303f256ff7e7dd720c72fc0d513110468d44e31a8fc9833d521b95c3b04378ca1c67b4faca350009045628c7f7196510f14ebdc68ba7", 0xac}], 0x4, 0x0, 0x0, 0x1f00c00e}, 0x0) 2.029236027s ago: executing program 0 (id=11): r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000c80)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.890458844s ago: executing program 0 (id=12): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0x200, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x1, 0x10000, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x6}, 0x1c) sendmmsg$inet(r0, &(0x7f00000081c0)=[{{&(0x7f0000000a40)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000cc0)=[{&(0x7f0000000a80)='p', 0x1}], 0x1}}, {{&(0x7f0000001f80)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10, &(0x7f0000003140)=[{&(0x7f0000001fc0)="8f", 0x1}], 0x1}}], 0x2, 0x40840) 1.607395202s ago: executing program 2 (id=13): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "dbdc27ff", "16de86d67a8426bd"}, 0x28) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0000}]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 1.426960209s ago: executing program 0 (id=14): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) listen(r0, 0xfff) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r1, 0x5) r2 = socket$inet(0xa, 0x801, 0x84) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) listen(r2, 0xfffffffd) r4 = socket$inet(0xa, 0x801, 0x84) listen(0xffffffffffffffff, 0x8) listen(r4, 0x1) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r5) 1.237377126s ago: executing program 3 (id=15): r0 = inotify_init1(0x80000) r1 = inotify_add_watch(r0, &(0x7f0000000200)='.\x00', 0x400) r2 = dup(r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x86}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) inotify_rm_watch(r2, r1) 542.36605ms ago: executing program 0 (id=16): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r2}, 0x10) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r1, &(0x7f0000000080), 0x10) 20.009073ms ago: executing program 2 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB='g\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010126bd70211c1c33bf92e5bd0008000300", @ANYRES32], 0x74}, 0x1, 0x0, 0x0, 0x4c080}, 0x4010) 0s ago: executing program 1 (id=18): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/mdstat\x00', 0x0, 0x0) syz_open_dev$media(&(0x7f00000000c0), 0x103, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) connect$inet(r0, &(0x7f0000000c80)={0x2, 0x4e21, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.7' (ED25519) to the list of known hosts. [ 92.056545][ T10] cfg80211: failed to load regulatory.db [ 93.025103][ T5596] cgroup: Unknown subsys name 'net' [ 93.265395][ T5596] cgroup: Unknown subsys name 'cpuset' [ 93.319704][ T5596] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.328228][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.038115][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.064747][ T5619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 98.087239][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 98.091320][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 98.099122][ T5617] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 98.111418][ T5623] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.115545][ T5623] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.122525][ T5623] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 98.131114][ T5617] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 98.161229][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 98.167687][ T5626] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 98.175613][ T5626] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.181874][ T5626] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 98.184888][ T5626] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.192552][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 98.198929][ T5626] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 98.206691][ T5626] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 98.227504][ T5626] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 98.234060][ T5626] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 98.234069][ T4925] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 100.273362][ T60] Bluetooth: hci0: command tx timeout [ 100.349498][ T60] Bluetooth: hci2: command tx timeout [ 100.350868][ T60] Bluetooth: hci3: command tx timeout [ 100.430181][ T60] Bluetooth: hci1: command tx timeout [ 100.499480][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.499731][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.499987][ T5613] bridge_slave_0: entered allmulticast mode [ 100.517496][ T5613] bridge_slave_0: entered promiscuous mode [ 100.577189][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.577422][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.577640][ T5613] bridge_slave_1: entered allmulticast mode [ 100.597444][ T5613] bridge_slave_1: entered promiscuous mode [ 100.665041][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.665350][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.665971][ T5616] bridge_slave_0: entered allmulticast mode [ 100.669027][ T5616] bridge_slave_0: entered promiscuous mode [ 100.741565][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.742023][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.742320][ T5616] bridge_slave_1: entered allmulticast mode [ 100.745097][ T5616] bridge_slave_1: entered promiscuous mode [ 100.811805][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.839235][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.839514][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.839759][ T5614] bridge_slave_0: entered allmulticast mode [ 100.842518][ T5614] bridge_slave_0: entered promiscuous mode [ 100.886511][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.957395][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.957814][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.958098][ T5614] bridge_slave_1: entered allmulticast mode [ 100.971867][ T5614] bridge_slave_1: entered promiscuous mode [ 100.987555][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.987798][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.988005][ T5615] bridge_slave_0: entered allmulticast mode [ 100.995454][ T5615] bridge_slave_0: entered promiscuous mode [ 101.041017][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.068296][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.068554][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.068792][ T5615] bridge_slave_1: entered allmulticast mode [ 101.081199][ T5615] bridge_slave_1: entered promiscuous mode [ 101.117996][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.166226][ T5613] team0: Port device team_slave_0 added [ 101.198224][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.227849][ T5613] team0: Port device team_slave_1 added [ 101.255573][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.264097][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.297975][ T5616] team0: Port device team_slave_0 added [ 101.329281][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.364806][ T5616] team0: Port device team_slave_1 added [ 101.413500][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.413515][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.413535][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.476011][ T5614] team0: Port device team_slave_0 added [ 101.506306][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.506320][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.506340][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.564416][ T5614] team0: Port device team_slave_1 added [ 101.567747][ T5615] team0: Port device team_slave_0 added [ 101.594689][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.594702][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.594722][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.654428][ T5615] team0: Port device team_slave_1 added [ 101.658728][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.658742][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.658762][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.759317][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.759335][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.759364][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.841599][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.841613][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.841633][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.843579][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.843591][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.843610][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.950510][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.950523][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.950549][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.972834][ T5613] hsr_slave_0: entered promiscuous mode [ 101.987967][ T5613] hsr_slave_1: entered promiscuous mode [ 102.350775][ T60] Bluetooth: hci0: command tx timeout [ 102.355657][ T5616] hsr_slave_0: entered promiscuous mode [ 102.357252][ T5616] hsr_slave_1: entered promiscuous mode [ 102.358699][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 102.358793][ T5616] Cannot create hsr debugfs directory [ 102.439180][ T5626] Bluetooth: hci2: command tx timeout [ 102.439307][ T60] Bluetooth: hci3: command tx timeout [ 102.501073][ T5614] hsr_slave_0: entered promiscuous mode [ 102.502724][ T5614] hsr_slave_1: entered promiscuous mode [ 102.503979][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 102.504004][ T5614] Cannot create hsr debugfs directory [ 102.509829][ T60] Bluetooth: hci1: command tx timeout [ 102.593608][ T5615] hsr_slave_0: entered promiscuous mode [ 102.595167][ T5615] hsr_slave_1: entered promiscuous mode [ 102.596457][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 102.596483][ T5615] Cannot create hsr debugfs directory [ 103.492715][ T5613] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.568172][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.584683][ T5613] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.605771][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.618330][ T5613] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.645429][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.674676][ T5613] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.694830][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.840843][ T5616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 103.875507][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.890929][ T5616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 103.925160][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.935386][ T5616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 103.977687][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.011013][ T5616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.058833][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.248191][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.278287][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.314647][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.357368][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.387598][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.424656][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.429306][ T60] Bluetooth: hci0: command tx timeout [ 104.446647][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.484419][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.509712][ T5626] Bluetooth: hci2: command tx timeout [ 104.510014][ T60] Bluetooth: hci3: command tx timeout [ 104.589895][ T60] Bluetooth: hci1: command tx timeout [ 104.675683][ T5614] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 104.715089][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.732000][ T5614] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 104.776764][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.795565][ T5614] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 104.834301][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.854546][ T5614] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 104.905646][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.053322][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.228306][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.266202][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.304290][ T1307] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.304671][ T1307] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.374478][ T169] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.374623][ T169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.464618][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.517630][ T169] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.517849][ T169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.545099][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.585396][ T169] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.585581][ T169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.697831][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.759926][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.782767][ T169] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.782948][ T169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.880599][ T1289] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.880767][ T1289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.974883][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.058505][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.058753][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.148394][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.148583][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.509251][ T60] Bluetooth: hci0: command tx timeout [ 106.589517][ T5626] Bluetooth: hci2: command tx timeout [ 106.589572][ T60] Bluetooth: hci3: command tx timeout [ 106.670447][ T60] Bluetooth: hci1: command tx timeout [ 107.045768][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.517633][ T5613] veth0_vlan: entered promiscuous mode [ 107.575542][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.635831][ T5613] veth1_vlan: entered promiscuous mode [ 107.878217][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.924598][ T5613] veth0_macvtap: entered promiscuous mode [ 108.016262][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.052652][ T5613] veth1_macvtap: entered promiscuous mode [ 108.083961][ T5616] veth0_vlan: entered promiscuous mode [ 108.174775][ T5616] veth1_vlan: entered promiscuous mode [ 108.206866][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.265944][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.337687][ T1027] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.372179][ T5615] veth0_vlan: entered promiscuous mode [ 108.373263][ T1027] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.397466][ T1027] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.423288][ T1027] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.522790][ T5614] veth0_vlan: entered promiscuous mode [ 108.537358][ T5615] veth1_vlan: entered promiscuous mode [ 108.609410][ T5616] veth0_macvtap: entered promiscuous mode [ 108.701759][ T5614] veth1_vlan: entered promiscuous mode [ 108.769503][ T5616] veth1_macvtap: entered promiscuous mode [ 108.942652][ T1027] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.942675][ T1027] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.971296][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.028369][ T5615] veth0_macvtap: entered promiscuous mode [ 109.056736][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.109284][ T5615] veth1_macvtap: entered promiscuous mode [ 109.145665][ T1316] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.171591][ T1316] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.176512][ T5614] veth0_macvtap: entered promiscuous mode [ 109.176580][ T163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.176597][ T163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.214824][ T1316] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.240005][ T1316] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.381231][ T5614] veth1_macvtap: entered promiscuous mode [ 109.426064][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.497252][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.716568][ T163] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.748981][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.750937][ T163] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.778882][ T163] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.794888][ T163] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.827404][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.827427][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.864887][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.079366][ T180] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.086696][ T180] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.134463][ T180] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.198686][ T180] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.429366][ T169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.429388][ T169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.958299][ T180] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.958323][ T180] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.247006][ T169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.247027][ T169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.806843][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.806866][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.290265][ T1521] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.290298][ T1521] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.062813][ T5771] netlink: 'syz.2.6': attribute type 10 has an invalid length. [ 113.263104][ T5771] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.324984][ T5771] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 113.371001][ T5775] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 113.712046][ T824] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 114.069116][ T824] usb 2-1: Using ep0 maxpacket: 32 [ 114.195609][ T824] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 114.195640][ T824] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 114.195659][ T824] usb 2-1: config 0 has no interface number 0 [ 114.195706][ T824] usb 2-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 7 [ 114.195735][ T824] usb 2-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 114.195764][ T824] usb 2-1: config 0 interface 8 has no altsetting 0 [ 114.242449][ T824] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 114.242541][ T824] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 114.242598][ T824] usb 2-1: Product: syz [ 114.242653][ T824] usb 2-1: Manufacturer: syz [ 114.242707][ T824] usb 2-1: SerialNumber: syz [ 114.710494][ T824] usb 2-1: config 0 descriptor?? [ 115.162221][ T5782] syz.3.4 (5782) used greatest stack depth: 18640 bytes left [ 117.432087][ T824] ------------[ cut here ]------------ [ 117.432103][ T824] workqueue: ath6kl_wq is using neither WQ_PERCPU or WQ_UNBOUND. Setting WQ_PERCPU. [ 117.432121][ T824] WARNING: kernel/workqueue.c:5856 at __alloc_workqueue+0x1d02/0x2070, CPU#1: kworker/1:2/824 [ 117.432168][ T824] Modules linked in: [ 117.432236][ T824] CPU: 1 UID: 0 PID: 824 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 117.432262][ T824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 117.432278][ T824] Workqueue: usb_hub_wq hub_event [ 117.432311][ T824] RIP: 0010:__alloc_workqueue+0x1d07/0x2070 [ 117.432339][ T824] Code: e9 36 f9 ff ff e8 89 8a 37 00 e9 05 fb ff ff e8 7f 8a 37 00 e9 92 fb ff ff e8 75 8a 37 00 48 8d 3d ee ff 43 0e 48 8b 74 24 20 <67> 48 0f b9 3a 81 cd 00 01 00 00 e9 88 e5 ff ff e8 54 8a 37 00 48 [ 117.432359][ T824] RSP: 0018:ffffc9000535ebc8 EFLAGS: 00010287 [ 117.432380][ T824] RAX: ffffffff818e412b RBX: 0000000000000000 RCX: 0000000000100000 [ 117.432405][ T824] RDX: ffffc90018b5f000 RSI: ffff88803bd54568 RDI: ffffffff8fd24120 [ 117.432422][ T824] RBP: 0000000000000000 R08: ffff888025cc0000 R09: 0000000000000002 [ 117.432436][ T824] R10: 0000000000000100 R11: 0000000000000102 R12: dffffc0000000000 [ 117.432452][ T824] R13: ffff88803bd54400 R14: ffffc9000535ece0 R15: 0000000000000000 [ 117.432469][ T824] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 117.432487][ T824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 117.432504][ T824] CR2: 0000200000001000 CR3: 0000000031c16000 CR4: 00000000003526f0 [ 117.432546][ T824] Call Trace: [ 117.432560][ T824] [ 117.432589][ T824] alloc_workqueue_noprof+0xe3/0x210 [ 117.432626][ T824] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 117.432659][ T824] ? __kmalloc_cache_noprof+0x3d0/0x6d0 [ 117.432686][ T824] ? ath6kl_usb_probe+0x8e/0x1580 [ 117.432732][ T824] ath6kl_usb_probe+0xaa/0x1580 [ 117.432775][ T824] ? usb_unlocked_disable_lpm+0x8c/0xb0 [ 117.432813][ T824] usb_probe_interface+0x659/0xc70 [ 117.432859][ T824] ? __pfx_usb_probe_interface+0x10/0x10 [ 117.432888][ T824] really_probe+0x267/0xaf0 [ 117.432929][ T824] __driver_probe_device+0x1e2/0x350 [ 117.432964][ T824] driver_probe_device+0x4f/0x240 [ 117.433001][ T824] __device_attach_driver+0x270/0x410 [ 117.433038][ T824] bus_for_each_drv+0x25b/0x2f0 [ 117.433062][ T824] ? __pfx___device_attach_driver+0x10/0x10 [ 117.433095][ T824] ? __pfx_bus_for_each_drv+0x10/0x10 [ 117.433119][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.433153][ T824] __device_attach+0x2c8/0x450 [ 117.433184][ T824] ? __pfx___device_attach+0x10/0x10 [ 117.433214][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.433245][ T824] device_initial_probe+0xa1/0xd0 [ 117.433283][ T824] bus_probe_device+0x12d/0x220 [ 117.433309][ T824] device_add+0x7ec/0xb90 [ 117.433340][ T824] usb_set_configuration+0x1a87/0x2110 [ 117.433427][ T824] usb_generic_driver_probe+0x8d/0x150 [ 117.433460][ T824] usb_probe_device+0x1c4/0x3b0 [ 117.433496][ T824] ? __pfx_usb_probe_device+0x10/0x10 [ 117.433525][ T824] really_probe+0x267/0xaf0 [ 117.433565][ T824] __driver_probe_device+0x1e2/0x350 [ 117.433602][ T824] driver_probe_device+0x4f/0x240 [ 117.433639][ T824] __device_attach_driver+0x270/0x410 [ 117.433675][ T824] bus_for_each_drv+0x25b/0x2f0 [ 117.433700][ T824] ? __pfx___device_attach_driver+0x10/0x10 [ 117.433734][ T824] ? __pfx_bus_for_each_drv+0x10/0x10 [ 117.433758][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.433790][ T824] __device_attach+0x2c8/0x450 [ 117.433824][ T824] ? __pfx___device_attach+0x10/0x10 [ 117.433855][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.433886][ T824] device_initial_probe+0xa1/0xd0 [ 117.433920][ T824] bus_probe_device+0x12d/0x220 [ 117.433948][ T824] device_add+0x7ec/0xb90 [ 117.433981][ T824] usb_new_device+0x9f8/0x16e0 [ 117.434018][ T824] ? __pfx_usb_new_device+0x10/0x10 [ 117.434052][ T824] hub_event+0x2a49/0x4f60 [ 117.434134][ T824] ? __pfx_hub_event+0x10/0x10 [ 117.434161][ T824] ? process_one_work+0x8be/0x1630 [ 117.434208][ T824] ? process_one_work+0x8be/0x1630 [ 117.434240][ T824] process_one_work+0x98b/0x1630 [ 117.434299][ T824] ? __pfx_process_one_work+0x10/0x10 [ 117.434332][ T824] ? do_raw_spin_lock+0x12b/0x2f0 [ 117.434377][ T824] worker_thread+0xb49/0x1140 [ 117.434457][ T824] kthread+0x388/0x470 [ 117.434485][ T824] ? __pfx_worker_thread+0x10/0x10 [ 117.434518][ T824] ? __pfx_kthread+0x10/0x10 [ 117.434547][ T824] ret_from_fork+0x514/0xb70 [ 117.434579][ T824] ? __pfx_ret_from_fork+0x10/0x10 [ 117.434606][ T824] ? __switch_to+0xc79/0x1410 [ 117.434633][ T824] ? __pfx_kthread+0x10/0x10 [ 117.434662][ T824] ret_from_fork_asm+0x1a/0x30 [ 117.434711][ T824] [ 117.434723][ T824] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 117.434740][ T824] CPU: 1 UID: 0 PID: 824 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 117.434766][ T824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 117.434781][ T824] Workqueue: usb_hub_wq hub_event [ 117.434809][ T824] Call Trace: [ 117.434817][ T824] [ 117.434827][ T824] vpanic+0x56c/0xa60 [ 117.434861][ T824] ? __pfx__printk+0x10/0x10 [ 117.434889][ T824] ? __pfx_vpanic+0x10/0x10 [ 117.434921][ T824] ? is_bpf_text_address+0x292/0x2b0 [ 117.434955][ T824] ? is_bpf_text_address+0x26/0x2b0 [ 117.434992][ T824] panic+0xc5/0xd0 [ 117.435023][ T824] ? __pfx_panic+0x10/0x10 [ 117.435073][ T824] ? ret_from_fork_asm+0x1a/0x30 [ 117.435111][ T824] __warn+0x315/0x4c0 [ 117.435142][ T824] ? __alloc_workqueue+0x1d02/0x2070 [ 117.435171][ T824] ? __alloc_workqueue+0x1d02/0x2070 [ 117.435199][ T824] __report_bug+0x339/0x540 [ 117.435228][ T824] ? __device_attach+0x2c8/0x450 [ 117.435256][ T824] ? device_initial_probe+0xa1/0xd0 [ 117.435284][ T824] ? bus_probe_device+0x12d/0x220 [ 117.435310][ T824] ? __alloc_workqueue+0x1d02/0x2070 [ 117.435338][ T824] ? __pfx___report_bug+0x10/0x10 [ 117.435367][ T824] ? device_add+0x7ec/0xb90 [ 117.435426][ T824] report_bug_entry+0x19a/0x290 [ 117.435460][ T824] ? __alloc_workqueue+0x1d07/0x2070 [ 117.435486][ T824] ? __alloc_workqueue+0x1d0c/0x2070 [ 117.435514][ T824] handle_bug+0xce/0x200 [ 117.435550][ T824] exc_invalid_op+0x1a/0x50 [ 117.435585][ T824] asm_exc_invalid_op+0x1a/0x20 [ 117.435609][ T824] RIP: 0010:__alloc_workqueue+0x1d07/0x2070 [ 117.435639][ T824] Code: e9 36 f9 ff ff e8 89 8a 37 00 e9 05 fb ff ff e8 7f 8a 37 00 e9 92 fb ff ff e8 75 8a 37 00 48 8d 3d ee ff 43 0e 48 8b 74 24 20 <67> 48 0f b9 3a 81 cd 00 01 00 00 e9 88 e5 ff ff e8 54 8a 37 00 48 [ 117.435659][ T824] RSP: 0018:ffffc9000535ebc8 EFLAGS: 00010287 [ 117.435680][ T824] RAX: ffffffff818e412b RBX: 0000000000000000 RCX: 0000000000100000 [ 117.435697][ T824] RDX: ffffc90018b5f000 RSI: ffff88803bd54568 RDI: ffffffff8fd24120 [ 117.435716][ T824] RBP: 0000000000000000 R08: ffff888025cc0000 R09: 0000000000000002 [ 117.435731][ T824] R10: 0000000000000100 R11: 0000000000000102 R12: dffffc0000000000 [ 117.435748][ T824] R13: ffff88803bd54400 R14: ffffc9000535ece0 R15: 0000000000000000 [ 117.435775][ T824] ? __alloc_workqueue+0x1cfb/0x2070 [ 117.435811][ T824] ? __alloc_workqueue+0x1cfb/0x2070 [ 117.435857][ T824] alloc_workqueue_noprof+0xe3/0x210 [ 117.435894][ T824] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 117.435926][ T824] ? __kmalloc_cache_noprof+0x3d0/0x6d0 [ 117.435954][ T824] ? ath6kl_usb_probe+0x8e/0x1580 [ 117.436001][ T824] ath6kl_usb_probe+0xaa/0x1580 [ 117.436044][ T824] ? usb_unlocked_disable_lpm+0x8c/0xb0 [ 117.436082][ T824] usb_probe_interface+0x659/0xc70 [ 117.436128][ T824] ? __pfx_usb_probe_interface+0x10/0x10 [ 117.436158][ T824] really_probe+0x267/0xaf0 [ 117.436200][ T824] __driver_probe_device+0x1e2/0x350 [ 117.436242][ T824] driver_probe_device+0x4f/0x240 [ 117.436280][ T824] __device_attach_driver+0x270/0x410 [ 117.436318][ T824] bus_for_each_drv+0x25b/0x2f0 [ 117.436342][ T824] ? __pfx___device_attach_driver+0x10/0x10 [ 117.436376][ T824] ? __pfx_bus_for_each_drv+0x10/0x10 [ 117.436407][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.436439][ T824] __device_attach+0x2c8/0x450 [ 117.436473][ T824] ? __pfx___device_attach+0x10/0x10 [ 117.436507][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.436539][ T824] device_initial_probe+0xa1/0xd0 [ 117.436574][ T824] bus_probe_device+0x12d/0x220 [ 117.436602][ T824] device_add+0x7ec/0xb90 [ 117.436635][ T824] usb_set_configuration+0x1a87/0x2110 [ 117.436698][ T824] usb_generic_driver_probe+0x8d/0x150 [ 117.436730][ T824] usb_probe_device+0x1c4/0x3b0 [ 117.436766][ T824] ? __pfx_usb_probe_device+0x10/0x10 [ 117.436795][ T824] really_probe+0x267/0xaf0 [ 117.436836][ T824] __driver_probe_device+0x1e2/0x350 [ 117.436871][ T824] driver_probe_device+0x4f/0x240 [ 117.436908][ T824] __device_attach_driver+0x270/0x410 [ 117.436946][ T824] bus_for_each_drv+0x25b/0x2f0 [ 117.436971][ T824] ? __pfx___device_attach_driver+0x10/0x10 [ 117.437003][ T824] ? __pfx_bus_for_each_drv+0x10/0x10 [ 117.437028][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.437057][ T824] __device_attach+0x2c8/0x450 [ 117.437088][ T824] ? __pfx___device_attach+0x10/0x10 [ 117.437118][ T824] ? rt_spin_unlock+0x160/0x200 [ 117.437148][ T824] device_initial_probe+0xa1/0xd0 [ 117.437181][ T824] bus_probe_device+0x12d/0x220 [ 117.437209][ T824] device_add+0x7ec/0xb90 [ 117.437241][ T824] usb_new_device+0x9f8/0x16e0 [ 117.437277][ T824] ? __pfx_usb_new_device+0x10/0x10 [ 117.437312][ T824] hub_event+0x2a49/0x4f60 [ 117.437406][ T824] ? __pfx_hub_event+0x10/0x10 [ 117.437435][ T824] ? process_one_work+0x8be/0x1630 [ 117.437484][ T824] ? process_one_work+0x8be/0x1630 [ 117.437517][ T824] process_one_work+0x98b/0x1630 [ 117.437577][ T824] ? __pfx_process_one_work+0x10/0x10 [ 117.437610][ T824] ? do_raw_spin_lock+0x12b/0x2f0 [ 117.437656][ T824] worker_thread+0xb49/0x1140 [ 117.437723][ T824] kthread+0x388/0x470 [ 117.437751][ T824] ? __pfx_worker_thread+0x10/0x10 [ 117.437785][ T824] ? __pfx_kthread+0x10/0x10 [ 117.437814][ T824] ret_from_fork+0x514/0xb70 [ 117.437846][ T824] ? __pfx_ret_from_fork+0x10/0x10 [ 117.437874][ T824] ? __switch_to+0xc79/0x1410 [ 117.437902][ T824] ? __pfx_kthread+0x10/0x10 [ 117.437930][ T824] ret_from_fork_asm+0x1a/0x30 [ 117.437982][ T824] [ 117.438603][ T824] Kernel Offset: disabled