last executing test programs: 14.310076913s ago: executing program 3 (id=5): rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}, 0x20, 0x1, 0x0) 14.223176159s ago: executing program 3 (id=6): sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r3, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) 12.9236308s ago: executing program 0 (id=1): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 9.620427203s ago: executing program 3 (id=14): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="4c01000010000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb0000fff720000001000000003b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000004000000000000000000000000000000000000000080000004000000000000000000004000000000000000000000000000000000000000000000000025bd70000000000002000001000000000000000008001f0004000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f00"], 0x14c}}, 0x4810) 8.966600354s ago: executing program 0 (id=7): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000080)=0x1, 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000340)=0x3, 0x4) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00001bbbbbbbbbbbbbaaaaaaaaaa2986dd6d002008001811ff20010000000000000000000000000001ff0200000000000000000000000000014f194e20"], 0x52) 8.966440329s ago: executing program 3 (id=8): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a05630000000000000109"], 0x0) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) 6.697144745s ago: executing program 0 (id=9): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000004c0)={0x84, &(0x7f0000000140)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x0, 0x13, 0x2, "067b"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.693039538s ago: executing program 3 (id=11): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r0) eventfd2(0x8, 0x1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1000000000fe, 0x0) 5.421801517s ago: executing program 2 (id=12): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x41, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r0}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 5.355880269s ago: executing program 1 (id=13): r0 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) write$binfmt_register(r0, 0x0, 0x0) 5.241153441s ago: executing program 1 (id=15): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000c80)=@broute={'broute\x00', 0x20, 0x2, 0x12e, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000008c0], 0x0, 0x0, &(0x7f00000008c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{0x9, 0x60, 0x3, 'rose0\x00', 'veth1_vlan\x00', 'ipvlan0\x00', 'macvtap0\x00', @empty, [0xff, 0x0, 0xff, 0xff], @broadcast, [0xff], 0x6e, 0x6e, 0x9e, [], [], @common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffd}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc}, {0x0, '\x00', 0x2, 0xffffffffffffffff}]}, 0x1a6) 5.194680169s ago: executing program 2 (id=16): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a00)={'syz0\x00', {0x6, 0x7, 0x5, 0x7}, 0x3f, [0x6, 0x10000002, 0x18, 0x2, 0x8, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x40000001, 0x7, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xffffffeb, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x7, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2a, 0x200, 0x2, 0x5, 0x2000000e, 0x6, 0x2, 0x8000006f, 0x8, 0x405, 0x80000000, 0x199d, 0x6, 0x3, 0xffffffff, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0x9, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x2, 0x25, 0xa, 0xfffffffc, 0x8, 0x7fff, 0x729, 0x1c32, 0x3, 0x2, 0x10000, 0x400, 0x7ffd, 0x5, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x14, 0xfffffff7, 0xfffffffd, 0x7, 0x9, 0xffffffff, 0x6, 0x4, 0x800, 0x0, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x37a, 0x9, 0xe, 0x5, 0x7, 0x6, 0x6, 0x1, 0x1, 0xe, 0x20007, 0x200, 0x3], [0x1, 0x8000c584, 0xffff, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0xffff0000, 0x3f92, 0x1000, 0x0, 0x6611, 0x6, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x8, 0x6, 0x200003, 0x1, 0x5, 0x80, 0x8, 0x8001, 0x10000, 0x4, 0x4, 0x400004, 0x3, 0x7, 0x3, 0x8, 0xb3c, 0xbf23, 0x6, 0x20005, 0x956, 0x0, 0x3ff, 0x80000e, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0x1000, 0x9, 0x7fffffff, 0x3, 0x80, 0x0, 0x7d, 0x401, 0x5], [0x80108e, 0xffff, 0x3, 0x3, 0x88, 0x80000002, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x2402, 0x1, 0x5, 0x1000, 0x7f, 0x5, 0x8, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4004, 0x20008, 0x8a5, 0x7fff, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xfffffff7, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xffffffff, 0xd, 0x5, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) 5.114388892s ago: executing program 1 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x50, r1, 0x1, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x1341}, @NL80211_ATTR_FRAME={0x29, 0x33, @auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x2}, @broadcast, @device_a, @random="f0a2baa43dcf", {0x3, 0x10}, @value=@ver_80211n={0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}}, 0x1, 0x2, 0x5d, @val={0x10, 0x1, 0x31}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8616b9850ddcf752) 4.612885871s ago: executing program 1 (id=18): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat(0xffffffffffffff9c, 0x0, 0x40, 0x1) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r1 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r1, 0x800799c) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0x19) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read(r2, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 3.938812228s ago: executing program 2 (id=19): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r2 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(0x0, r3) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000003c0)={0x14, r4, 0x5, 0xd00, 0x0, {0x22}}, 0x14}}, 0x4000000) readv(r1, &(0x7f0000000340)=[{0x0}], 0x1) r5 = syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) r6 = dup(r5) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$XFS_IOC_ERROR_INJECTION(r6, 0x40085874, &(0x7f00000000c0)={r7}) read(r6, &(0x7f0000000040), 0x0) ioctl$VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000000)={0xf0f046}) tkill(r2, 0xb) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r8 = inotify_init1(0x0) inotify_add_watch(r8, &(0x7f0000000040)='./file1\x00', 0x7f7) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 3.141615954s ago: executing program 1 (id=20): socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$FUSE(r0, &(0x7f0000002280)={0x2020}, 0x2020) 2.017233962s ago: executing program 3 (id=21): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xc) r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='1\x00', 0x2) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011900000000406a05630000000000000109"], 0x0) write$sysctl(r0, &(0x7f00000000c0)='2\x00', 0x2) 1.776588223s ago: executing program 1 (id=22): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) msgget$private(0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x7fff, 0x400) syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.493873987s ago: executing program 2 (id=23): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000600)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x220002, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000080)) 1.326046783s ago: executing program 0 (id=24): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="04"], 0x40) 1.216350475s ago: executing program 2 (id=25): gettid() r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x8000) read(r0, &(0x7f0000000200)=""/209, 0xd1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) 560.565484ms ago: executing program 2 (id=26): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f00000005c0)=&(0x7f0000000580)) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000180)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000300)=""/78, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) 0s ago: executing program 0 (id=27): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000004c0)={'veth0_to_bond\x00', 0x4000}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.71' (ED25519) to the list of known hosts. [ 76.084860][ T5604] cgroup: Unknown subsys name 'net' [ 76.315580][ T5604] cgroup: Unknown subsys name 'cpuset' [ 76.382027][ T5604] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.098859][ T5604] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.486281][ T4932] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 80.525683][ T5627] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.526562][ T5627] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 80.553761][ T5631] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.555144][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.585473][ T5631] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 80.588709][ T5631] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.589709][ T5632] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.594242][ T5627] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.595126][ T5631] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 80.598550][ T5631] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.598920][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.604696][ T5632] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.611669][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.637102][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.643388][ T5620] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.683491][ T5620] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.714959][ T5620] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.721020][ T5620] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.737297][ T5620] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.733313][ T4932] Bluetooth: hci1: command tx timeout [ 82.733624][ T5623] Bluetooth: hci2: command tx timeout [ 82.804998][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.806255][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.807123][ T5616] bridge_slave_0: entered allmulticast mode [ 82.808925][ T5616] bridge_slave_0: entered promiscuous mode [ 82.811903][ T4932] Bluetooth: hci3: command tx timeout [ 82.812082][ T5623] Bluetooth: hci0: command tx timeout [ 82.886478][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.886717][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.886981][ T5616] bridge_slave_1: entered allmulticast mode [ 82.888943][ T5616] bridge_slave_1: entered promiscuous mode [ 82.962158][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.962318][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.962460][ T5618] bridge_slave_0: entered allmulticast mode [ 82.964281][ T5618] bridge_slave_0: entered promiscuous mode [ 82.965974][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.966237][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.966485][ T5617] bridge_slave_0: entered allmulticast mode [ 82.968561][ T5617] bridge_slave_0: entered promiscuous mode [ 83.035287][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.035582][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.035817][ T5618] bridge_slave_1: entered allmulticast mode [ 83.037840][ T5618] bridge_slave_1: entered promiscuous mode [ 83.038857][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.039020][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.039197][ T5617] bridge_slave_1: entered allmulticast mode [ 83.041855][ T5617] bridge_slave_1: entered promiscuous mode [ 83.045637][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.045911][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.046153][ T5615] bridge_slave_0: entered allmulticast mode [ 83.049930][ T5615] bridge_slave_0: entered promiscuous mode [ 83.067297][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.124254][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.124827][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.126731][ T5615] bridge_slave_1: entered allmulticast mode [ 83.129829][ T5615] bridge_slave_1: entered promiscuous mode [ 83.140619][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.215640][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.219905][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.409270][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.420160][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.429820][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.439343][ T5616] team0: Port device team_slave_0 added [ 83.474409][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.477468][ T5616] team0: Port device team_slave_1 added [ 83.546770][ T5618] team0: Port device team_slave_0 added [ 83.549626][ T5617] team0: Port device team_slave_0 added [ 83.586942][ T5618] team0: Port device team_slave_1 added [ 83.589387][ T5617] team0: Port device team_slave_1 added [ 83.596215][ T5615] team0: Port device team_slave_0 added [ 83.600258][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.600273][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.600295][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.679607][ T5615] team0: Port device team_slave_1 added [ 83.682315][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.682328][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.682352][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.768010][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.768022][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.768036][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.770551][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.770561][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.770574][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.819348][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.819365][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.819387][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.828318][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.828333][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.828357][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.832066][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.832079][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.832102][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.870293][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.870309][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 83.870332][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.967537][ T5616] hsr_slave_0: entered promiscuous mode [ 83.969552][ T5616] hsr_slave_1: entered promiscuous mode [ 84.079258][ T5618] hsr_slave_0: entered promiscuous mode [ 84.080548][ T5618] hsr_slave_1: entered promiscuous mode [ 84.082845][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 84.082957][ T5618] Cannot create hsr debugfs directory [ 84.112431][ T5617] hsr_slave_0: entered promiscuous mode [ 84.113593][ T5617] hsr_slave_1: entered promiscuous mode [ 84.114455][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 84.114476][ T5617] Cannot create hsr debugfs directory [ 84.148449][ T5615] hsr_slave_0: entered promiscuous mode [ 84.149597][ T5615] hsr_slave_1: entered promiscuous mode [ 84.150510][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 84.150531][ T5615] Cannot create hsr debugfs directory [ 84.812324][ T4932] Bluetooth: hci1: command tx timeout [ 84.812414][ T5623] Bluetooth: hci2: command tx timeout [ 84.891006][ T5623] Bluetooth: hci0: command tx timeout [ 84.891034][ T5623] Bluetooth: hci3: command tx timeout [ 85.244720][ T5616] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.286804][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.300550][ T5616] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.338769][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.340500][ T5616] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.389340][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.411467][ T5616] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.448871][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.555391][ T5617] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.598349][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.604546][ T5617] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.647131][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.659040][ T5617] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.686508][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.716893][ T5617] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.744738][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 85.884853][ T5618] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.919337][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.933584][ T5618] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.974805][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.978214][ T5618] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.016558][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.055257][ T5618] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.088035][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.219766][ T5615] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.248668][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.254190][ T5615] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.284510][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.295747][ T5615] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.326446][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.342252][ T5615] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.374944][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.447511][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.569145][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.615072][ T1411] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.615234][ T1411] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.660116][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.682830][ T1411] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.683188][ T1411] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.765306][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.797972][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.829446][ T1570] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.829546][ T1570] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.864268][ T821] cfg80211: failed to load regulatory.db [ 86.891062][ T5623] Bluetooth: hci2: command tx timeout [ 86.891091][ T5623] Bluetooth: hci1: command tx timeout [ 86.924257][ T1570] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.924386][ T1570] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.971875][ T5623] Bluetooth: hci0: command tx timeout [ 86.971962][ T4932] Bluetooth: hci3: command tx timeout [ 87.014285][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.050647][ T1601] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.059717][ T1601] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.083890][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.150564][ T1601] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.169243][ T1601] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.302548][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.346815][ T1601] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.346932][ T1601] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.408512][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.408672][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.195293][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.486973][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.635245][ T5616] veth0_vlan: entered promiscuous mode [ 88.735137][ T5616] veth1_vlan: entered promiscuous mode [ 88.764985][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.904022][ T5617] veth0_vlan: entered promiscuous mode [ 88.971915][ T4932] Bluetooth: hci1: command tx timeout [ 88.977389][ T5617] veth1_vlan: entered promiscuous mode [ 88.981836][ T4932] Bluetooth: hci2: command tx timeout [ 89.008196][ T5616] veth0_macvtap: entered promiscuous mode [ 89.049239][ T5616] veth1_macvtap: entered promiscuous mode [ 89.053677][ T5623] Bluetooth: hci0: command tx timeout [ 89.053720][ T4932] Bluetooth: hci3: command tx timeout [ 89.075645][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.114979][ T5618] veth0_vlan: entered promiscuous mode [ 89.160038][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.175400][ T5618] veth1_vlan: entered promiscuous mode [ 89.204124][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.205091][ T5617] veth0_macvtap: entered promiscuous mode [ 89.260421][ T5617] veth1_macvtap: entered promiscuous mode [ 89.275100][ T1031] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.291313][ T1031] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.311576][ T1031] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.319832][ T1031] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.421479][ T5615] veth0_vlan: entered promiscuous mode [ 89.499649][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.640577][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.685781][ T5618] veth0_macvtap: entered promiscuous mode [ 89.720524][ T5615] veth1_vlan: entered promiscuous mode [ 89.740504][ T1411] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.744824][ T1411] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.747129][ T5618] veth1_macvtap: entered promiscuous mode [ 89.755642][ T1411] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.760463][ T1411] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.881237][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.881260][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.983701][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.190624][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.248959][ T1509] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.248978][ T1509] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.282005][ T5615] veth0_macvtap: entered promiscuous mode [ 90.287206][ T1446] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.345193][ T1446] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.376673][ T1446] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.397853][ T1446] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.400136][ T5615] veth1_macvtap: entered promiscuous mode [ 90.404832][ T1031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.404849][ T1031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.757564][ T1601] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.757589][ T1601] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.863596][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.032872][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.255742][ T1031] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.273260][ T1031] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.278779][ T2987] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.278797][ T2987] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.306266][ T1031] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.327285][ T1031] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.654865][ T1031] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.654884][ T1031] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.535190][ T1446] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.535209][ T1446] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.267287][ T5729] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 93.328093][ T2987] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.328112][ T2987] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.571629][ T5729] usb 2-1: Using ep0 maxpacket: 16 [ 93.776830][ T5729] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 93.776854][ T5729] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 2 [ 95.265189][ T5784] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2'. [ 95.265227][ T5784] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2'. [ 96.029770][ T5795] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14'. [ 96.464910][ T5797] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3'. [ 96.991188][ T5804] syz.0.7 uses obsolete (PF_INET,SOCK_PACKET) [ 97.273569][ T5730] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 97.584932][ T5730] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 97.584955][ T5730] usb 4-1: can't read configurations, error -61 [ 97.772071][ T5730] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 98.130604][ T5730] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 98.130643][ T5730] usb 4-1: can't read configurations, error -61 [ 98.149236][ T5730] usb usb4-port1: attempt power cycle [ 98.751513][ T5730] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 98.864286][ T5730] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 98.864322][ T5730] usb 4-1: can't read configurations, error -61 [ 98.864982][ T5729] usb 2-1: string descriptor 0 read error: -32 [ 98.865064][ T5729] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 98.865076][ T5729] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.016191][ T5730] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 99.066068][ T5730] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 99.066091][ T5730] usb 4-1: can't read configurations, error -61 [ 99.078507][ T5730] usb usb4-port1: unable to enumerate USB device [ 99.218698][ T5729] usb 2-1: can't set config #1, error -32 [ 99.462640][ T1261] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 99.670835][ T1261] usb 1-1: Using ep0 maxpacket: 8 [ 99.698167][ T1261] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 99.711039][ T1261] usb 1-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 99.711057][ T1261] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.711067][ T1261] usb 1-1: Product: syz [ 99.711074][ T1261] usb 1-1: Manufacturer: syz [ 99.711082][ T1261] usb 1-1: SerialNumber: syz [ 99.839826][ T5730] usb 2-1: USB disconnect, device number 2 [ 99.901818][ T1261] usb 1-1: config 0 descriptor?? [ 100.014742][ T5817] openvswitch: netlink: IP tunnel dst address not specified [ 100.168241][ T1261] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 100.220877][ T5729] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 100.353407][ T5729] usb 4-1: device descriptor read/64, error -71 [ 100.399447][ T5825] input: syz0 as /devices/virtual/input/input5 [ 100.772642][ T5729] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 100.922461][ T5729] usb 4-1: device descriptor read/64, error -71 [ 102.047802][ T5729] usb usb4-port1: attempt power cycle [ 103.161704][ T5729] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 103.214815][ T5729] usb 4-1: device descriptor read/8, error -71 [ 103.347221][ T5841] Zero length message leads to an empty skb [ 103.504423][ T1261] gspca_zc3xx: reg_r err -32 [ 103.675063][ T9] libceph: connect (1)[c::]:6789 error -101 [ 103.676859][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 103.705153][ T5842] ceph: No mds server is up or the cluster is laggy [ 103.717905][ T9] libceph: connect (1)[c::]:6789 error -101 [ 103.718125][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 103.890876][ T32] usb 2-1: new low-speed USB device number 3 using dummy_hcd [ 103.990845][ T5729] usb 4-1: new full-speed USB device number 9 using dummy_hcd [ 104.018514][ T5729] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 104.018550][ T5729] usb 4-1: can't read configurations, error -61 [ 104.018892][ T5729] usb usb4-port1: unable to enumerate USB device [ 104.067558][ T32] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.067584][ T32] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 104.067633][ T32] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 104.067688][ T32] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 104.067712][ T32] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.105295][ T1261] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 104.105395][ T1261] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -32 [ 104.164265][ T5853] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 104.259533][ T32] hub 2-1:1.0: bad descriptor, ignoring hub [ 104.259568][ T32] hub 2-1:1.0: probe with driver hub failed with error -5 [ 104.282990][ T32] cdc_wdm 2-1:1.0: skipping garbage [ 104.283010][ T32] cdc_wdm 2-1:1.0: skipping garbage [ 104.326092][ T32] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 104.326129][ T32] cdc_wdm 2-1:1.0: Unknown control protocol [ 104.348655][ T1261] usb 1-1: USB disconnect, device number 2 [ 104.612753][ T32] usb 2-1: USB disconnect, device number 3 [ 105.100999][ T4932] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 105.498084][ T0] ------------[ cut here ]------------ [ 105.498096][ T0] rq->clock_update_flags < RQCF_ACT_SKIP [ 105.498107][ T0] WARNING: kernel/sched/sched.h:1792 at update_curr_idle+0x1cf/0x260, CPU#1: swapper/1/0 [ 105.498142][ T0] Modules linked in: [ 105.498168][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 105.498184][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 105.498195][ T0] RIP: 0010:update_curr_idle+0x1cf/0x260 [ 105.498216][ T0] Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 3a 98 97 00 48 8b 3b 4c 89 f6 4c 89 fa 5b 41 5c 41 5d 41 5e 41 5f 5d e9 52 38 01 00 90 <0f> 0b 90 e9 01 ff ff ff 90 0f 0b 90 e9 d3 fe ff ff 48 c7 c1 40 4c [ 105.498228][ T0] RSP: 0018:ffffc900001e7bf8 EFLAGS: 00010097 [ 105.498240][ T0] RAX: 0000000000000000 RBX: ffff8880b873ba40 RCX: 0000000000000002 [ 105.498250][ T0] RDX: ffff88802a1d5d00 RSI: ffffffff8dbdec30 RDI: ffffffff8bcc4d80 [ 105.498260][ T0] RBP: ffffc900001e7e30 R08: ffff8880b873c91f R09: 0000000000000000 [ 105.498269][ T0] R10: ffff8880b873c910 R11: ffffffff819a0020 R12: dffffc0000000000 [ 105.498279][ T0] R13: ffffffff8dc14a58 R14: ffff88801e29dd00 R15: ffff8880b873c620 [ 105.498290][ T0] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 105.498301][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.498311][ T0] CR2: 000000110c28a0b3 CR3: 000000003c576000 CR4: 00000000003526f0 [ 105.498324][ T0] Call Trace: [ 105.498334][ T0] [ 105.498343][ T0] put_prev_task_idle+0xd/0x20 [ 105.498363][ T0] __schedule+0x3da0/0x5550 [ 105.498399][ T0] ? __pfx___schedule+0x10/0x10 [ 105.498413][ T0] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.498437][ T0] ? tick_nohz_idle_exit+0x2a6/0x370 [ 105.498460][ T0] schedule_idle+0x51/0x90 [ 105.498475][ T0] do_idle+0x4a6/0x540 [ 105.498496][ T0] ? __pfx_do_idle+0x10/0x10 [ 105.498521][ T0] cpu_startup_entry+0x43/0x60 [ 105.498540][ T0] start_secondary+0x101/0x110 [ 105.498556][ T0] common_startup_64+0x13e/0x157 [ 105.498590][ T0] [ 105.498598][ T0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.498608][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 105.498623][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 105.498631][ T0] Call Trace: [ 105.498636][ T0] [ 105.498642][ T0] vpanic+0x56c/0xa60 [ 105.498663][ T0] ? __pfx__printk+0x10/0x10 [ 105.498677][ T0] ? __pfx_vpanic+0x10/0x10 [ 105.498696][ T0] ? is_bpf_text_address+0x292/0x2b0 [ 105.498716][ T0] ? is_bpf_text_address+0x26/0x2b0 [ 105.498741][ T0] panic+0xc5/0xd0 [ 105.498761][ T0] ? __pfx_panic+0x10/0x10 [ 105.498788][ T0] ? common_startup_64+0x13e/0x157 [ 105.498807][ T0] __warn+0x315/0x4c0 [ 105.498821][ T0] ? update_curr_idle+0x1cf/0x260 [ 105.498836][ T0] ? update_curr_idle+0x1cf/0x260 [ 105.498851][ T0] __report_bug+0x339/0x540 [ 105.498868][ T0] ? update_curr_idle+0x1cf/0x260 [ 105.498882][ T0] ? __pfx___report_bug+0x10/0x10 [ 105.498903][ T0] ? pick_task_fair+0x21a/0x1410 [ 105.498920][ T0] ? update_curr_idle+0x1cf/0x260 [ 105.498934][ T0] report_bug+0x16a/0x220 [ 105.498947][ T0] ? update_curr_idle+0x1cf/0x260 [ 105.498960][ T0] ? update_curr_idle+0x1d1/0x260 [ 105.498974][ T0] handle_bug+0x9c/0x200 [ 105.498989][ T0] exc_invalid_op+0x1a/0x50 [ 105.499003][ T0] asm_exc_invalid_op+0x1a/0x20 [ 105.499014][ T0] RIP: 0010:update_curr_idle+0x1cf/0x260 [ 105.499028][ T0] Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 3a 98 97 00 48 8b 3b 4c 89 f6 4c 89 fa 5b 41 5c 41 5d 41 5e 41 5f 5d e9 52 38 01 00 90 <0f> 0b 90 e9 01 ff ff ff 90 0f 0b 90 e9 d3 fe ff ff 48 c7 c1 40 4c [ 105.499036][ T0] RSP: 0018:ffffc900001e7bf8 EFLAGS: 00010097 [ 105.499044][ T0] RAX: 0000000000000000 RBX: ffff8880b873ba40 RCX: 0000000000000002 [ 105.499051][ T0] RDX: ffff88802a1d5d00 RSI: ffffffff8dbdec30 RDI: ffffffff8bcc4d80 [ 105.499058][ T0] RBP: ffffc900001e7e30 R08: ffff8880b873c91f R09: 0000000000000000 [ 105.499064][ T0] R10: ffff8880b873c910 R11: ffffffff819a0020 R12: dffffc0000000000 [ 105.499077][ T0] R13: ffffffff8dc14a58 R14: ffff88801e29dd00 R15: ffff8880b873c620 [ 105.499086][ T0] ? __pfx_put_prev_task_idle+0x10/0x10 [ 105.499105][ T0] ? update_curr_idle+0xab/0x260 [ 105.499121][ T0] put_prev_task_idle+0xd/0x20 [ 105.499134][ T0] __schedule+0x3da0/0x5550 [ 105.499157][ T0] ? __pfx___schedule+0x10/0x10 [ 105.499168][ T0] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.499184][ T0] ? tick_nohz_idle_exit+0x2a6/0x370 [ 105.499199][ T0] schedule_idle+0x51/0x90 [ 105.499211][ T0] do_idle+0x4a6/0x540 [ 105.499225][ T0] ? __pfx_do_idle+0x10/0x10 [ 105.499243][ T0] cpu_startup_entry+0x43/0x60 [ 105.499257][ T0] start_secondary+0x101/0x110 [ 105.499268][ T0] common_startup_64+0x13e/0x157 [ 105.499290][ T0] [ 106.574360][ T0] Shutting down cpus with NMI [ 106.574566][ T0] Kernel Offset: disabled