last executing test programs: 32.132521225s ago: executing program 0 (id=64): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x14, 0x0, 0xb1d, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x48850) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) userfaultfd(0x80001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket(0x10, 0x3, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, r1, 0x0, &(0x7f00000003c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x7, &(0x7f0000000380)=@new_dev={0x3, 0x32c, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x191}}}, &(0x7f0000000200)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x40040, 0x1000002, 0x93}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x1f}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x282f, 0x1000, 0x40000003, 0x337}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x20000001, 0xffffffff}}], 0x1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket(0x40000000015, 0x805, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r5, &(0x7f0000007880)=""/102400, 0x19000) 30.41034703s ago: executing program 0 (id=72): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x88840, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, r1, 0xffffc000) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000), 0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_change_link_key_complete={{0x9, 0x3}, {0x8, 0xc9}}}, 0x6) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(0xffffffffffffffff, 0xc008ae05, 0x0) r5 = openat$full(0xffffffffffffff9c, 0x0, 0x400, 0x0) fcntl$lock(r5, 0x5, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local}, {0xa, 0x0, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x74, 0x3]}}, 0x5c) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x80, 0x101) 29.171213889s ago: executing program 0 (id=75): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) r0 = open(&(0x7f00000002c0)='.\x00', 0x101800, 0x1d2) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 28.88236839s ago: executing program 0 (id=77): openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) mount$bind(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x803400, 0x0) sched_setscheduler(0x0, 0x3, &(0x7f0000000100)=0x4) r0 = getpid() r1 = openat$vsock(0xffffffffffffff9c, 0x0, 0x1c1880, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x3) syz_clone(0x8000, 0x0, 0xffffffffffffff2f, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r4, 0x4068ae53, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0xbb0, 0x0, 0x1}, {0xa62, 0x0, 0x6}]}) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000180)) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000000540)=""/102393, 0x18ff9) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = socket$inet6(0xa, 0x80003, 0xff) socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_int(r7, 0x29, 0x16, &(0x7f0000fcb000), 0x4) add_key$keyring(&(0x7f0000000500), 0x0, 0x0, 0x0, 0xffffffffffffffff) close_range(r6, 0xffffffffffffffff, 0x0) 25.861808782s ago: executing program 0 (id=85): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x2, 0x0) r0 = open(&(0x7f00000002c0)='.\x00', 0x101800, 0x1d2) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, 0x0) 25.306965405s ago: executing program 0 (id=88): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, 0x0) 13.175242025s ago: executing program 3 (id=132): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0), 0x60081, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x0) 12.947549636s ago: executing program 1 (id=133): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000380), 0x8001, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40186f40, &(0x7f0000000180)={0xffffffff, 0x1f, 0x3f, 0x1, '\x00', 0x10003}) 12.76675336s ago: executing program 3 (id=134): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0x9}, 0x0) mmap(&(0x7f00005e9000/0x2000)=nil, 0x2000, 0x1000004, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) syz_open_dev$usbfs(0x0, 0x6a, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, 0x0, 0x0) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0xa, 0x0, &(0x7f00000001c0)) sendto$inet(r2, &(0x7f0000000380)='g', 0x1, 0x8812, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x2}], 0x1, 0x162, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f00000000c0), &(0x7f0000000140)=@v3={0x3000000, [{0x8, 0x80}, {0x8, 0xfffff820}], 0xee00}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], &(0x7f00000002c0)=""/203, 0xfffffffffffffe5f) bind$rds(r4, &(0x7f0000000040)={0x2, 0x2, @loopback}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) set_mempolicy(0x6, 0x0, 0xe0) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) 12.766474258s ago: executing program 1 (id=135): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r0, &(0x7f0000000180), 0x1000) 12.570927589s ago: executing program 1 (id=136): socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x805}, @void, @x25={0x0, 0x0, 0x1, '\v'}}, 0xfdef) 8.216106312s ago: executing program 32 (id=88): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, 0x0) 7.862173117s ago: executing program 1 (id=139): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$sock_SIOCOUTQ(r3, 0x5411, 0xffffffffffffffff) 6.011293115s ago: executing program 3 (id=142): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r3) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r3, {0x8001, 0x5}}, './file0\x00'}) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r4, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x8081}, 0x0) 4.701153848s ago: executing program 3 (id=143): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./my_dbroot\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r0, &(0x7f0000000400), 0x0) mkdir(&(0x7f0000000500)='./my_dbroot/alua\x00', 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000700)='./my_dbroot/alua/usb_gadget/naa.1234567890abcdef+1\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000900)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000a00)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000b00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000c00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r1, &(0x7f0000001000)='rd_pages=8', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000001200)='1', 0x1) close(r2) mkdir(&(0x7f0000001300)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000001400)='./my_configfs/target/core/rd_mcp_0/dev0\x00', &(0x7f0000001500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') mkdir(0x0, 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_write_md\x00', 0x1, 0x0) write(r3, &(0x7f0000001700)='1', 0x1) openat(0xffffffffffffff9c, &(0x7f0000001800)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) 3.85463785s ago: executing program 3 (id=146): writev(0xffffffffffffffff, &(0x7f0000000a40), 0x0) r0 = syz_open_dev$sg(0x0, 0x0, 0x9840) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffe, 0x0, 0x1, @buffer={0x300, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x14, 0x0, 0x0}) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000080)) r1 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r1) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) 2.371538251s ago: executing program 1 (id=149): syz_open_dev$video(0x0, 0x8, 0x101840) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 2.180081735s ago: executing program 2 (id=150): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_generic(0x10, 0x3, 0x10) fremovexattr(0xffffffffffffffff, &(0x7f0000000040)=@known='trusted.overlay.upper\x00') r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x10}, 0x1, 0x7}, 0x800) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000140)={'netpci0\x00', 0x800}) r2 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) r3 = fsmount(r2, 0x0, 0xa) fchdir(r3) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100), 0x103000, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r4, 0x50009405, &(0x7f00000003c0)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f00000000c0)='iocharset', &(0x7f0000000100)='iocharset', 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300), r5) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x1c, r6, 0x331, 0x70bd2a, 0x25dfdbfb, {0xb}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c0c1}, 0x8004800) 1.332640383s ago: executing program 2 (id=151): r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='sys_mnt/block/zram0/disksize\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1', 0x1) 1.224041854s ago: executing program 2 (id=152): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r0, &(0x7f0000000180), 0x1000) read(r0, &(0x7f0000000340)=""/202, 0xca) 1.146495957s ago: executing program 2 (id=153): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0102}}}, 0x14) 1.045876008s ago: executing program 2 (id=154): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) write$tun(r0, &(0x7f0000000100)={@val={0x0, 0x805}, @void, @x25={0x0, 0x0, 0x1, '\v'}}, 0xfdef) 855.103727ms ago: executing program 3 (id=155): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r2, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000300)=[@in6={0xa, 0x4e20, 0x9, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x0, @loopback}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000000)=0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6, @multicast}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r1, 0x1, 0x6, @multicast}, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r4, 0x7, &(0x7f0000000340)={0x0, 0x2, 0x2, 0x7fffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='aio\x00', 0x80040, &(0x7f0000000140)='\xc0,*\x00') mount(0x0, &(0x7f0000000240)='./debug\x00', &(0x7f0000000280)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/fail_page_alloc/probability\x00', 0x1, 0x0) write(r5, &(0x7f0000000380)='10', 0x2) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x6) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000080)={'veth1_macvtap\x00', 0x0}) 486.871411ms ago: executing program 2 (id=156): setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r1, 0x707, &(0x7f00000000c0)={0x0}) 0s ago: executing program 1 (id=157): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)="012031303030303030303030203020302030206b72623520202075", 0x1b) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.27' (ED25519) to the list of known hosts. [ 92.216939][ T199] cfg80211: failed to load regulatory.db [ 92.320250][ T5578] cgroup: Unknown subsys name 'net' [ 92.566360][ T5578] cgroup: Unknown subsys name 'cpuset' [ 92.635144][ T5578] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 94.817748][ T5578] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.686710][ T5592] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.689931][ T5592] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.692448][ T5592] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.703704][ T5592] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.719406][ T5592] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.810444][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 98.831185][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 98.835730][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 98.854037][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 98.865595][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 98.992896][ T5592] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 99.030012][ T5592] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 99.030937][ T5592] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 99.050767][ T5592] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 99.053243][ T5592] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.175634][ T5592] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.203277][ T5592] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.230969][ T5592] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.234485][ T5592] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.242020][ T5592] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.806771][ T5592] Bluetooth: hci0: command tx timeout [ 100.974364][ T5592] Bluetooth: hci1: command tx timeout [ 101.125461][ T5592] Bluetooth: hci2: command tx timeout [ 101.285338][ T5592] Bluetooth: hci3: command tx timeout [ 101.771610][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.773122][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.773380][ T5599] bridge_slave_0: entered allmulticast mode [ 101.786134][ T5599] bridge_slave_0: entered promiscuous mode [ 101.865242][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.865520][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.865773][ T5599] bridge_slave_1: entered allmulticast mode [ 101.878003][ T5599] bridge_slave_1: entered promiscuous mode [ 101.917962][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.918252][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.918543][ T5600] bridge_slave_0: entered allmulticast mode [ 101.921209][ T5600] bridge_slave_0: entered promiscuous mode [ 102.019115][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.019516][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.019821][ T5600] bridge_slave_1: entered allmulticast mode [ 102.022535][ T5600] bridge_slave_1: entered promiscuous mode [ 102.056704][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.057073][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.057407][ T5594] bridge_slave_0: entered allmulticast mode [ 102.061064][ T5594] bridge_slave_0: entered promiscuous mode [ 102.110721][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.111202][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.111610][ T5590] bridge_slave_0: entered allmulticast mode [ 102.119110][ T5590] bridge_slave_0: entered promiscuous mode [ 102.163305][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.163649][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.163867][ T5594] bridge_slave_1: entered allmulticast mode [ 102.180809][ T5594] bridge_slave_1: entered promiscuous mode [ 102.200842][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.201313][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.201680][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.201969][ T5590] bridge_slave_1: entered allmulticast mode [ 102.213123][ T5590] bridge_slave_1: entered promiscuous mode [ 102.292797][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.332224][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.410705][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.427445][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.464803][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.496497][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.500615][ T5599] team0: Port device team_slave_0 added [ 102.522895][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.592675][ T5599] team0: Port device team_slave_1 added [ 102.620290][ T5600] team0: Port device team_slave_0 added [ 102.696433][ T5600] team0: Port device team_slave_1 added [ 102.701398][ T5594] team0: Port device team_slave_0 added [ 102.739335][ T5590] team0: Port device team_slave_0 added [ 102.770806][ T5594] team0: Port device team_slave_1 added [ 102.773183][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.773202][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.773240][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.824327][ T5590] team0: Port device team_slave_1 added [ 102.870184][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.870198][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.870219][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.894264][ T5592] Bluetooth: hci0: command tx timeout [ 102.934586][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.934605][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.934639][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.033528][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.033542][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.033562][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.044585][ T5592] Bluetooth: hci1: command tx timeout [ 103.050530][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.050581][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.050669][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.112496][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.112558][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.112636][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.185048][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.185062][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.185083][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.188902][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.188915][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.188935][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.204552][ T5592] Bluetooth: hci2: command tx timeout [ 103.374390][ T5592] Bluetooth: hci3: command tx timeout [ 103.671400][ T5599] hsr_slave_0: entered promiscuous mode [ 103.677621][ T5599] hsr_slave_1: entered promiscuous mode [ 103.763449][ T5600] hsr_slave_0: entered promiscuous mode [ 103.771729][ T5600] hsr_slave_1: entered promiscuous mode [ 103.773488][ T5600] debugfs: 'hsr0' already exists in 'hsr' [ 103.773595][ T5600] Cannot create hsr debugfs directory [ 103.839125][ T5594] hsr_slave_0: entered promiscuous mode [ 103.841035][ T5594] hsr_slave_1: entered promiscuous mode [ 103.842615][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 103.842640][ T5594] Cannot create hsr debugfs directory [ 103.896913][ T5590] hsr_slave_0: entered promiscuous mode [ 103.898966][ T5590] hsr_slave_1: entered promiscuous mode [ 103.900479][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 103.900504][ T5590] Cannot create hsr debugfs directory [ 104.966712][ T5592] Bluetooth: hci0: command tx timeout [ 105.020202][ T5599] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.079866][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.097602][ T5599] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.125950][ T5592] Bluetooth: hci1: command tx timeout [ 105.131632][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.139819][ T5599] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.201111][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.242464][ T5599] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.272978][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.284695][ T5592] Bluetooth: hci2: command tx timeout [ 105.445193][ T5592] Bluetooth: hci3: command tx timeout [ 105.498871][ T5590] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 105.518817][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.540440][ T5590] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.581241][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.602532][ T5590] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.641604][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.681372][ T5590] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.710676][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.958134][ T5600] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 105.993759][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.012772][ T5600] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.040226][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.063180][ T5600] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.106072][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.143690][ T5600] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.182721][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.343339][ T5594] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.381198][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.406457][ T5594] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.441532][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.475717][ T5594] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.513050][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.538336][ T5594] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.582501][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.658174][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.804592][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.895964][ T1029] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.896207][ T1029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.962314][ T3387] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.963020][ T3387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.017817][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.044998][ T5592] Bluetooth: hci0: command tx timeout [ 107.180063][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.215114][ T5592] Bluetooth: hci1: command tx timeout [ 107.231231][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.262467][ T3387] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.262672][ T3387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.333985][ T3387] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.343485][ T3387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.364368][ T5592] Bluetooth: hci2: command tx timeout [ 107.447085][ T5600] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.489910][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.535032][ T5592] Bluetooth: hci3: command tx timeout [ 107.607905][ T1140] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.608097][ T1140] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.708151][ T1029] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.708399][ T1029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.805861][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.886643][ T1037] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.886770][ T1037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.962165][ T1037] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.962282][ T1037] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.702937][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.435968][ T5599] veth0_vlan: entered promiscuous mode [ 109.589085][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.661096][ T5599] veth1_vlan: entered promiscuous mode [ 109.803745][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.982510][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.030512][ T5599] veth0_macvtap: entered promiscuous mode [ 110.081698][ T5599] veth1_macvtap: entered promiscuous mode [ 110.114057][ T5590] veth0_vlan: entered promiscuous mode [ 110.197826][ T5590] veth1_vlan: entered promiscuous mode [ 110.241206][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.243221][ T5600] veth0_vlan: entered promiscuous mode [ 110.297411][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.351741][ T5600] veth1_vlan: entered promiscuous mode [ 110.377980][ T1140] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.406032][ T1140] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.407503][ T5594] veth0_vlan: entered promiscuous mode [ 110.436276][ T1140] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.459248][ T1140] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.581660][ T5594] veth1_vlan: entered promiscuous mode [ 110.677495][ T5590] veth0_macvtap: entered promiscuous mode [ 110.787197][ T5590] veth1_macvtap: entered promiscuous mode [ 110.984621][ T5600] veth0_macvtap: entered promiscuous mode [ 111.077782][ T5600] veth1_macvtap: entered promiscuous mode [ 111.096502][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.121570][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.121593][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.258947][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.263058][ T5594] veth0_macvtap: entered promiscuous mode [ 111.332180][ T5594] veth1_macvtap: entered promiscuous mode [ 111.344085][ T68] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.366000][ T68] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.378441][ T68] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.397849][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.429986][ T1037] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.430009][ T1037] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.431238][ T68] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.645576][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.725525][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.831672][ T1037] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.951192][ T1037] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.981021][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.981162][ T1037] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.083817][ T1037] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.465803][ T1037] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.469028][ T1037] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.532604][ T1037] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.549398][ T1037] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.885899][ T1559] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.885921][ T1559] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.120168][ T5740] syz.3.5 (5740) used greatest stack depth: 17312 bytes left [ 113.840267][ T1029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.840290][ T1029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.197350][ T1559] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.197373][ T1559] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.534220][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.554221][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.564228][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.574218][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.584199][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.594254][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.604225][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.614205][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.870612][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.870635][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.924224][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 114.944231][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 116.705677][ T1029] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.705700][ T1029] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.030095][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.030120][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.495122][ T5775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 122.637071][ T5783] netlink: 'syz.2.17': attribute type 1 has an invalid length. [ 122.637205][ T5783] netlink: 224 bytes leftover after parsing attributes in process `syz.2.17'. [ 123.383356][ T5788] syz.1.18 uses obsolete (PF_INET,SOCK_PACKET) [ 125.658997][ T5812] zram0: detected capacity change from 0 to 8 [ 128.927401][ T5695] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 129.214367][ T5695] usb 3-1: Using ep0 maxpacket: 32 [ 129.300860][ T5695] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 129.300923][ T5695] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 64 [ 129.300947][ T5695] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 129.365208][ T5695] usb 3-1: New USB device found, idVendor=08e4, idProduct=0163, bcdDevice= 0.40 [ 129.365241][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.365262][ T5695] usb 3-1: Product: syz [ 129.365277][ T5695] usb 3-1: Manufacturer: syz [ 129.365292][ T5695] usb 3-1: SerialNumber: syz [ 129.831114][ T5859] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 130.237139][ T5902] capability: warning: `syz.1.57' uses 32-bit capabilities (legacy support in use) [ 131.408835][ T5695] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 131.408907][ T5695] usb 3-1: MIDIStreaming interface descriptor not found [ 133.156374][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.197940][ T5695] usb 3-1: USB disconnect, device number 2 [ 134.254441][ T5688] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 134.437407][ T5688] usb 2-1: Using ep0 maxpacket: 32 [ 134.462743][ T5688] usb 2-1: unable to get BOS descriptor set [ 134.524602][ T5688] usb 2-1: config 0 has no interfaces? [ 134.541877][ T5688] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 134.541906][ T5688] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.541924][ T5688] usb 2-1: Product: syz [ 134.541936][ T5688] usb 2-1: Manufacturer: syz [ 134.541948][ T5688] usb 2-1: SerialNumber: syz [ 134.692437][ T5688] usb 2-1: config 0 descriptor?? [ 135.840048][ T5688] usb 2-1: USB disconnect, device number 2 [ 136.320360][ T5978] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 137.175801][ T5984] Zero length message leads to an empty skb [ 139.539605][ T6010] netlink: 'syz.1.87': attribute type 3 has an invalid length. [ 139.539632][ T6010] netlink: 8 bytes leftover after parsing attributes in process `syz.1.87'. [ 139.588939][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 139.589300][ T5594] do_umount: task=syz-executor[5594] propagate_mount_busy()!=0 [ 143.024651][ T6057] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 143.024651][ T6057] Please contact the netfilter-devel mailing list or update your nftables rules. [ 143.344323][ T5909] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 143.514287][ T5909] usb 2-1: Using ep0 maxpacket: 32 [ 143.517152][ T5909] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.517187][ T5909] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.517227][ T5909] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 143.517252][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.767670][ T5909] usb 2-1: config 0 descriptor?? [ 144.104735][ T6072] ptrace attach of "ci-upstream-rust-kasan-gce/syz-executor exec"[5590] was attempted by " [ 145.640680][ T5909] savu 0003:1E7D:2D5A.0001: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.1-1/input0 [ 145.850025][ T5909] usb 2-1: USB disconnect, device number 3 [ 146.070088][ T6081] fido_id[6081]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 151.236387][ T6137] zram: Cannot change disksize for initialized device [ 151.731368][ T822] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 151.893737][ T822] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 151.893772][ T822] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.893793][ T822] usb 3-1: Product: syz [ 151.893808][ T822] usb 3-1: Manufacturer: syz [ 151.893823][ T822] usb 3-1: SerialNumber: syz [ 152.273307][ T5688] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 154.164216][ T5688] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 156.246189][ T199] usb 3-1: USB disconnect, device number 3 [ 156.425762][ T5688] ath9k_htc: Failed to initialize the device [ 156.563892][ T199] usb 3-1: ath9k_htc: USB layer deinitialized [ 157.710665][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 157.738219][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 157.755961][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 157.780469][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 157.782506][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 159.255781][ T6195] zram: Cannot change disksize for initialized device [ 160.214451][ T5592] Bluetooth: hci4: command tx timeout [ 161.604342][ T5688] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 161.756099][ T5688] usb 4-1: Using ep0 maxpacket: 32 [ 161.763867][ T5688] usb 4-1: unable to get BOS descriptor or descriptor too short [ 161.807936][ T5688] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 161.807968][ T5688] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 161.807991][ T5688] usb 4-1: config 14 has no interface number 0 [ 161.808009][ T5688] usb 4-1: config 14 has no interface number 1 [ 161.808084][ T5688] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 161.808110][ T5688] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 161.808137][ T5688] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 161.808166][ T5688] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 161.808196][ T5688] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 161.808224][ T5688] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 161.808253][ T5688] usb 4-1: config 14 interface 57 has no altsetting 0 [ 161.808272][ T5688] usb 4-1: config 14 interface 228 has no altsetting 0 [ 161.813227][ T5688] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 161.813259][ T5688] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 161.813280][ T5688] usb 4-1: Product: syz [ 161.813296][ T5688] usb 4-1: Manufacturer: syz [ 161.813310][ T5688] usb 4-1: SerialNumber: syz [ 162.081653][ T1391] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.248752][ T5592] Bluetooth: hci4: command tx timeout [ 162.440624][ T5688] legousbtower 4-1:14.57: interrupt endpoints not found [ 162.838253][ T5688] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 162.892469][ T5688] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 162.914358][ T37] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 163.094377][ T37] usb 2-1: Using ep0 maxpacket: 32 [ 163.102569][ T1391] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.122173][ T37] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 163.122206][ T37] usb 2-1: config 0 has no interface number 0 [ 163.122385][ T37] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 163.148080][ T5909] usb 4-1: USB disconnect, device number 2 [ 163.161538][ T37] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 163.161571][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 163.161591][ T37] usb 2-1: Product: syz [ 163.161608][ T37] usb 2-1: Manufacturer: syz [ 163.161623][ T37] usb 2-1: SerialNumber: syz [ 163.162064][ T6222] usb 4-1: LEGO USB Tower reset control request failed [ 163.309663][ T37] usb 2-1: config 0 descriptor?? [ 163.405807][ T37] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 163.405849][ T37] em28xx 2-1:0.132: Video interface 132 found: [ 163.450184][ T5909] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected [ 163.723374][ T37] em28xx 2-1:0.132: unknown em28xx chip ID (0) [ 163.763642][ T1391] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 164.153848][ T37] em28xx 2-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 164.153905][ T37] em28xx 2-1:0.132: board has no eeprom [ 164.234404][ T37] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 164.234435][ T37] em28xx 2-1:0.132: analog set to bulk mode. [ 164.234801][ T5688] em28xx 2-1:0.132: Registering V4L2 extension [ 164.287010][ T6259] ======================================================= [ 164.287010][ T6259] WARNING: The mand mount option has been deprecated and [ 164.287010][ T6259] and is ignored by this kernel. Remove the mand [ 164.287010][ T6259] option from the mount to silence this warning. [ 164.287010][ T6259] ======================================================= [ 164.324414][ T5592] Bluetooth: hci4: command tx timeout [ 164.366081][ T37] usb 2-1: USB disconnect, device number 4 [ 164.383392][ T37] em28xx 2-1:0.132: Disconnecting em28xx [ 165.042012][ T5688] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 165.042039][ T5688] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 165.042054][ T5688] em28xx 2-1:0.132: No AC97 audio processor [ 165.130137][ T5688] usb 2-1: Decoder not found [ 165.130160][ T5688] em28xx 2-1:0.132: failed to create media graph [ 165.130239][ T5688] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 165.190243][ T5909] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 165.216890][ T5688] INFO: trying to register non-static key. [ 165.216905][ T5688] The code is fine but needs lockdep annotation, or maybe [ 165.216914][ T5688] you didn't initialize this object before use? [ 165.216921][ T5688] turning off the locking correctness validator. [ 165.216953][ T5688] CPU: 1 UID: 0 PID: 5688 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 165.216978][ T5688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 165.216991][ T5688] Workqueue: events request_module_async [ 165.217031][ T5688] Call Trace: [ 165.217038][ T5688] [ 165.217056][ T5688] dump_stack_lvl+0xe8/0x150 [ 165.217084][ T5688] assign_lock_key+0x133/0x150 [ 165.217109][ T5688] register_lock_class+0xcc/0x2e0 [ 165.217143][ T5688] __lock_acquire+0xaf/0x2e40 [ 165.217163][ T5688] ? ret_from_fork_asm+0x1a/0x30 [ 165.217195][ T5688] ? stack_trace_save+0xa9/0x100 [ 165.217224][ T5688] ? __pfx_stack_trace_save+0x10/0x10 [ 165.217258][ T5688] lock_acquire+0x115/0x350 [ 165.217287][ T5688] ? __wake_up_common_lock+0x2f/0x1f0 [ 165.217323][ T5688] rt_spin_lock+0x83/0x400 [ 165.217350][ T5688] ? __wake_up_common_lock+0x2f/0x1f0 [ 165.217379][ T5688] ? __pfx_rt_spin_lock+0x10/0x10 [ 165.217405][ T5688] ? lockdep_hardirqs_on+0x7a/0x110 [ 165.217423][ T5688] ? irqentry_exit+0x218/0x8f0 [ 165.217447][ T5688] __wake_up_common_lock+0x2f/0x1f0 [ 165.217481][ T5688] __vb2_queue_cancel+0x2de/0xdc0 [ 165.217512][ T5688] ? _raw_spin_unlock_irqrestore+0x47/0x80 [ 165.217533][ T5688] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 165.217568][ T5688] vb2_core_queue_release+0x2f/0x150 [ 165.217603][ T5688] vb2_video_unregister_device+0x15b/0x200 [ 165.217640][ T5688] em28xx_v4l2_init+0x1c60/0x3140 [ 165.217670][ T5688] em28xx_init_extension+0x120/0x1d0 [ 165.217704][ T5688] ? process_one_work+0x7fd/0x1480 [ 165.217724][ T5688] process_one_work+0xaaf/0x1480 [ 165.217753][ T5688] ? __pfx_process_one_work+0x10/0x10 [ 165.217772][ T5688] ? do_raw_spin_lock+0x12b/0x2f0 [ 165.217804][ T5688] ? assign_work+0x3cf/0x5d0 [ 165.217826][ T5688] worker_thread+0xb05/0x10d0 [ 165.217852][ T5688] ? __kthread_parkme+0x71/0x1f0 [ 165.217881][ T5688] kthread+0x388/0x470 [ 165.217909][ T5688] ? __pfx_worker_thread+0x10/0x10 [ 165.217930][ T5688] ? __pfx_kthread+0x10/0x10 [ 165.217958][ T5688] ret_from_fork+0x514/0xb70 [ 165.217987][ T5688] ? __pfx_ret_from_fork+0x10/0x10 [ 165.218015][ T5688] ? __switch_to+0xc89/0x1420 [ 165.218040][ T5688] ? __pfx_kthread+0x10/0x10 [ 165.218080][ T5688] ret_from_fork_asm+0x1a/0x30 [ 165.218116][ T5688] [ 165.218982][ T5688] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 165.219004][ T5688] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 165.219029][ T5688] CPU: 1 UID: 0 PID: 5688 Comm: kworker/1:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 165.219061][ T5688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 165.219075][ T5688] Workqueue: events request_module_async [ 165.219101][ T5688] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 165.219132][ T5688] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 165.219157][ T5688] RSP: 0018:ffffc9000540f908 EFLAGS: 00010246 [ 165.219174][ T5688] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 165.219188][ T5688] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 165.219203][ T5688] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 165.219215][ T5688] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888040ea1b14 [ 165.219231][ T5688] R13: ffff888040ea1c28 R14: 0000000000000000 R15: 0000000000000000 [ 165.219246][ T5688] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 165.219263][ T5688] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 165.219278][ T5688] CR2: 00007ffc14070fc0 CR3: 0000000040e96000 CR4: 00000000003526f0 [ 165.219296][ T5688] Call Trace: [ 165.219303][ T5688] [ 165.219315][ T5688] __vb2_queue_cancel+0x2de/0xdc0 [ 165.219348][ T5688] ? _raw_spin_unlock_irqrestore+0x47/0x80 [ 165.219371][ T5688] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 165.219406][ T5688] vb2_core_queue_release+0x2f/0x150 [ 165.219439][ T5688] vb2_video_unregister_device+0x15b/0x200 [ 165.219476][ T5688] em28xx_v4l2_init+0x1c60/0x3140 [ 165.219507][ T5688] em28xx_init_extension+0x120/0x1d0 [ 165.219543][ T5688] ? process_one_work+0x7fd/0x1480 [ 165.219564][ T5688] process_one_work+0xaaf/0x1480 [ 165.219595][ T5688] ? __pfx_process_one_work+0x10/0x10 [ 165.219614][ T5688] ? do_raw_spin_lock+0x12b/0x2f0 [ 165.219647][ T5688] ? assign_work+0x3cf/0x5d0 [ 165.219670][ T5688] worker_thread+0xb05/0x10d0 [ 165.219697][ T5688] ? __kthread_parkme+0x71/0x1f0 [ 165.219726][ T5688] kthread+0x388/0x470 [ 165.219753][ T5688] ? __pfx_worker_thread+0x10/0x10 [ 165.219774][ T5688] ? __pfx_kthread+0x10/0x10 [ 165.219803][ T5688] ret_from_fork+0x514/0xb70 [ 165.219834][ T5688] ? __pfx_ret_from_fork+0x10/0x10 [ 165.219863][ T5688] ? __switch_to+0xc89/0x1420 [ 165.219888][ T5688] ? __pfx_kthread+0x10/0x10 [ 165.219916][ T5688] ret_from_fork_asm+0x1a/0x30 [ 165.219953][ T5688] [ 165.219960][ T5688] Modules linked in: [ 165.220002][ T5688] ---[ end trace 0000000000000000 ]--- [ 165.221032][ T5688] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 165.221077][ T5688] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 165.221094][ T5688] RSP: 0018:ffffc9000540f908 EFLAGS: 00010246 [ 165.221112][ T5688] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 165.221125][ T5688] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 165.221141][ T5688] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 165.221153][ T5688] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff888040ea1b14 [ 165.221169][ T5688] R13: ffff888040ea1c28 R14: 0000000000000000 R15: 0000000000000000 [ 165.221183][ T5688] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 165.221201][ T5688] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 165.221215][ T5688] CR2: 00007f371b8feb00 CR3: 0000000040e96000 CR4: 00000000003526f0 [ 165.221238][ T5688] Kernel panic - not syncing: Fatal exception [ 165.221943][ T5688] Kernel Offset: disabled