last executing test programs: 34.305790477s ago: executing program 1 (id=309): sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000025300)=""/102392, 0x18ff8) r1 = openat$random(0xffffffffffffff9c, &(0x7f000000fe80), 0x40800, 0x0) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f000000fec0)=ANY=[@ANYBLOB="04004100000010"]) 33.612013203s ago: executing program 1 (id=315): r0 = socket$tipc(0x1e, 0x1, 0x0) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x1, {{0x41}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40010}, 0x0) recvmsg(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)=""/35, 0x23}], 0x1}, 0x10040) 33.466480822s ago: executing program 1 (id=316): sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000440)='4', 0x1}], 0x1}}], 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="dbaa00000071"], 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 33.32391841s ago: executing program 1 (id=317): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'netpci0\x00', &(0x7f00000001c0)=@ethtool_per_queue_op={0x4b, 0xf, [0x5, 0x2, 0x9, 0xb588, 0x5, 0x7fffffff, 0x3, 0x7, 0x7, 0x80000000, 0x200, 0x9, 0x4, 0xd24, 0x8, 0x4002, 0x0, 0x99, 0x15b, 0x5, 0x0, 0x9, 0x9, 0x7, 0x9, 0x800, 0x6, 0xfa2, 0x0, 0x7, 0x40, 0x7fffffff, 0xd, 0x6, 0x2f0, 0x1, 0x2, 0x9, 0x7, 0xc6432d, 0x7, 0x4, 0x4, 0x3ff, 0xf, 0x7ff, 0x8, 0xfffff67e, 0x4, 0x6, 0xffffffff, 0x6, 0x6, 0x3bc9, 0x7ff, 0x7, 0x80000000, 0x0, 0x1fd, 0x1ff, 0x8, 0x7ff, 0x6, 0x7, 0x3ca5, 0x5, 0x40, 0x0, 0x0, 0x6, 0x9, 0x10000, 0x4, 0x7, 0x0, 0x5, 0x0, 0xf, 0x8, 0x1, 0x31c, 0xd, 0x9, 0x80000000, 0x6, 0x2, 0xffff4ff8, 0xa29, 0x2, 0xb0, 0x1, 0xecc4, 0x8, 0x2559, 0x8000, 0xb647, 0xffffff80, 0x0, 0x9, 0x2, 0x8, 0x3, 0x80000, 0x6, 0xd4, 0x80000000, 0x2, 0x800, 0x8000, 0x9, 0x87, 0x1, 0x400, 0x9, 0x7, 0x73e1, 0x0, 0x3, 0x6, 0x80000005, 0x7, 0x3, 0x401, 0x100, 0x0, 0xc, 0x0, 0x80000000]}}) lseek(0xffffffffffffffff, 0x0, 0x3) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f00000001c0)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$NILFS_IOCTL_GET_CPINFO(r0, 0x80186e82, 0x0) 33.047618974s ago: executing program 1 (id=319): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x20000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0\x00', 0x0, 0x98d046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x10454ca, 0x0) 32.848662746s ago: executing program 1 (id=321): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x9d3ed9d77c9aa274, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r2 = dup(r1) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000040)={0xc0002009}) write$UHID_INPUT(r2, 0x0, 0x0) 4.623680844s ago: executing program 4 (id=466): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c00000002000000ffff000005"], 0x48) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x220080c1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r1, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000029000000040000003a00000000000000100000000000000029"], 0x30}, 0x4004000) 4.465812629s ago: executing program 4 (id=467): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xa, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x54}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) timer_create(0x4, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @thr={0x0, 0x0}}, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f000094c000/0x3000)=nil, 0x800000}) 4.355881504s ago: executing program 4 (id=468): listen(0xffffffffffffffff, 0x7d4165c9) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(0xffffffffffffffff, 0x40146f2c, &(0x7f0000000000)={0x1, 0x1, 0x2, 0x9, 0x4}) r0 = io_uring_setup(0x7272, &(0x7f0000000080)={0x0, 0x8270, 0x40, 0x1, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000001bc0), 0x113e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) io_uring_register$IORING_REGISTER_FILES(r0, 0x1e, &(0x7f0000000000)=[r0], 0x1) 4.204077402s ago: executing program 4 (id=470): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x4008880) recvfrom(r1, 0x0, 0x0, 0x40002062, 0x0, 0x0) 3.969947736s ago: executing program 4 (id=472): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) syz_usb_connect(0x3, 0x34, 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xf, 0x204031, 0xffffffffffffffff, 0x2d5c000) read$FUSE(r0, &(0x7f0000004200)={0x2020}, 0x2020) 3.857828735s ago: executing program 0 (id=473): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000c80)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000000)='\x00', 0x1, 0xc891, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x8012, 0x0, 0xfffffffffffffe2d) recvfrom$inet(r0, &(0x7f0000000080)=""/7, 0x7, 0x10064, 0x0, 0x0) 3.225003462s ago: executing program 3 (id=475): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8000000190001000000000000000100e00000020000000000000000e6ff001200000000000000000000000000000000000000000000004c0a002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0800000000000000100000000000000002000000010000000000000000000000ff0f00000000000073b4ffffffffffffffffffffffffffff00000000000000000000000010000000000000000000002002000000000000000200000000000000feff"], 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 3.118407908s ago: executing program 3 (id=476): open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000006c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000640), &(0x7f0000000680)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2}, 0xc) 3.061073161s ago: executing program 2 (id=477): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0xfffd, 0x4000000, @loopback, 0xdb}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000001840), 0x4) 2.98414885s ago: executing program 3 (id=478): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2, 0x0, 0x400000}, 0x4c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x421, 0x4, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x26d2}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_XFRM_LINK={0x8, 0x1, 0x3}, @IFLA_XFRM_IF_ID={0x8, 0x2, 0x25}]}}}]}, 0x44}}, 0xc080) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) 2.925014905s ago: executing program 2 (id=479): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f0000002340)=[{&(0x7f0000001080)=""/4096, 0x1000}], 0x1}, 0x81}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x1}, 0xe}, {{0x0, 0x0, &(0x7f0000003ac0)=[{&(0x7f00000039c0)=""/16, 0x10}], 0x1}, 0xd4}], 0x3, 0x40000141, 0x0) 2.850090242s ago: executing program 0 (id=480): r0 = syz_open_dev$radio(&(0x7f0000000100), 0x1, 0x2) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(r1, &(0x7f0000000000), 0xffffff98) splice(r0, 0x0, r1, 0x0, 0x5, 0x8) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x123}, 0x10, 0x0) landlock_restrict_self(r2, 0x9) 2.650163157s ago: executing program 3 (id=481): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) sendmsg$unix(r2, &(0x7f0000004540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x4000) close_range(r1, r2, 0x0) 2.362702403s ago: executing program 3 (id=482): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0, 0x0) r1 = fanotify_init(0x8, 0x1000) fanotify_mark(r1, 0x39, 0x1a, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) 2.173637653s ago: executing program 3 (id=483): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101c1b021b00000000000109022400010000400009040000010300400009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000200)={0x40, 0x40, 0x1, "80"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f00000003c0)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.945196345s ago: executing program 2 (id=484): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000240)=@req3={0x1000, 0x1, 0x1000, 0x1, 0x7ff, 0xf84, 0x3}, 0x1c) syz_emit_ethernet(0x36, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000000)={@multicast, @random="c59a1b746cda", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "0300", 0x0, 0x1d, 0xff, @remote, @local}}}}, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[], 0x0) 1.860246987s ago: executing program 0 (id=485): r0 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000200)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x3b}}, 0x10, 0x0}, 0x3000c085) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f0000000100)=r1, 0x4) sendmsg$inet(r0, 0x0, 0x844) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0xeafbff3, &(0x7f0000000000)=[{&(0x7f0000000300)="b8", 0xfffffdef}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) 1.572589232s ago: executing program 2 (id=486): prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000001c0)={0x18, 0x110, 0xfa00, {r2, 0x7fffffff, 0x12, 0x0, 0x0, @ib={0x1b, 0x5, 0x6, {"78c36cbe7e38dade0099fe4e9d908e9b"}, 0xffff, 0x1ff, 0xfffffffeffffffff}, @in6={0xa, 0x4e22, 0x2, @local, 0x2}}}, 0x118) 1.387944169s ago: executing program 2 (id=487): pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffff82048008, 0x0, 0x40, 0x8, 0x0, 0x0, 0x0, 0x104, 0x8}}, 0x50) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) 905.215604ms ago: executing program 0 (id=488): r0 = socket$kcm(0xa, 0x1, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000ffffffff0500"/20, @ANYRES32=r0], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 487.718508ms ago: executing program 0 (id=489): r0 = fsopen(&(0x7f0000000000)='debugfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x11) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x4) getdents(r2, 0x0, 0x0) 96.421095ms ago: executing program 2 (id=490): r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x28fb87, 0x800, 0x1, 0x3a}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x59e6, 0x80, 0x1, 0x15e, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x8, 0x10000000, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x1, 0x3, 0x0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9621, 0x40, 0x82, 0xbd}}], 0x1, &(0x7f0000000340)={0x2e, 0x54, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x4, 0x0, 0x0}}, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f0000000340)={0x3e, {0x0, 0x1, 0x0, 0x4, 0x5}}) 82.537131ms ago: executing program 0 (id=491): r0 = socket$netlink(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x777) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='0', 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040001}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0xffffff0f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x8}]}, 0x3c}}, 0x0) 0s ago: executing program 4 (id=492): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) preadv(r1, &(0x7f0000001600)=[{&(0x7f00000000c0)=""/91, 0x5b}], 0x1, 0xa2e3, 0xc) r2 = openat$cgroup_procs(r0, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) sendfile(r2, r2, 0x0, 0x10001) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts. [ 91.998271][ T197] cfg80211: failed to load regulatory.db [ 92.900672][ T5577] cgroup: Unknown subsys name 'net' [ 93.152523][ T5577] cgroup: Unknown subsys name 'cpuset' [ 93.205605][ T5577] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.169549][ T5577] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 99.775623][ T5605] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 99.804698][ T5605] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.835467][ T5605] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 99.837365][ T5605] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 99.859400][ T5607] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 99.884237][ T5607] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 99.887198][ T5611] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.887669][ T5607] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 99.898177][ T5607] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 99.909876][ T5607] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 99.913943][ T5607] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 99.929133][ T5607] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 99.939871][ T59] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 100.012019][ T5610] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 100.052107][ T5610] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.115514][ T4906] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.115557][ T59] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 100.144309][ T59] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 100.154717][ T59] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 100.156927][ T59] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 100.159907][ T4906] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 100.190455][ T4906] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.199236][ T5611] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.220958][ T5611] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.222282][ T5611] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.117171][ T5611] Bluetooth: hci3: command tx timeout [ 102.117301][ T5611] Bluetooth: hci1: command tx timeout [ 102.117518][ T4906] Bluetooth: hci4: command tx timeout [ 102.355040][ T5601] Bluetooth: hci0: command tx timeout [ 102.355277][ T4906] Bluetooth: hci2: command tx timeout [ 102.716654][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.717502][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.717653][ T5599] bridge_slave_0: entered allmulticast mode [ 102.719694][ T5599] bridge_slave_0: entered promiscuous mode [ 102.790550][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.790703][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.791051][ T5599] bridge_slave_1: entered allmulticast mode [ 102.792964][ T5599] bridge_slave_1: entered promiscuous mode [ 102.972467][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.972601][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.972812][ T5596] bridge_slave_0: entered allmulticast mode [ 102.974789][ T5596] bridge_slave_0: entered promiscuous mode [ 103.008412][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.057161][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.057451][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.057633][ T5596] bridge_slave_1: entered allmulticast mode [ 103.060209][ T5596] bridge_slave_1: entered promiscuous mode [ 103.099164][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.122037][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.122169][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.122538][ T5598] bridge_slave_0: entered allmulticast mode [ 103.125930][ T5598] bridge_slave_0: entered promiscuous mode [ 103.144491][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.144811][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.153506][ T5595] bridge_slave_0: entered allmulticast mode [ 103.161731][ T5595] bridge_slave_0: entered promiscuous mode [ 103.221343][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.221480][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.221643][ T5598] bridge_slave_1: entered allmulticast mode [ 103.223808][ T5598] bridge_slave_1: entered promiscuous mode [ 103.249602][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.249947][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.251388][ T5595] bridge_slave_1: entered allmulticast mode [ 103.263099][ T5595] bridge_slave_1: entered promiscuous mode [ 103.312121][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.312249][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.312411][ T5597] bridge_slave_0: entered allmulticast mode [ 103.337039][ T5597] bridge_slave_0: entered promiscuous mode [ 103.378253][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.380751][ T5599] team0: Port device team_slave_0 added [ 103.381012][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.381160][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.381327][ T5597] bridge_slave_1: entered allmulticast mode [ 103.383458][ T5597] bridge_slave_1: entered promiscuous mode [ 103.452533][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.454625][ T5599] team0: Port device team_slave_1 added [ 103.497545][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.504723][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.577155][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.579733][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.629373][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.667100][ T5596] team0: Port device team_slave_0 added [ 103.668998][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.669011][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.669032][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.673740][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.758269][ T5596] team0: Port device team_slave_1 added [ 103.759079][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.759090][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.759109][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.815418][ T5598] team0: Port device team_slave_0 added [ 103.823823][ T5595] team0: Port device team_slave_0 added [ 103.874789][ T5598] team0: Port device team_slave_1 added [ 103.882588][ T5595] team0: Port device team_slave_1 added [ 103.907741][ T5597] team0: Port device team_slave_0 added [ 103.942272][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.942284][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.942303][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.958339][ T5597] team0: Port device team_slave_1 added [ 104.051903][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.051916][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.051935][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.052994][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.053004][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.053022][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.054688][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.054698][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.054716][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.195037][ T5601] Bluetooth: hci1: command tx timeout [ 104.195087][ T5601] Bluetooth: hci3: command tx timeout [ 104.195225][ T4906] Bluetooth: hci4: command tx timeout [ 104.204151][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.204164][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.204183][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.221723][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.221797][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.221888][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.435064][ T5611] Bluetooth: hci2: command tx timeout [ 104.435086][ T4906] Bluetooth: hci0: command tx timeout [ 104.663864][ T5599] hsr_slave_0: entered promiscuous mode [ 104.667092][ T5599] hsr_slave_1: entered promiscuous mode [ 104.677177][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.677188][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.677207][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.790297][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.790316][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.790345][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.936302][ T5596] hsr_slave_0: entered promiscuous mode [ 104.937339][ T5596] hsr_slave_1: entered promiscuous mode [ 104.938124][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 104.938218][ T5596] Cannot create hsr debugfs directory [ 105.026571][ T5598] hsr_slave_0: entered promiscuous mode [ 105.027936][ T5598] hsr_slave_1: entered promiscuous mode [ 105.028926][ T5598] debugfs: 'hsr0' already exists in 'hsr' [ 105.028950][ T5598] Cannot create hsr debugfs directory [ 105.058539][ T5595] hsr_slave_0: entered promiscuous mode [ 105.059556][ T5595] hsr_slave_1: entered promiscuous mode [ 105.060207][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 105.060232][ T5595] Cannot create hsr debugfs directory [ 105.146475][ T5597] hsr_slave_0: entered promiscuous mode [ 105.147467][ T5597] hsr_slave_1: entered promiscuous mode [ 105.148228][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 105.148254][ T5597] Cannot create hsr debugfs directory [ 106.090357][ T5599] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 106.139614][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.142611][ T5599] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 106.168746][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.174556][ T5599] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 106.223768][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.249174][ T5599] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 106.275159][ T5611] Bluetooth: hci3: command tx timeout [ 106.275194][ T5611] Bluetooth: hci1: command tx timeout [ 106.275272][ T4906] Bluetooth: hci4: command tx timeout [ 106.280983][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.414544][ T5598] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.453035][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.469301][ T5598] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.508513][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.513980][ T5598] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.516025][ T4906] Bluetooth: hci0: command tx timeout [ 106.516116][ T4906] Bluetooth: hci2: command tx timeout [ 106.569931][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.601665][ T5598] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.642796][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.814722][ T5595] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.852062][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.866724][ T5595] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.901273][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.912851][ T5595] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.941177][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.973011][ T5595] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 107.022337][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.184818][ T5596] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.232148][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.247047][ T5596] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.280110][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.292610][ T5596] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.361409][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.413618][ T5596] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.439167][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.554201][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.621758][ T5597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 107.650795][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.665296][ T5597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 107.683944][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.700617][ T5597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 107.748332][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.769659][ T5597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 107.809527][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.833643][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.870034][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.901274][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.901422][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.968290][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.968538][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.040933][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.093578][ T1177] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.093769][ T1177] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.136405][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.152764][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.164357][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.295709][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.356484][ T4906] Bluetooth: hci4: command tx timeout [ 108.356510][ T5611] Bluetooth: hci3: command tx timeout [ 108.356540][ T5611] Bluetooth: hci1: command tx timeout [ 108.380086][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.393827][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.414436][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.473195][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.481325][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.582163][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.595575][ T5601] Bluetooth: hci2: command tx timeout [ 108.595624][ T4906] Bluetooth: hci0: command tx timeout [ 108.694739][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.734833][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.739797][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.821226][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.821388][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.937449][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.051189][ T1473] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.052934][ T1473] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.207195][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.207417][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.693065][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.361280][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.457703][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.788707][ T5598] veth0_vlan: entered promiscuous mode [ 110.902608][ T5595] veth0_vlan: entered promiscuous mode [ 110.924042][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.933199][ T5598] veth1_vlan: entered promiscuous mode [ 110.949914][ T5599] veth0_vlan: entered promiscuous mode [ 111.004603][ T5599] veth1_vlan: entered promiscuous mode [ 111.023670][ T5595] veth1_vlan: entered promiscuous mode [ 111.044783][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.137990][ T5598] veth0_macvtap: entered promiscuous mode [ 111.181263][ T5598] veth1_macvtap: entered promiscuous mode [ 111.219417][ T5595] veth0_macvtap: entered promiscuous mode [ 111.233856][ T5599] veth0_macvtap: entered promiscuous mode [ 111.250240][ T5596] veth0_vlan: entered promiscuous mode [ 111.298050][ T5595] veth1_macvtap: entered promiscuous mode [ 111.299994][ T5599] veth1_macvtap: entered promiscuous mode [ 111.357662][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.360035][ T5596] veth1_vlan: entered promiscuous mode [ 111.363514][ T5597] veth0_vlan: entered promiscuous mode [ 111.407702][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.444117][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.450517][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.484284][ T5597] veth1_vlan: entered promiscuous mode [ 111.498043][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.499776][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.860608][ T5596] veth0_macvtap: entered promiscuous mode [ 112.146388][ T5596] veth1_macvtap: entered promiscuous mode [ 112.490019][ T5597] veth0_macvtap: entered promiscuous mode [ 112.586556][ T5597] veth1_macvtap: entered promiscuous mode [ 112.642210][ T1473] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.642241][ T1473] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.683613][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.777885][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.814171][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.839341][ T1177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.839357][ T1177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.864573][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.016661][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.016679][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.235999][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.236019][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.752903][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.752932][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.040378][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.040408][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.140649][ T1411] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.140682][ T1411] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.171626][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.425569][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.425590][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.455238][ T1411] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.455485][ T1411] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.506305][ T1411] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.536507][ T1177] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.537064][ T1177] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.537259][ T1177] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.609087][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.609107][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.730054][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.730076][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.766740][ T57] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.961059][ T3324] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.962593][ T3324] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.962644][ T3324] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.962685][ T3324] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.962725][ T3324] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963771][ T3324] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963820][ T3324] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963861][ T3324] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963901][ T3324] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963941][ T3324] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.963980][ T3324] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.964021][ T3324] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.937040][ T5815] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12'. [ 118.938017][ T9] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 119.477206][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 119.481047][ T9] usb 5-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 119.591232][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.591262][ T9] usb 5-1: Product: syz [ 119.591277][ T9] usb 5-1: Manufacturer: syz [ 119.591293][ T9] usb 5-1: SerialNumber: syz [ 119.645190][ T5725] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 119.793232][ T5849] IPVS: Scheduler module ip_vs_ not found [ 119.874953][ T5725] usb 1-1: Using ep0 maxpacket: 32 [ 119.875932][ T5725] usb 1-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 119.877668][ T5725] usb 1-1: config 0 has an invalid interface number: 146 but max is 0 [ 119.877694][ T5725] usb 1-1: config 0 has no interface number 0 [ 119.877755][ T5725] usb 1-1: config 0 interface 146 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 119.877787][ T5725] usb 1-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 119.877815][ T5725] usb 1-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 119.878049][ T5725] usb 1-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 119.878077][ T5725] usb 1-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xF2, changing to 0x82 [ 119.878102][ T5725] usb 1-1: config 0 interface 146 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 119.878126][ T5725] usb 1-1: config 0 interface 146 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 119.878150][ T5725] usb 1-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid maxpacket 19968, setting to 1024 [ 119.878177][ T5725] usb 1-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 1024 [ 119.878201][ T5725] usb 1-1: config 0 interface 146 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 119.883188][ T5725] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.883211][ T5725] usb 1-1: Product: syz [ 119.883225][ T5725] usb 1-1: Manufacturer: syz [ 119.883239][ T5725] usb 1-1: SerialNumber: syz [ 120.174629][ T9] usb 5-1: config 0 descriptor?? [ 120.236600][ T5725] usb 1-1: config 0 descriptor?? [ 120.341395][ T5844] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.341688][ T5844] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 120.649913][ T5725] usb 1-1: will this work? Response EP is not usually 3 [ 120.649937][ T5725] usb 1-1: will this work? Image data EP is not usually 2 [ 120.740267][ T9] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 121.030056][ T9] gspca_ov534_9: reg_w failed -71 [ 121.058989][ T5725] scsi host1: microtekX6 [ 121.436497][ T9] gspca_ov534_9: Unknown sensor 0000 [ 121.436615][ T9] ov534_9 5-1:0.0: probe with driver ov534_9 failed with error -22 [ 121.601396][ T9] usb 5-1: USB disconnect, device number 2 [ 121.620139][ T5725] usb 1-1: USB disconnect, device number 2 [ 122.941699][ T5892] netlink: 'syz.1.40': attribute type 1 has an invalid length. [ 123.216870][ T5837] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 123.488292][ T5837] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 123.489840][ T5837] usb 5-1: config 1 interface 0 altsetting 13 endpoint 0x2 has an invalid bInterval 32, changing to 9 [ 123.489870][ T5837] usb 5-1: config 1 interface 0 has no altsetting 0 [ 123.526379][ T5837] usb 5-1: string descriptor 0 read error: -22 [ 123.526534][ T5837] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.401200][ T5902] Zero length message leads to an empty skb [ 124.450025][ T5837] keytouch 0003:0926:3333.0001: fixing up Keytouch IEC report descriptor [ 124.660639][ T5837] input: HID 0926:3333 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/0003:0926:3333.0001/input/input5 [ 125.324011][ T5908] overlayfs: upper fs does not support file handles, falling back to index=off. [ 125.434992][ T5725] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 125.435264][ C1] raw-gadget.0 gadget.0: ignoring, device is not running [ 125.697397][ T5837] keytouch 0003:0926:3333.0001: input,hidraw0: USB HID v0.05 Keyboard [HID 0926:3333] on usb-dummy_hcd.4-1/input0 [ 125.834143][ T5837] usb 5-1: USB disconnect, device number 3 [ 126.730177][ T5945] capability: warning: `syz.4.60' uses 32-bit capabilities (legacy support in use) [ 127.156745][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 127.232333][ T5956] netlink: 24 bytes leftover after parsing attributes in process `syz.1.63'. [ 127.315598][ T997] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 127.341969][ T31] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 127.369459][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.442466][ T31] usb 1-1: config 0 descriptor?? [ 127.492647][ T5951] netlink: 15902 bytes leftover after parsing attributes in process `syz.2.62'. [ 127.568643][ T997] usb 3-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 127.576336][ T997] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 127.576373][ T997] usb 3-1: can't read configurations, error -71 [ 127.800672][ T4906] Bluetooth: hci2: command tx timeout [ 128.409329][ T5970] syz.3.68 uses obsolete (PF_INET,SOCK_PACKET) [ 128.806597][ T31] usb 1-1: Cannot set autoneg [ 128.810081][ T31] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 128.883643][ T31] usb 1-1: USB disconnect, device number 4 [ 130.366022][ T997] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 130.544921][ T997] usb 5-1: Using ep0 maxpacket: 16 [ 130.545873][ T997] usb 5-1: New USB device found, idVendor=1b1c, idProduct=1b25, bcdDevice= 0.00 [ 130.552447][ T997] usb 5-1: config 0 interface 0 altsetting 13 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.552569][ T997] usb 5-1: config 0 interface 0 altsetting 13 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.552595][ T997] usb 5-1: config 0 interface 0 has no altsetting 0 [ 130.552631][ T997] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.636399][ T997] usb 5-1: config 0 descriptor?? [ 130.879633][ T6002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.942608][ T6002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.215875][ T997] hid-corsair-void 0003:1B1C:1B25.0002: unknown main item tag 0x0 [ 131.215910][ T997] hid-corsair-void 0003:1B1C:1B25.0002: unknown main item tag 0x1 [ 131.215934][ T997] hid-corsair-void 0003:1B1C:1B25.0002: item fetching failed at offset 4/5 [ 131.216604][ T997] hid-corsair-void 0003:1B1C:1B25.0002: parse failed (reason: -22) [ 131.216728][ T997] hid-corsair-void 0003:1B1C:1B25.0002: probe with driver hid-corsair-void failed with error -22 [ 131.429085][ T5725] usb 5-1: USB disconnect, device number 4 [ 132.183616][ T6037] zero sized request [ 132.498701][ T6092] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 132.928228][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.928324][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.805268][ T5725] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 133.996254][ T5725] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 133.998832][ T5725] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.317646][ T5725] cdc_acm 5-1:1.0: ttyACM0: USB ACM device [ 134.376303][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 134.508869][ T6139] netlink: 12 bytes leftover after parsing attributes in process `syz.2.110'. [ 134.550387][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 134.560186][ T9] usb 1-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 134.572057][ T9] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 134.572086][ T9] usb 1-1: config 0 has no interface number 0 [ 134.639733][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.639780][ T9] usb 1-1: Product: syz [ 134.639795][ T9] usb 1-1: Manufacturer: syz [ 134.639810][ T9] usb 1-1: SerialNumber: syz [ 134.662998][ T10] usb 5-1: USB disconnect, device number 5 [ 134.744500][ T9] usb 1-1: config 0 descriptor?? [ 134.812121][ T9] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 135.289822][ T6149] device-mapper: ioctl: name not supplied when creating device [ 136.031116][ T9] gspca_spca1528: reg_w err -71 [ 136.031228][ T9] spca1528 1-1:0.1: probe with driver spca1528 failed with error -71 [ 136.146375][ T9] usb 1-1: USB disconnect, device number 5 [ 136.990468][ T6185] warning: `syz.4.131' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 138.255354][ T6220] netlink: 40 bytes leftover after parsing attributes in process `syz.1.141'. [ 138.255376][ T6220] tipc: Invalid UDP bearer configuration [ 138.255420][ T6220] tipc: Enabling of bearer rejected, failed to enable media [ 138.452860][ T6223] capability: warning: `syz.1.144' uses deprecated v2 capabilities in a way that may be insecure [ 140.054815][ T6270] netlink: 64 bytes leftover after parsing attributes in process `syz.0.160'. [ 140.186688][ T6274] ======================================================= [ 140.186688][ T6274] WARNING: The mand mount option has been deprecated and [ 140.186688][ T6274] and is ignored by this kernel. Remove the mand [ 140.186688][ T6274] option from the mount to silence this warning. [ 140.186688][ T6274] ======================================================= [ 141.627075][ T37] audit: type=1800 audit(1787654066.644:2): pid=6300 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.172" name=05 dev="tmpfs" ino=157 res=0 errno=0 [ 141.768261][ T6305] netlink: 24 bytes leftover after parsing attributes in process `syz.1.175'. [ 141.768302][ T6305] netlink: 'syz.1.175': attribute type 1 has an invalid length. [ 141.768317][ T6305] netlink: 28 bytes leftover after parsing attributes in process `syz.1.175'. [ 141.995020][ T5725] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 142.150451][ T5725] usb 1-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 142.151989][ T5725] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 142.152044][ T5725] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 142.152068][ T5725] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 142.152093][ T5725] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 142.152144][ T5725] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.372043][ T5725] gud 1-1:1.0: USB-1: Failed to add properties (ret=-5) [ 143.372096][ T5725] gud 1-1:1.0: Failed to get connectors (error=-5) [ 143.372132][ T5725] gud 1-1:1.0: probe with driver gud failed with error -5 [ 143.504139][ T6323] loop2: detected capacity change from 0 to 7 [ 143.590848][ T31] usb 1-1: USB disconnect, device number 6 [ 143.688273][ T5784] udevd[5784]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 143.837081][ T6323] Dev loop2: unable to read RDB block 7 [ 143.837123][ T6323] loop2: AHDI p1 p2 p3 [ 143.837138][ T6323] loop2: partition table partially beyond EOD, truncated [ 143.915628][ T5784] udevd[5784]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 143.939636][ T6323] loop2: p1 start 1601398130 is beyond EOD, truncated [ 143.939657][ T6323] loop2: p2 start 1702059890 is beyond EOD, truncated [ 144.012836][ T5784] udevd[5784]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 144.050835][ T5784] udevd[5784]: inotify_add_watch(7, /dev/loop2, 10) failed: No such file or directory [ 144.567793][ T6343] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 144.738249][ T6354] device-mapper: ioctl: Invalid data size in the ioctl structure: 0 [ 144.788919][ T6344] netlink: 48 bytes leftover after parsing attributes in process `syz.4.189'. [ 145.087051][ T6359] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 146.055368][ T6393] netlink: 12 bytes leftover after parsing attributes in process `syz.4.210'. [ 146.175033][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 146.346035][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 146.347204][ T31] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 146.349641][ T31] usb 4-1: config index 0 descriptor too short (expected 27632, got 27) [ 146.349667][ T31] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 146.349699][ T31] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 146.349722][ T31] usb 4-1: config 1 has no interface number 0 [ 146.349770][ T31] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 146.349798][ T31] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 146.349842][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.488855][ T31] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found [ 146.522108][ T6389] mmap: syz.0.208 (6389) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 146.769921][ T31] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached [ 147.033862][ T37] audit: type=1326 audit(1787654072.084:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6406 comm="syz.2.215" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f99a4b8e0d9 code=0x0 [ 147.218654][ T10] usb 4-1: USB disconnect, device number 2 [ 147.222135][ T10] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected [ 147.404980][ T5826] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 147.576355][ T5826] usb 1-1: Using ep0 maxpacket: 8 [ 147.577548][ T5826] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 147.579217][ T5826] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 147.579250][ T5826] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 147.579275][ T5826] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 147.579300][ T5826] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 147.579341][ T5826] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 148.035194][ T5826] usb 1-1: GET_CAPABILITIES returned 0 [ 148.035236][ T5826] usbtmc 1-1:16.0: can't read capabilities [ 149.593635][ T6439] Bluetooth: MGMT ver 1.23 [ 149.890164][ T6415] syz.4.217 (6415) used greatest stack depth: 18952 bytes left [ 149.941455][ T6447] process 'syz.3.231' launched './file0' with NULL argv: empty string added [ 150.271977][ T31] usb 1-1: USB disconnect, device number 7 [ 151.665220][ T5837] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 151.837059][ T5837] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 151.839484][ T5837] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 151.839513][ T5837] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 151.870828][ T5837] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.870855][ T5837] usb 4-1: Product: syz [ 151.870869][ T5837] usb 4-1: Manufacturer: syz [ 151.870884][ T5837] usb 4-1: SerialNumber: syz [ 152.810473][ T6504] netlink: 'syz.4.251': attribute type 1 has an invalid length. [ 153.133907][ C1] usb 4-1: short message received [ 153.464339][ T6507] bond1: (slave veth0_to_bond): making interface the new active one [ 153.490012][ T6507] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 154.136961][ T6517] faux_driver vgem: [drm] Unknown color mode 11176; guessing buffer size. [ 154.911458][ T6527] 0x000000000000-0x000000020000 : "" [ 154.933831][ T6527] ftl_cs: FTL header not found. [ 156.253823][ T6543] netlink: 4 bytes leftover after parsing attributes in process `syz.4.267'. [ 156.304983][ T5837] usb 4-1: USB disconnect, device number 3 [ 156.347357][ C1] usb 4-1: failed to resubmit in-urb: -2 [ 156.347603][ C1] usb 4-1: failed to resubmit arpc in-urb: -19 [ 156.347662][ C1] usb 4-1: failed to resubmit arpc in-urb: -19 [ 156.352885][ T5837] usb 4-1: failed to send ARPC request 4: -19 [ 156.352971][ T5837] usb 4-1: failed to execute ARPC: -19 [ 156.352988][ T5837] usb 4-1: failed to flush cport 0: -19 [ 156.353007][ T5837] greybus greybus1: 0/0:0: failed to flush host cport: -19 [ 156.353181][ T5837] usb 4-1: failed to send ARPC request 2: -19 [ 156.353256][ T5837] usb 4-1: failed to execute ARPC: -19 [ 156.353273][ T5837] usb 4-1: failed to quiesce cport 0: -19 (0) [ 156.353293][ T5837] greybus greybus1: 0/0:0: failed to quiesce host cport: -19 [ 156.353824][ T5837] usb 4-1: failed to send ARPC request 3: -19 [ 156.353906][ T5837] usb 4-1: failed to execute ARPC: -19 [ 156.353923][ T5837] usb 4-1: failed to clear cport 0: -19 [ 156.353941][ T5837] greybus greybus1: 0/0:0: failed to clear host cport: -19 [ 158.326726][ T5826] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 158.475991][ T5826] usb 2-1: Using ep0 maxpacket: 32 [ 158.500387][ T5826] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 158.543353][ T5826] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.543383][ T5826] usb 2-1: Product: syz [ 158.543398][ T5826] usb 2-1: Manufacturer: syz [ 158.543412][ T5826] usb 2-1: SerialNumber: syz [ 158.610416][ T5826] usb 2-1: config 0 descriptor?? [ 158.647862][ T5826] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 158.704586][ T6581] genirq: Flags mismatch irq 7. 00202000 (das16m1) vs. 00202080 (ttyS3) [ 159.125548][ T6592] netlink: 12 bytes leftover after parsing attributes in process `syz.4.285'. [ 159.880798][ T6614] netlink: 12 bytes leftover after parsing attributes in process `syz.0.295'. [ 159.902039][ T5826] gspca_ov534_9: reg_w failed -71 [ 159.943181][ T6614] netlink: 12 bytes leftover after parsing attributes in process `syz.0.295'. [ 160.092719][ T31] kernel read not supported for file /rfkill (pid: 31 comm: kworker/1:0) [ 160.184998][ T5826] gspca_ov534_9: Unknown sensor 0000 [ 160.185100][ T5826] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 160.226523][ T5826] usb 2-1: USB disconnect, device number 2 [ 160.678466][ T6633] netlink: 24 bytes leftover after parsing attributes in process `syz.4.303'. [ 162.055127][ T5837] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 162.235016][ T5837] usb 3-1: Using ep0 maxpacket: 16 [ 162.236502][ T5837] usb 3-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 162.243568][ T5837] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 162.323526][ T5837] usb 3-1: config 0 descriptor?? [ 162.448473][ T5837] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 162.591901][ T5837] usb 3-1: Detected FT232B [ 162.805002][ T5837] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 162.844298][ T5837] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 163.036911][ T5826] usb 3-1: USB disconnect, device number 4 [ 163.173745][ T5826] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 163.193902][ T5826] ftdi_sio 3-1:0.0: device disconnected [ 164.469711][ T6702] netlink: 'syz.3.332': attribute type 4 has an invalid length. [ 164.532130][ T6704] netlink: 'syz.3.332': attribute type 4 has an invalid length. [ 165.034206][ T6077] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.616255][ T6077] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 165.790535][ T5601] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 165.831228][ T5601] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 165.843382][ T5601] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 165.856078][ T5601] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 165.858372][ T5601] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 166.480848][ T6077] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.287992][ T6077] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.035100][ T4906] Bluetooth: hci3: command tx timeout [ 169.413007][ T6792] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 169.510120][ T6799] synth uevent: /bus/acpi: unknown uevent action string [ 169.663369][ T6077] bridge_slave_1: left allmulticast mode [ 169.663524][ T6077] bridge_slave_1: left promiscuous mode [ 169.690833][ T6077] bridge0: port 2(bridge_slave_1) entered disabled state [ 169.774998][ T5826] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 169.933825][ T5826] usb 4-1: unable to get BOS descriptor or descriptor too short [ 169.933886][ T5826] usb 4-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40 [ 169.937105][ T5826] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 169.937129][ T5826] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 169.977860][ T5826] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.977886][ T5826] usb 4-1: Product: syz [ 169.977901][ T5826] usb 4-1: Manufacturer: syz [ 169.977915][ T5826] usb 4-1: SerialNumber: syz [ 170.011062][ T6077] bridge_slave_0: left allmulticast mode [ 170.011099][ T6077] bridge_slave_0: left promiscuous mode [ 170.011369][ T6077] bridge0: port 1(bridge_slave_0) entered disabled state [ 170.058262][ T5826] usb 4-1: selecting invalid altsetting 1 [ 170.088096][ T5826] usb 4-1: unit 6 not found! [ 170.115056][ T4906] Bluetooth: hci3: command tx timeout [ 170.115181][ T5603] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 170.300390][ T5603] usb 3-1: Using ep0 maxpacket: 32 [ 170.301308][ T5603] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 170.302861][ T5603] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 170.302886][ T5603] usb 3-1: config 0 has no interface number 0 [ 170.302934][ T5603] usb 3-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 170.302960][ T5603] usb 3-1: config 0 interface 184 has no altsetting 0 [ 170.357995][ T5603] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 170.358023][ T5603] usb 3-1: Product: syz [ 170.358038][ T5603] usb 3-1: Manufacturer: syz [ 170.358053][ T5603] usb 3-1: SerialNumber: syz [ 170.417911][ T5603] usb 3-1: config 0 descriptor?? [ 170.420472][ T6809] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 170.681863][ T6809] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 170.883468][ T5826] usb 4-1: 2:0: sticky mixer values (0/123/1 => 0), disabling [ 170.883517][ T5826] usb 4-1: check MIXER_GET_CUR_BROKEN if you believe the mixer is non-sticky [ 171.543716][ T5603] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 171.747903][ T5603] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 171.747932][ T5603] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 171.747951][ T5603] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 171.747970][ T5603] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 171.749261][ T5603] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 171.894978][ T5603] usb 3-1: USB disconnect, device number 5 [ 172.197831][ T4906] Bluetooth: hci3: command tx timeout [ 172.704003][ T5826] usb 4-1: USB disconnect, device number 4 [ 172.809760][ T5784] udevd[5784]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 173.808244][ T6077] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 173.895943][ T6077] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 173.922641][ T6077] bond0 (unregistering): Released all slaves [ 174.275359][ T4906] Bluetooth: hci3: command tx timeout [ 175.522447][ T6879] ceph: No mds server is up or the cluster is laggy [ 175.578803][ T5837] libceph: connect (1)[c::]:6789 error -101 [ 175.579568][ T5837] libceph: mon0 (1)[c::]:6789 connect error [ 175.742649][ T6890] netlink: 8 bytes leftover after parsing attributes in process `syz.3.397'. [ 175.887368][ T5603] libceph: connect (1)[c::]:6789 error -101 [ 175.889405][ T5603] libceph: mon0 (1)[c::]:6789 connect error [ 176.635049][ T5603] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 176.664568][ T5253] 8021q: adding VLAN 0 to HW filter on device eth1 [ 176.820032][ T5603] usb 3-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 176.821396][ T5603] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 176.821421][ T5603] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 176.821457][ T5603] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 177.001865][ T5603] spcp8x5 3-1:1.0: SPCP8x5 converter detected [ 177.105186][ T5603] usb 3-1: SPCP8x5 converter now attached to ttyUSB0 [ 177.385612][ T6908] SPCP8x5 ttyUSB0: failed to set control lines: -110 [ 177.386290][ T6908] SPCP8x5 ttyUSB0: Set UART format 0x30b failed (error = -32) [ 177.422848][ T6908] SPCP8x5 ttyUSB0: failed to set control lines: -32 [ 177.602788][ T6908] SPCP8x5 ttyUSB0: Set UART format 0x3709 failed (error = -32) [ 178.066381][ T9] usb 3-1: USB disconnect, device number 6 [ 178.138948][ T9] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 178.144671][ T9] spcp8x5 3-1:1.0: device disconnected [ 178.819927][ T6719] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.820112][ T6719] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.820314][ T6719] bridge_slave_0: entered allmulticast mode [ 178.898599][ T6719] bridge_slave_0: entered promiscuous mode [ 178.923945][ T5253] 8021q: adding VLAN 0 to HW filter on device eth2 [ 178.927688][ T6719] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.928041][ T6719] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.932311][ T6719] bridge_slave_1: entered allmulticast mode [ 178.988858][ T6719] bridge_slave_1: entered promiscuous mode [ 179.678692][ T6077] hsr_slave_0: left promiscuous mode [ 179.724587][ T6077] hsr_slave_1: left promiscuous mode [ 179.782417][ T6077] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.782507][ T6077] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.877986][ T6077] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.878016][ T6077] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 180.044955][ T10] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 180.120091][ T6077] veth1_macvtap: left promiscuous mode [ 180.120388][ T6077] veth0_macvtap: left promiscuous mode [ 180.141961][ T6077] veth1_vlan: left promiscuous mode [ 180.142370][ T6077] veth0_vlan: left promiscuous mode [ 180.198000][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 180.247196][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.247222][ T10] usb 1-1: Product: syz [ 180.247236][ T10] usb 1-1: Manufacturer: syz [ 180.247250][ T10] usb 1-1: SerialNumber: syz [ 180.771354][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 180.771435][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 181.384397][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 181.384458][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 181.605439][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 181.682460][ T10] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 181.904166][ T10] usb 1-1: USB disconnect, device number 8 [ 182.144966][ T9] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 182.306447][ T9] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 182.307824][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 182.307878][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.377262][ T9] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 182.377527][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 182.377579][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 182.433331][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 182.433426][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 182.528272][ T9] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 182.640875][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 88 [ 182.640969][ T9] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 182.667302][ T9] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 182.687781][ T9] usb 5-1: USB disconnect, device number 6 [ 182.819618][ T9] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 182.884207][ T9] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 182.950001][ T9] keyspan 5-1:1.0: device disconnected [ 183.444187][ T6077] team0 (unregistering): Port device team_slave_1 removed [ 183.676542][ T6077] team0 (unregistering): Port device team_slave_0 removed [ 184.133878][ T5826] kernel read not supported for file /vcsa1 (pid: 5826 comm: kworker/0:6) [ 184.702145][ T6719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 184.793535][ T6719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 185.060664][ T6719] team0: Port device team_slave_0 added [ 185.095105][ T6719] team0: Port device team_slave_1 added [ 185.376839][ T6719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 185.376856][ T6719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.376884][ T6719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 185.382434][ T6719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 185.382449][ T6719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 185.382477][ T6719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 185.596344][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 185.747746][ T9] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 185.766091][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.766118][ T9] usb 1-1: Product: syz [ 185.766134][ T9] usb 1-1: Manufacturer: syz [ 185.766149][ T9] usb 1-1: SerialNumber: syz [ 186.082223][ T7059] loop7: detected capacity change from 0 to 16384 [ 186.190111][ T6719] hsr_slave_0: entered promiscuous mode [ 186.210253][ T6719] hsr_slave_1: entered promiscuous mode [ 186.224005][ T6719] debugfs: 'hsr0' already exists in 'hsr' [ 186.224033][ T6719] Cannot create hsr debugfs directory [ 186.264988][ T997] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 186.311514][ T7061] loop7: detected capacity change from 16384 to 0 [ 186.331393][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 186.331459][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 186.561876][ T997] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 186.585415][ T997] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 186.585451][ T997] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 186.585492][ T997] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.706854][ T997] usb 3-1: config 0 descriptor?? [ 186.835025][ T5603] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 186.993690][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000000. ret = -EPROTO [ 186.993753][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 187.055869][ T5603] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00 [ 187.058004][ T5603] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 187.058031][ T5603] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 187.058134][ T5603] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 187.164182][ T9] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 187.216671][ T9] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 187.361791][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.361830][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.361858][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.362453][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.362485][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.362513][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.362540][ T997] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 187.443582][ T9] usb 1-1: USB disconnect, device number 9 [ 187.465629][ T997] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 187.583855][ T997] cp2112 0003:10C4:EA90.0003: Part Number: 0x82 Device Version: 0xFE [ 187.743561][ T5253] 8021q: adding VLAN 0 to HW filter on device eth3 [ 187.897743][ T5603] gud 4-1:1.0: Failed to add properties (error=-5) [ 187.897848][ T5603] gud 4-1:1.0: probe with driver gud failed with error -5 [ 188.010244][ T997] cp2112 0003:10C4:EA90.0003: error setting SMBus config [ 188.095674][ T997] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 188.179257][ T997] usb 3-1: USB disconnect, device number 7 [ 188.354143][ T9] usb 4-1: USB disconnect, device number 5 [ 189.366513][ T7091] input: syz0 as /devices/virtual/input/input6 [ 190.402827][ T7130] Driver unsupported XDP return value 0 on prog (id 37) dev N/A, expect packet loss! [ 190.439417][ T7118] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.459118][ T7118] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.949265][ T7118] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 190.976172][ T7118] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 191.217714][ T7141] block nbd0: shutting down sockets [ 192.085013][ T6081] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.085063][ T6081] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.085102][ T6081] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 192.218281][ T7156] sd 0:0:1:0: device reset [ 192.615449][ T6086] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 193.725028][ T5603] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 193.887063][ T5603] usb 4-1: Using ep0 maxpacket: 16 [ 193.893520][ T5603] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 193.902703][ T5603] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 193.902731][ T5603] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.902764][ T5603] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 193.951918][ T5603] usb 4-1: config 0 descriptor?? [ 194.383574][ T1328] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.383638][ T1328] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.508217][ T5603] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 194.508272][ T5603] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 194.508299][ T5603] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 194.508325][ T5603] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 194.508351][ T5603] corsair 0003:1B1C:1B02.0004: unknown main item tag 0x0 [ 194.584013][ T5603] corsair 0003:1B1C:1B02.0004: hidraw0: USB HID v0.00 Device [HID 1b1c:1b02] on usb-dummy_hcd.3-1/input0 [ 194.878655][ T5603] corsair 0003:1B1C:1B02.0004: Failed to get K90 initial state (error -32). [ 194.919381][ T4906] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 194.948689][ T5603] usb 4-1: USB disconnect, device number 6 [ 195.117875][ T7221] fido_id[7221]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 195.449268][ T997] ================================================================== [ 195.449291][ T997] BUG: KASAN: slab-use-after-free in k90_backlight_work+0x174/0x1c0 [ 195.449325][ T997] Read of size 1 at addr ffff88805ef61b00 by task kworker/1:2/997 [ 195.449338][ T997] [ 195.449363][ T997] CPU: 1 UID: 0 PID: 997 Comm: kworker/1:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 195.449386][ T997] Tainted: [L]=SOFTLOCKUP SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 195.449392][ T997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.449403][ T997] Workqueue: events k90_backlight_work [ 195.449439][ T997] Call Trace: [ 195.449447][ T997] [ 195.449455][ T997] dump_stack_lvl+0xe8/0x150 [ 195.449486][ T997] print_address_description+0x55/0x1e0 [ 195.449513][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.449539][ T997] print_report+0x58/0x70 [ 195.449563][ T997] kasan_report+0x117/0x150 [ 195.449589][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.449620][ T997] ? process_scheduled_works+0x97a/0x1630 [ 195.449645][ T997] k90_backlight_work+0x174/0x1c0 [ 195.449673][ T997] process_scheduled_works+0xc3d/0x1630 [ 195.449712][ T997] ? __pfx_process_scheduled_works+0x10/0x10 [ 195.449737][ T997] ? assign_work+0x3cf/0x5d0 [ 195.449766][ T997] worker_thread+0xa47/0xfb0 [ 195.449798][ T997] ? __kthread_parkme+0x71/0x1f0 [ 195.449832][ T997] kthread+0x38b/0x470 [ 195.449863][ T997] ? __pfx_worker_thread+0x10/0x10 [ 195.449888][ T997] ? __pfx_kthread+0x10/0x10 [ 195.449920][ T997] ret_from_fork+0x514/0xb70 [ 195.449952][ T997] ? __pfx_ret_from_fork+0x10/0x10 [ 195.449984][ T997] ? __switch_to+0xc89/0x1420 [ 195.450014][ T997] ? __pfx_kthread+0x10/0x10 [ 195.450046][ T997] ret_from_fork_asm+0x1a/0x30 [ 195.450077][ T997] [ 195.450085][ T997] [ 195.450090][ T997] Allocated by task 5603: [ 195.450100][ T997] kasan_save_track+0x3e/0x80 [ 195.450122][ T997] __kasan_kmalloc+0x93/0xb0 [ 195.450144][ T997] __kmalloc_cache_noprof+0x3d5/0x680 [ 195.450166][ T997] corsair_probe+0x627/0xbc0 [ 195.450192][ T997] hid_device_probe+0x46a/0x870 [ 195.450224][ T997] really_probe+0x254/0xae0 [ 195.450254][ T997] __driver_probe_device+0x1e8/0x360 [ 195.450291][ T997] driver_probe_device+0x4f/0x240 [ 195.450321][ T997] __device_attach_driver+0x270/0x410 [ 195.450364][ T997] bus_for_each_drv+0x25b/0x2f0 [ 195.450384][ T997] __device_attach+0x2c7/0x450 [ 195.450410][ T997] device_initial_probe+0xa1/0xd0 [ 195.450437][ T997] bus_probe_device+0x12d/0x220 [ 195.450457][ T997] device_add+0x7d7/0xb80 [ 195.450481][ T997] hid_add_device+0x272/0x3e0 [ 195.450497][ T997] usbhid_probe+0x9dc/0xde0 [ 195.450514][ T997] usb_probe_interface+0x653/0xc60 [ 195.450514][ T997] usb_probe_interface+0x653/0xc60 [ 195.450544][ T997] really_probe+0x254/0xae0 [ 195.450572][ T997] __driver_probe_device+0x1e8/0x360 [ 195.450599][ T997] driver_probe_device+0x4f/0x240 [ 195.450627][ T997] __device_attach_driver+0x270/0x410 [ 195.450656][ T997] bus_for_each_drv+0x25b/0x2f0 [ 195.450676][ T997] __device_attach+0x2c7/0x450 [ 195.450701][ T997] device_initial_probe+0xa1/0xd0 [ 195.450728][ T997] bus_probe_device+0x12d/0x220 [ 195.450747][ T997] device_add+0x7d7/0xb80 [ 195.450770][ T997] usb_set_configuration+0x1ad8/0x2180 [ 195.450799][ T997] usb_generic_driver_probe+0x8d/0x150 [ 195.450827][ T997] usb_probe_device+0x1c3/0x3b0 [ 195.450855][ T997] really_probe+0x254/0xae0 [ 195.450883][ T997] __driver_probe_device+0x1e8/0x360 [ 195.450910][ T997] driver_probe_device+0x4f/0x240 [ 195.450938][ T997] __device_attach_driver+0x270/0x410 [ 195.450967][ T997] bus_for_each_drv+0x25b/0x2f0 [ 195.450987][ T997] __device_attach+0x2c7/0x450 [ 195.451012][ T997] device_initial_probe+0xa1/0xd0 [ 195.451039][ T997] bus_probe_device+0x12d/0x220 [ 195.451059][ T997] device_add+0x7d7/0xb80 [ 195.451082][ T997] usb_new_device+0x99a/0x1680 [ 195.451105][ T997] hub_event+0x28cf/0x4cf0 [ 195.451131][ T997] process_scheduled_works+0xc3d/0x1630 [ 195.451153][ T997] worker_thread+0xa47/0xfb0 [ 195.451176][ T997] kthread+0x38b/0x470 [ 195.451204][ T997] ret_from_fork+0x514/0xb70 [ 195.451231][ T997] ret_from_fork_asm+0x1a/0x30 [ 195.451248][ T997] [ 195.451253][ T997] Freed by task 5603: [ 195.451262][ T997] kasan_save_track+0x3e/0x80 [ 195.451287][ T997] kasan_save_free_info+0x40/0x50 [ 195.451315][ T997] __kasan_slab_free+0x5c/0x80 [ 195.451336][ T997] kfree+0x1c5/0x6d0 [ 195.451352][ T997] hid_device_remove+0xc8/0x1d0 [ 195.451368][ T997] device_release_driver_internal+0x48b/0x880 [ 195.451394][ T997] bus_remove_device+0x449/0x560 [ 195.451414][ T997] device_del+0x528/0x8f0 [ 195.451437][ T997] hid_destroy_device+0x6b/0x1b0 [ 195.451452][ T997] usbhid_disconnect+0x9f/0xc0 [ 195.451468][ T997] usb_unbind_interface+0x295/0x9f0 [ 195.451496][ T997] device_release_driver_internal+0x4f5/0x880 [ 195.451524][ T997] bus_remove_device+0x449/0x560 [ 195.451545][ T997] device_del+0x528/0x8f0 [ 195.451569][ T997] usb_disable_device+0x3d4/0x8d0 [ 195.451594][ T997] usb_disconnect+0x32d/0x990 [ 195.451616][ T997] hub_event+0x1bb7/0x4cf0 [ 195.451641][ T997] process_scheduled_works+0xc3d/0x1630 [ 195.451663][ T997] worker_thread+0xa47/0xfb0 [ 195.451684][ T997] kthread+0x38b/0x470 [ 195.451706][ T997] ret_from_fork+0x514/0xb70 [ 195.451727][ T997] ret_from_fork_asm+0x1a/0x30 [ 195.451740][ T997] [ 195.451744][ T997] Last potentially related work creation: [ 195.451750][ T997] kasan_save_stack+0x3e/0x60 [ 195.451765][ T997] kasan_record_aux_stack+0xbd/0xd0 [ 195.451789][ T997] insert_work+0x3d/0x330 [ 195.451804][ T997] __queue_work+0xd4b/0x1120 [ 195.451822][ T997] queue_work_on+0x106/0x1d0 [ 195.451840][ T997] led_classdev_unregister+0x113/0x270 [ 195.451863][ T997] corsair_remove+0x1a4/0x260 [ 195.451883][ T997] hid_device_remove+0xc8/0x1d0 [ 195.451895][ T997] device_release_driver_internal+0x48b/0x880 [ 195.451918][ T997] bus_remove_device+0x449/0x560 [ 195.451933][ T997] device_del+0x528/0x8f0 [ 195.451952][ T997] hid_destroy_device+0x6b/0x1b0 [ 195.451965][ T997] usbhid_disconnect+0x9f/0xc0 [ 195.451978][ T997] usb_unbind_interface+0x295/0x9f0 [ 195.452001][ T997] device_release_driver_internal+0x4f5/0x880 [ 195.452023][ T997] bus_remove_device+0x449/0x560 [ 195.452038][ T997] device_del+0x528/0x8f0 [ 195.452057][ T997] usb_disable_device+0x3d4/0x8d0 [ 195.452077][ T997] usb_disconnect+0x32d/0x990 [ 195.452094][ T997] hub_event+0x1bb7/0x4cf0 [ 195.452115][ T997] process_scheduled_works+0xc3d/0x1630 [ 195.452132][ T997] worker_thread+0xa47/0xfb0 [ 195.452149][ T997] kthread+0x38b/0x470 [ 195.452171][ T997] ret_from_fork+0x514/0xb70 [ 195.452192][ T997] ret_from_fork_asm+0x1a/0x30 [ 195.452205][ T997] [ 195.452208][ T997] The buggy address belongs to the object at ffff88805ef61800 [ 195.452208][ T997] which belongs to the cache kmalloc-1k of size 1024 [ 195.452222][ T997] The buggy address is located 768 bytes inside of [ 195.452222][ T997] freed 1024-byte region [ffff88805ef61800, ffff88805ef61c00) [ 195.452239][ T997] [ 195.452243][ T997] The buggy address belongs to the physical page: [ 195.452259][ T997] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ef60 [ 195.452279][ T997] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 195.452292][ T997] flags: 0x80000000000040(head|node=0|zone=1) [ 195.452305][ T997] page_type: f5(slab) [ 195.452325][ T997] raw: 0080000000000040 ffff88813ffb9dc0 dead000000000100 dead000000000122 [ 195.452339][ T997] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 195.452355][ T997] head: 0080000000000040 ffff88813ffb9dc0 dead000000000100 dead000000000122 [ 195.452368][ T997] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 195.452383][ T997] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 195.452396][ T997] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 195.452405][ T997] page dumped because: kasan: bad access detected [ 195.452420][ T997] page_owner tracks the page as allocated [ 195.452426][ T997] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6081, tgid 6081 (kworker/u8:64), ts 194508013619 [ 195.452452][ T997] post_alloc_hook+0x1f9/0x250 [ 195.452467][ T997] get_page_from_freelist+0x2591/0x2600 [ 195.452485][ T997] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 195.452504][ T997] allocate_slab+0x7d/0x620 [ 195.452525][ T997] refill_objects+0x2d8/0x350 [ 195.452548][ T997] __pcs_replace_empty_main+0x339/0x690 [ 195.452569][ T997] __kmalloc_noprof+0x54b/0x790 [ 195.452584][ T997] ieee802_11_parse_elems_full+0x14b/0x2de0 [ 195.452606][ T997] ieee80211_inform_bss+0x163/0x10d0 [ 195.452623][ T997] cfg80211_inform_single_bss_data+0xd98/0x1bf0 [ 195.452644][ T997] cfg80211_inform_bss_data+0x263/0x3cc0 [ 195.452663][ T997] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 195.452682][ T997] ieee80211_bss_info_update+0x791/0xa50 [ 195.452699][ T997] ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 [ 195.452717][ T997] ieee80211_iface_work+0x78a/0x1010 [ 195.452735][ T997] cfg80211_wiphy_work+0x29e/0x420 [ 195.452758][ T997] page last free pid 4957 tgid 4957 ts 183339891400 stack trace: [ 195.452768][ T997] __free_frozen_pages+0xf8e/0x1070 [ 195.452785][ T997] __slab_free+0x250/0x2a0 [ 195.452800][ T997] qlist_free_all+0x99/0x100 [ 195.452817][ T997] kasan_quarantine_reduce+0x148/0x160 [ 195.452834][ T997] __kasan_slab_alloc+0x22/0x80 [ 195.452850][ T997] kmem_cache_alloc_noprof+0x360/0x690 [ 195.452865][ T997] do_getname+0x2e/0x250 [ 195.452882][ T997] do_readlinkat+0xc8/0x510 [ 195.452902][ T997] __x64_sys_readlink+0x7f/0x90 [ 195.452921][ T997] do_syscall_64+0x166/0x520 [ 195.452937][ T997] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 195.452953][ T997] [ 195.452956][ T997] Memory state around the buggy address: [ 195.452965][ T997] ffff88805ef61a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.452975][ T997] ffff88805ef61a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.452986][ T997] >ffff88805ef61b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.452994][ T997] ^ [ 195.453002][ T997] ffff88805ef61b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 195.453012][ T997] ffff88805ef61c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 195.453020][ T997] ================================================================== [ 195.732518][ T997] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 195.732545][ T997] CPU: 1 UID: 0 PID: 997 Comm: kworker/1:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 195.732594][ T997] Tainted: [L]=SOFTLOCKUP [ 195.732602][ T997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 195.732616][ T997] Workqueue: events k90_backlight_work [ 195.732663][ T997] Call Trace: [ 195.732671][ T997] [ 195.732680][ T997] vpanic+0x56d/0xa60 [ 195.732703][ T997] ? __pfx_vpanic+0x10/0x10 [ 195.732734][ T997] ? __pfx___schedule+0x10/0x10 [ 195.732758][ T997] panic+0xc5/0xd0 [ 195.732789][ T997] ? __pfx_panic+0x10/0x10 [ 195.732821][ T997] ? preempt_schedule_thunk+0x16/0x40 [ 195.732852][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.732882][ T997] check_panic_on_warn+0x89/0xb0 [ 195.732916][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.732947][ T997] end_report+0x73/0x170 [ 195.732975][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.733006][ T997] kasan_report+0x128/0x150 [ 195.733034][ T997] ? k90_backlight_work+0x174/0x1c0 [ 195.733069][ T997] ? process_scheduled_works+0x97a/0x1630 [ 195.733097][ T997] k90_backlight_work+0x174/0x1c0 [ 195.733131][ T997] process_scheduled_works+0xc3d/0x1630 [ 195.733176][ T997] ? __pfx_process_scheduled_works+0x10/0x10 [ 195.733207][ T997] ? assign_work+0x3cf/0x5d0 [ 195.733234][ T997] worker_thread+0xa47/0xfb0 [ 195.733277][ T997] ? __kthread_parkme+0x71/0x1f0 [ 195.733312][ T997] kthread+0x38b/0x470 [ 195.733344][ T997] ? __pfx_worker_thread+0x10/0x10 [ 195.733369][ T997] ? __pfx_kthread+0x10/0x10 [ 195.733402][ T997] ret_from_fork+0x514/0xb70 [ 195.733437][ T997] ? __pfx_ret_from_fork+0x10/0x10 [ 195.733469][ T997] ? __switch_to+0xc89/0x1420 [ 195.733499][ T997] ? __pfx_kthread+0x10/0x10 [ 195.733532][ T997] ret_from_fork_asm+0x1a/0x30 [ 195.733562][ T997] [ 195.734165][ T997] Kernel Offset: disabled