last executing test programs: 5.204006582s ago: executing program 1 (id=114): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = creat(&(0x7f0000000240)='./file1\x00', 0x0) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r4, 0x3b, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r3, &(0x7f0000000000), 0x4000}]) 3.448259125s ago: executing program 0 (id=116): r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) poll(&(0x7f0000000040)=[{r0, 0x8744}], 0x1, 0x0) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) 3.01581876s ago: executing program 0 (id=119): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) sendto$inet(r0, &(0x7f0000000500)="ea6a8b8748799764cfcca40fefbff4258b09a86e686582a5bcff485d66237e2afc85b960c465ccefb2cc1e690f50b762b05eaf6b24a66ff326215603a3865cf9", 0x40, 0x800, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 2.744098123s ago: executing program 0 (id=121): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x28a5291, 0x0) 2.601042743s ago: executing program 0 (id=123): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="040e04f4220c"], 0x7) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x7fff) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket(0x1a, 0x1, 0x9) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000900)={0x0, 0x0, 0x2, 0x4, 0x0, 0x2}, 0x14) ioctl$F2FS_IOC_DECOMPRESS_FILE(0xffffffffffffffff, 0xf517, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'pcl724\x00', [0x294, 0x2, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x200009ea, 0x20000010, 0x40000, 0x8, 0x4008, 0x746f, 0x8, 0x5, 0x8, 0x1, 0x4, 0x7ffd]}) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, 0x0) 2.35226781s ago: executing program 0 (id=126): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000140)=[{{&(0x7f0000000080)={0x2, 0x4e22, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @remote}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}], 0x38}}], 0x1, 0x0) 2.255765445s ago: executing program 0 (id=127): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231b06e53f77"], 0x0}, 0x0) 2.242099186s ago: executing program 1 (id=128): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r0, &(0x7f00000032c0)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0x1}], 0x1, &(0x7f0000000240)=ANY=[@ANYBLOB="30000000000000008400000001"], 0x30}], 0x1, 0x0) 2.104813081s ago: executing program 1 (id=129): r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) 2.103753951s ago: executing program 1 (id=130): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) 1.967751975s ago: executing program 2 (id=131): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', 0x0, 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x28a5291, 0x0) 1.943661574s ago: executing program 1 (id=132): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r1, @ANYBLOB="030926bd7000fedbdf256800000008000300", @ANYRES32, @ANYBLOB="2600c7000300"], 0xa4}, 0x1, 0x0, 0x0, 0x40880}, 0x40840) 1.783106703s ago: executing program 1 (id=133): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) 1.778506287s ago: executing program 2 (id=134): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf688", 0x80}, {&(0x7f0000000380)}], 0x2}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000580)}], 0x1}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00', 0x0}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e0080000000", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10010002}, 0xc, &(0x7f0000000c80)={&(0x7f0000000e00)=ANY=[@ANYBLOB="7c0100", @ANYRES16=r1, @ANYRES32, @ANYRESDEC, @ANYRES32=r0, @ANYRES8=r1, @ANYRES32=r0, @ANYBLOB="400001801400020070696d367265673000000000000000001400020073797a5f74756e00000000000000000014000200697036677265746170300000000000003000018008000100", @ANYRES8, @ANYBLOB="080003000300000008000100", @ANYRES32=r0, @ANYBLOB="140002"], 0x17c}, 0x1, 0x0, 0x0, 0x4008004}, 0x20000080) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.675967488s ago: executing program 2 (id=135): syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="040e04f4220c"], 0x7) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$CEC_RECEIVE(0xffffffffffffffff, 0xc0386106, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x7fff) r1 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) socket(0x1a, 0x1, 0x9) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000900)={0x0, 0x0, 0x2, 0x4, 0x0, 0x2}, 0x14) ioctl$F2FS_IOC_DECOMPRESS_FILE(0xffffffffffffffff, 0xf517, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000140)={'pcl724\x00', [0x294, 0x2, 0x7fffffff, 0x8, 0x2f, 0x2006, 0xf1, 0x8, 0x80ffa, 0x2, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x200009ea, 0x20000010, 0x40000, 0x8, 0x4008, 0x746f, 0x8, 0x5, 0x8, 0x1, 0x4, 0x7ffd]}) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, 0x0) 1.615765877s ago: executing program 2 (id=136): poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x8744}], 0x1, 0x0) 1.515329427s ago: executing program 2 (id=137): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) capset(0x0, &(0x7f0000001040)={0x4, 0x6, 0x4, 0x7, 0x4, 0xfffffffc}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) tkill(0x0, 0xb) r3 = socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x3, 0x300) recvmmsg(r3, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x10022, 0x0) 1.514690589s ago: executing program 3 (id=138): munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r0, &(0x7f0000009780)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_STATX(r0, &(0x7f0000001f40)={0x130, 0x0, r1, {0x4, 0x3b6, 0x0, '\x00', {0x411, 0x200, 0x8000000000000000, 0xfffffe00, 0x0, 0x0, 0x4000, '\x00', 0xfffffffffffffff1, 0x8001, 0x3, 0x2, {0x6, 0x9}, {0x7b, 0x40}, {0x6, 0x2}, {0xbb, 0x7fff}, 0x6, 0xfffff800, 0x7, 0xf4}}}, 0x130) 1.334163271s ago: executing program 3 (id=139): r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) 1.256881137s ago: executing program 3 (id=140): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000700)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x50}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 195.489931ms ago: executing program 3 (id=141): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r1, @ANYBLOB="030926bd7000fedbdf256800000008000300", @ANYRES32, @ANYBLOB="2600c7000300"], 0xa4}, 0x1, 0x0, 0x0, 0x40880}, 0x40840) 132.694843ms ago: executing program 3 (id=142): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', 0x0, 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x28a5291, 0x0) 62.46185ms ago: executing program 3 (id=143): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf688", 0x80}, {&(0x7f0000000380)}], 0x2}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000580)}], 0x1}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00', 0x0}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e0080000000", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10010002}, 0xc, &(0x7f0000000c80)={&(0x7f0000000e00)=ANY=[@ANYBLOB="7c0100", @ANYRES16=r1, @ANYRES32, @ANYRESDEC, @ANYRES32=r0, @ANYRES8=r1, @ANYRES32=r0, @ANYBLOB="400001801400020070696d367265673000000000000000001400020073797a5f74756e00000000000000000014000200697036677265746170300000000000003000018008000100", @ANYRES8, @ANYBLOB="080003000300000008000100", @ANYRES32=r0, @ANYBLOB="140002"], 0x17c}, 0x1, 0x0, 0x0, 0x4008004}, 0x20000080) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 2 (id=144): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.227' (ED25519) to the list of known hosts. [ 70.244078][ T5596] cgroup: Unknown subsys name 'net' [ 70.485872][ T5596] cgroup: Unknown subsys name 'cpuset' [ 70.541006][ T5596] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.396965][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.397085][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.249145][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 74.548726][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 74.565536][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 74.583600][ T5617] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 74.587226][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 74.587601][ T5617] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 74.626061][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 74.636152][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 74.659592][ T5622] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 74.661324][ T5622] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 74.671674][ T5622] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 74.674330][ T5622] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 74.675586][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 74.676017][ T5622] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 74.679600][ T5622] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 74.690890][ T5612] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 74.692332][ T5612] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 74.743225][ T5617] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 74.752709][ T5617] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 74.756554][ T5617] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.777413][ T5617] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.624344][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.625446][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.625617][ T5615] bridge_slave_0: entered allmulticast mode [ 76.627566][ T5615] bridge_slave_0: entered promiscuous mode [ 76.682587][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.682857][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.683093][ T5615] bridge_slave_1: entered allmulticast mode [ 76.685070][ T5615] bridge_slave_1: entered promiscuous mode [ 76.710467][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.710768][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.711175][ T5610] bridge_slave_0: entered allmulticast mode [ 76.714407][ T5610] bridge_slave_0: entered promiscuous mode [ 76.742016][ T5619] Bluetooth: hci2: command tx timeout [ 76.765560][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.765750][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.765896][ T5610] bridge_slave_1: entered allmulticast mode [ 76.767690][ T5610] bridge_slave_1: entered promiscuous mode [ 76.820862][ T4924] Bluetooth: hci3: command tx timeout [ 76.821032][ T4924] Bluetooth: hci1: command tx timeout [ 76.821164][ T5619] Bluetooth: hci0: command tx timeout [ 76.875935][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.908628][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.908921][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.909471][ T5608] bridge_slave_0: entered allmulticast mode [ 76.913260][ T5608] bridge_slave_0: entered promiscuous mode [ 76.925270][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.925654][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.925936][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.926226][ T5614] bridge_slave_0: entered allmulticast mode [ 76.929835][ T5614] bridge_slave_0: entered promiscuous mode [ 76.945560][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.946249][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.946562][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.946790][ T5608] bridge_slave_1: entered allmulticast mode [ 76.951173][ T5608] bridge_slave_1: entered promiscuous mode [ 76.984129][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.984408][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.984633][ T5614] bridge_slave_1: entered allmulticast mode [ 76.988056][ T5614] bridge_slave_1: entered promiscuous mode [ 76.998178][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.092980][ T5615] team0: Port device team_slave_0 added [ 77.268130][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.273047][ T5615] team0: Port device team_slave_1 added [ 77.281208][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.287318][ T5610] team0: Port device team_slave_0 added [ 77.294079][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.317838][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.321274][ T5610] team0: Port device team_slave_1 added [ 77.397218][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.397230][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.397244][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.487308][ T5608] team0: Port device team_slave_0 added [ 77.488899][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.488910][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.488925][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.497167][ T5614] team0: Port device team_slave_0 added [ 77.500851][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.500866][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.500890][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.506989][ T5608] team0: Port device team_slave_1 added [ 77.531426][ T5614] team0: Port device team_slave_1 added [ 77.533660][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.533674][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.533699][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.672224][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.672237][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.672252][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.674071][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.674082][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.674096][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.709158][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.709176][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.709200][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.714427][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.714444][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.714472][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.757521][ T5615] hsr_slave_0: entered promiscuous mode [ 77.761521][ T5615] hsr_slave_1: entered promiscuous mode [ 77.840748][ T5610] hsr_slave_0: entered promiscuous mode [ 77.842838][ T5610] hsr_slave_1: entered promiscuous mode [ 77.844768][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 77.844897][ T5610] Cannot create hsr debugfs directory [ 77.988646][ T5608] hsr_slave_0: entered promiscuous mode [ 77.992585][ T5608] hsr_slave_1: entered promiscuous mode [ 77.994397][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 77.994420][ T5608] Cannot create hsr debugfs directory [ 78.006922][ T5614] hsr_slave_0: entered promiscuous mode [ 78.009006][ T5614] hsr_slave_1: entered promiscuous mode [ 78.011240][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 78.011263][ T5614] Cannot create hsr debugfs directory [ 78.821390][ T5619] Bluetooth: hci2: command tx timeout [ 78.900462][ T5619] Bluetooth: hci0: command tx timeout [ 78.900485][ T5617] Bluetooth: hci3: command tx timeout [ 78.900507][ T5617] Bluetooth: hci1: command tx timeout [ 78.992484][ T5615] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.048074][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.056442][ T5615] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.096110][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.124326][ T5615] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.165995][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.187201][ T5615] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.223797][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.343617][ T5610] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.375531][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.387940][ T5610] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.428647][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.439648][ T5610] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.483748][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.512252][ T5610] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.549874][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.729867][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.771336][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.778393][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.797933][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.835195][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.873884][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.891750][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.925177][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.039409][ T5614] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.065546][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.083296][ T5614] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.124263][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.128697][ T5614] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.165746][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.176944][ T5614] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.204776][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.319901][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.433620][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.463970][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.502416][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.503723][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.559223][ T1226] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.559374][ T1226] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.615291][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.671341][ T1022] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.671434][ T1022] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.699917][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.734096][ T1022] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.734187][ T1022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.832917][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.864192][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.883744][ T149] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.883892][ T149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.900474][ T5619] Bluetooth: hci2: command tx timeout [ 80.953063][ T1022] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.953238][ T1022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.980821][ T4924] Bluetooth: hci3: command tx timeout [ 80.980849][ T4924] Bluetooth: hci0: command tx timeout [ 80.980937][ T5619] Bluetooth: hci1: command tx timeout [ 81.086792][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.174517][ T1226] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.174633][ T1226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.256630][ T149] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.256827][ T149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.683872][ T32] cfg80211: failed to load regulatory.db [ 81.945428][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.523414][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.549592][ T5615] veth0_vlan: entered promiscuous mode [ 82.645498][ T5615] veth1_vlan: entered promiscuous mode [ 82.902478][ T5610] veth0_vlan: entered promiscuous mode [ 82.928364][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.952342][ T5615] veth0_macvtap: entered promiscuous mode [ 82.982534][ T5617] Bluetooth: hci2: command tx timeout [ 83.007165][ T5615] veth1_macvtap: entered promiscuous mode [ 83.039629][ T5610] veth1_vlan: entered promiscuous mode [ 83.061059][ T5617] Bluetooth: hci1: command tx timeout [ 83.061095][ T5617] Bluetooth: hci0: command tx timeout [ 83.061114][ T5617] Bluetooth: hci3: command tx timeout [ 83.128560][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.152526][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.187947][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.239676][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.265199][ T44] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.285250][ T44] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.314176][ T44] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.319120][ T5610] veth0_macvtap: entered promiscuous mode [ 83.333198][ T5608] veth0_vlan: entered promiscuous mode [ 83.407516][ T5610] veth1_macvtap: entered promiscuous mode [ 83.516233][ T5608] veth1_vlan: entered promiscuous mode [ 83.755736][ T5614] veth0_vlan: entered promiscuous mode [ 83.765118][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.834321][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.874424][ T5614] veth1_vlan: entered promiscuous mode [ 83.882533][ T1851] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.882564][ T1851] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.943581][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.958077][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.965538][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.978997][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.031748][ T5608] veth0_macvtap: entered promiscuous mode [ 84.094464][ T5608] veth1_macvtap: entered promiscuous mode [ 84.105118][ T162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.105150][ T162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.400363][ T5614] veth0_macvtap: entered promiscuous mode [ 84.523950][ T5614] veth1_macvtap: entered promiscuous mode [ 84.534653][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.543673][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.543693][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.619047][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.708225][ T149] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.712272][ T149] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.712351][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.712365][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.727866][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.731455][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.805444][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.945375][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.126246][ T149] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.145480][ T149] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.198240][ T149] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.256066][ T149] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.553494][ T5715] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 85.740187][ T5715] usb 3-1: Using ep0 maxpacket: 16 [ 85.751450][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.751470][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.816700][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 85.816733][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 85.816756][ T5715] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 85.816800][ T5715] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 85.816821][ T5715] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.001701][ T950] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 86.042212][ T5715] usb 3-1: config 0 descriptor?? [ 86.241210][ T950] usb 4-1: Using ep0 maxpacket: 16 [ 86.245160][ T950] usb 4-1: config 0 has an invalid interface number: 64 but max is 0 [ 86.245189][ T950] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 86.245207][ T950] usb 4-1: config 0 has no interface number 0 [ 86.245247][ T950] usb 4-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 86.245268][ T950] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.354509][ T950] usb 4-1: config 0 descriptor?? [ 86.449422][ T950] uvcvideo 4-1:0.64: Found Unit with invalid ID 0 [ 86.449717][ T950] uvcvideo 4-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 86.449758][ T950] uvcvideo 4-1:0.64: No valid video chain found. [ 86.491041][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.491062][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.578779][ T5715] usbhid 3-1:0.0: can't add hid device: -71 [ 86.578903][ T5715] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 86.635826][ T5715] usb 3-1: USB disconnect, device number 2 [ 86.774080][ T162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.774100][ T162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.874459][ T950] usb 4-1: USB disconnect, device number 2 [ 87.139593][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.139613][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.710314][ T5715] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.902599][ T5780] netlink: 96 bytes leftover after parsing attributes in process `syz.3.8'. [ 87.991392][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.991427][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.991461][ T5715] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 87.991483][ T5715] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 88.110167][ T5715] usb 3-1: config 0 descriptor?? [ 89.617735][ T5715] cp2112 0003:10C4:EA90.0001: unknown main item tag 0x0 [ 89.633140][ T5715] cp2112 0003:10C4:EA90.0001: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 89.749624][ T5715] cp2112 0003:10C4:EA90.0001: error requesting version [ 90.127872][ T5715] cp2112 0003:10C4:EA90.0001: probe with driver cp2112 failed with error -71 [ 90.150596][ T5716] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 90.254592][ T5715] usb 3-1: USB disconnect, device number 3 [ 90.370176][ T5716] usb 4-1: Using ep0 maxpacket: 16 [ 90.377076][ T5716] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 90.377106][ T5716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.377124][ T5716] usb 4-1: Product: syz [ 90.377148][ T5716] usb 4-1: Manufacturer: syz [ 90.377163][ T5716] usb 4-1: SerialNumber: syz [ 90.800594][ T5715] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 90.961146][ T5715] usb 3-1: Using ep0 maxpacket: 16 [ 90.962842][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 90.962862][ T5715] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 90.962874][ T5715] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 90.962899][ T5715] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 90.962912][ T5715] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.971352][ T5715] usb 3-1: config 0 descriptor?? [ 91.000620][ T5716] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 91.032846][ T821] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 91.098623][ T5716] usb 4-1: USB disconnect, device number 3 [ 91.190278][ T821] usb 1-1: Using ep0 maxpacket: 16 [ 91.216946][ T821] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 91.216965][ T821] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 91.216976][ T821] usb 1-1: config 0 has no interface number 0 [ 91.217002][ T821] usb 1-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 91.217050][ T821] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.536089][ T5715] usbhid 3-1:0.0: can't add hid device: -71 [ 91.536170][ T5715] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 91.722656][ T821] usb 1-1: config 0 descriptor?? [ 91.768339][ T5715] usb 3-1: USB disconnect, device number 4 [ 91.852910][ T821] uvcvideo 1-1:0.64: Found Unit with invalid ID 0 [ 91.852948][ T821] uvcvideo 1-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 91.852963][ T821] uvcvideo 1-1:0.64: No valid video chain found. [ 92.141736][ T5811] netlink: 96 bytes leftover after parsing attributes in process `syz.3.18'. [ 92.402697][ T5598] usb 1-1: USB disconnect, device number 2 [ 93.434071][ T5715] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 93.591316][ T5715] usb 1-1: Using ep0 maxpacket: 8 [ 93.593528][ T5715] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 93.593562][ T5715] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 93.593576][ T5715] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.134608][ T5838] netlink: 24 bytes leftover after parsing attributes in process `syz.1.32'. [ 94.450328][ T950] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 94.644765][ T950] usb 4-1: Using ep0 maxpacket: 16 [ 94.681671][ T950] usb 4-1: config 0 has an invalid interface number: 64 but max is 0 [ 94.681709][ T950] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 94.681768][ T950] usb 4-1: config 0 has no interface number 0 [ 94.681876][ T950] usb 4-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 94.682080][ T950] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.062781][ T950] usb 4-1: config 0 descriptor?? [ 95.159966][ T950] uvcvideo 4-1:0.64: Found Unit with invalid ID 0 [ 95.160005][ T950] uvcvideo 4-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 95.160302][ T950] uvcvideo 4-1:0.64: No valid video chain found. [ 95.251170][ T5807] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 95.704779][ T5598] usb 4-1: USB disconnect, device number 4 [ 95.732682][ T5807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.732715][ T5807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.732752][ T5807] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 95.732773][ T5807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.795774][ T5807] usb 2-1: config 0 descriptor?? [ 96.266054][ T9] usb 1-1: USB disconnect, device number 3 [ 96.369872][ T5807] cp2112 0003:10C4:EA90.0002: unknown main item tag 0x0 [ 96.555920][ T5807] cp2112 0003:10C4:EA90.0002: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 96.615357][ T5807] cp2112 0003:10C4:EA90.0002: error requesting version [ 96.657250][ T5807] cp2112 0003:10C4:EA90.0002: probe with driver cp2112 failed with error -71 [ 96.727062][ T5807] usb 2-1: USB disconnect, device number 2 [ 96.878524][ T5862] fido_id[5862]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:10C4:EA90.0002/report_descriptor': No such device [ 97.073642][ T9] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 97.221080][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 97.228341][ T9] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 97.228360][ T9] usb 1-1: config 0 has no interface number 0 [ 97.228377][ T9] usb 1-1: config 0 interface 1 has no altsetting 0 [ 97.242653][ T9] usb 1-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 97.242686][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.242706][ T9] usb 1-1: Product: syz [ 97.242721][ T9] usb 1-1: Manufacturer: syz [ 97.242736][ T9] usb 1-1: SerialNumber: syz [ 97.307112][ T9] usb 1-1: config 0 descriptor?? [ 97.533434][ T9] i2c-cp2615 1-1:0.1: probe with driver i2c-cp2615 failed with error -22 [ 97.738118][ T9] usb 1-1: USB disconnect, device number 4 [ 98.030177][ T5716] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 98.270078][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.290079][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.300084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.350308][ T5716] usb 4-1: Using ep0 maxpacket: 8 [ 98.354681][ T5716] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 98.354735][ T5716] usb 4-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 98.354775][ T5716] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 98.354798][ T5716] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.421850][ T5716] usbtmc 4-1:16.0: bulk endpoints not found [ 98.820290][ T5807] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 99.000385][ T5807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 99.000407][ T5807] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.000432][ T5807] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 99.000445][ T5807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.003642][ T5807] usb 2-1: config 0 descriptor?? [ 99.415719][ T5807] cp2112 0003:10C4:EA90.0003: unknown main item tag 0x0 [ 99.521994][ T5807] cp2112 0003:10C4:EA90.0003: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 99.669202][ T5807] cp2112 0003:10C4:EA90.0003: error requesting version [ 99.745413][ T5807] cp2112 0003:10C4:EA90.0003: probe with driver cp2112 failed with error -71 [ 99.830520][ T5807] usb 2-1: USB disconnect, device number 3 [ 99.920098][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 100.294630][ T5598] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 100.380340][ T5807] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 100.440295][ T5598] usb 1-1: Using ep0 maxpacket: 16 [ 100.463153][ T5598] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 100.463196][ T5598] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 100.463214][ T5598] usb 1-1: config 0 has no interface number 0 [ 100.463265][ T5598] usb 1-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 100.463287][ T5598] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.521958][ T5598] usb 1-1: config 0 descriptor?? [ 100.528281][ T5598] uvcvideo 1-1:0.64: Found Unit with invalid ID 0 [ 100.528342][ T5598] uvcvideo 1-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 100.528370][ T5598] uvcvideo 1-1:0.64: No valid video chain found. [ 100.550739][ T5807] usb 3-1: Using ep0 maxpacket: 8 [ 100.560183][ T5807] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 100.560234][ T5807] usb 3-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 100.560275][ T5807] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 100.560298][ T5807] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.629773][ T5807] usbtmc 3-1:16.0: bulk endpoints not found [ 100.741860][ T5807] usb 4-1: USB disconnect, device number 5 [ 100.794056][ T5716] usb 1-1: USB disconnect, device number 5 [ 101.347366][ T5937] ======================================================= [ 101.347366][ T5937] WARNING: The mand mount option has been deprecated and [ 101.347366][ T5937] and is ignored by this kernel. Remove the mand [ 101.347366][ T5937] option from the mount to silence this warning. [ 101.347366][ T5937] ======================================================= [ 101.450801][ T5598] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 101.644324][ T5598] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.644361][ T5598] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.644401][ T5598] usb 4-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 101.644422][ T5598] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.703254][ T5598] usb 4-1: config 0 descriptor?? [ 102.133737][ T5598] cp2112 0003:10C4:EA90.0004: unknown main item tag 0x0 [ 102.176921][ T5598] cp2112 0003:10C4:EA90.0004: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.3-1/input0 [ 102.312321][ T5598] cp2112 0003:10C4:EA90.0004: error requesting version [ 102.356404][ T5598] cp2112 0003:10C4:EA90.0004: probe with driver cp2112 failed with error -71 [ 102.377752][ T5598] usb 4-1: USB disconnect, device number 6 [ 102.760801][ T5807] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 102.920220][ T5807] usb 1-1: Using ep0 maxpacket: 16 [ 102.926838][ T5807] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 102.926868][ T5807] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 102.926886][ T5807] usb 1-1: config 0 has no interface number 0 [ 102.926931][ T5807] usb 1-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 102.926953][ T5807] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.948479][ T5807] usb 1-1: config 0 descriptor?? [ 103.007343][ T5807] uvcvideo 1-1:0.64: Found Unit with invalid ID 0 [ 103.011078][ T5807] uvcvideo 1-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 103.011102][ T5807] uvcvideo 1-1:0.64: No valid video chain found. [ 103.176002][ T5598] usb 3-1: USB disconnect, device number 5 [ 103.243001][ T5807] usb 1-1: USB disconnect, device number 6 [ 103.703997][ T5962] syz.1.81 (5962) used greatest stack depth: 18328 bytes left [ 103.989852][ T5984] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 104.101064][ T38] audit: type=1326 audit(1778969578.176:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.102229][ T38] audit: type=1326 audit(1778969578.226:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.102278][ T38] audit: type=1326 audit(1778969578.226:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.102314][ T38] audit: type=1326 audit(1778969578.226:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.102913][ T38] audit: type=1326 audit(1778969578.226:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.160338][ T38] audit: type=1326 audit(1778969578.276:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5fd9b0ce59 code=0x7ffc0000 [ 104.160390][ T38] audit: type=1326 audit(1778969578.286:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f5fd9b0cbc2 code=0x7ffc0000 [ 104.165749][ T38] audit: type=1326 audit(1778969578.286:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f5fd9b0cc57 code=0x7ffc0000 [ 104.165808][ T38] audit: type=1326 audit(1778969578.286:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f5fd9ac9b51 code=0x7ffc0000 [ 104.165846][ T38] audit: type=1326 audit(1778969578.286:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5981 comm="syz.2.91" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f5fd9b0dc49 code=0x7ffc0000 [ 104.288532][ T5598] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 104.399622][ T5994] binder: 5993:5994 ioctl c0306201 200000001440 returned -11 [ 104.543715][ T5598] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.543748][ T5598] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.543784][ T5598] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 104.543806][ T5598] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.602611][ T5598] usb 2-1: config 0 descriptor?? [ 104.723492][ T950] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 104.890143][ T950] usb 4-1: Using ep0 maxpacket: 16 [ 104.898303][ T950] usb 4-1: config 0 has an invalid interface number: 64 but max is 0 [ 104.898330][ T950] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 104.898346][ T950] usb 4-1: config 0 has no interface number 0 [ 104.898386][ T950] usb 4-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 104.898406][ T950] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.953203][ T950] usb 4-1: config 0 descriptor?? [ 104.978110][ T950] uvcvideo 4-1:0.64: Found Unit with invalid ID 0 [ 104.978234][ T950] uvcvideo 4-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 104.978261][ T950] uvcvideo 4-1:0.64: No valid video chain found. [ 105.019465][ T5598] cp2112 0003:10C4:EA90.0005: unknown main item tag 0x0 [ 105.056215][ T5598] cp2112 0003:10C4:EA90.0005: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 105.194015][ T5716] usb 4-1: USB disconnect, device number 7 [ 105.221821][ T5598] cp2112 0003:10C4:EA90.0005: error requesting version [ 105.244610][ T5598] cp2112 0003:10C4:EA90.0005: probe with driver cp2112 failed with error -71 [ 105.297264][ T5598] usb 2-1: USB disconnect, device number 4 [ 105.530192][ T5807] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 105.682136][ T5807] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.682172][ T5807] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 105.682202][ T5807] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 105.682215][ T5807] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.685727][ T5807] usb 1-1: config 0 descriptor?? [ 105.963312][ T6015] binder: 6013:6015 ioctl c0306201 200000001440 returned -11 [ 106.130864][ T5807] cp2112 0003:10C4:EA90.0006: unknown main item tag 0x0 [ 106.152172][ T5807] cp2112 0003:10C4:EA90.0006: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0 [ 106.306039][ T5807] cp2112 0003:10C4:EA90.0006: error requesting version [ 106.332403][ T5807] cp2112 0003:10C4:EA90.0006: probe with driver cp2112 failed with error -71 [ 106.372744][ T5807] usb 1-1: USB disconnect, device number 7 [ 107.990959][ T37] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 107.999807][ T6040] binder: 6039:6040 ioctl c0306201 200000001440 returned -11 [ 108.170161][ T37] usb 3-1: Using ep0 maxpacket: 16 [ 108.180640][ T37] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 108.180670][ T37] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 108.180690][ T37] usb 3-1: config 0 has no interface number 0 [ 108.180735][ T37] usb 3-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 108.180759][ T37] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.235556][ T37] usb 3-1: config 0 descriptor?? [ 108.273377][ T37] uvcvideo 3-1:0.64: Found Unit with invalid ID 0 [ 108.273440][ T37] uvcvideo 3-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 108.273468][ T37] uvcvideo 3-1:0.64: No valid video chain found. [ 108.484100][ T32] usb 3-1: USB disconnect, device number 6 [ 109.325170][ T6058] binder: 6057:6058 ioctl c0306201 200000001440 returned -11 [ 109.736914][ T38] kauditd_printk_skb: 29 callbacks suppressed [ 109.736933][ T38] audit: type=1326 audit(1778969583.856:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.737071][ T38] audit: type=1326 audit(1778969583.856:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.761068][ T38] audit: type=1326 audit(1778969583.876:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.761121][ T38] audit: type=1326 audit(1778969583.876:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.761162][ T38] audit: type=1326 audit(1778969583.876:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.761213][ T38] audit: type=1326 audit(1778969583.886:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.763008][ T38] audit: type=1326 audit(1778969583.886:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.763052][ T38] audit: type=1326 audit(1778969583.886:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.763090][ T38] audit: type=1326 audit(1778969583.886:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6073 comm="syz.1.130" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fb9b1e7ce59 code=0x7ffc0000 [ 109.810148][ T9] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 109.940197][ T9] usb 1-1: device descriptor read/64, error -71 [ 109.994050][ T6077] netlink: 96 bytes leftover after parsing attributes in process `syz.1.132'. [ 110.220298][ T9] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 110.350319][ T9] usb 1-1: device descriptor read/64, error -71 [ 110.460590][ T9] usb usb1-port1: attempt power cycle [ 110.503769][ T32] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 111.397319][ T32] usb 2-1: Using ep0 maxpacket: 8 [ 111.471245][ T32] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 111.471299][ T32] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 111.471322][ T32] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 111.471345][ T32] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 111.471387][ T32] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 111.471409][ T32] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.544584][ T32] usbtmc 2-1:16.0: bulk endpoints not found [ 111.638659][ T6098] netlink: 96 bytes leftover after parsing attributes in process `syz.3.141'. [ 111.854585][ T5619] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 111.854637][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.854666][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 111.854678][ T5619] Workqueue: hci3 hci_rx_work [ 111.854721][ T5619] Call Trace: [ 111.854732][ T5619] [ 111.854741][ T5619] dump_stack_lvl+0xe8/0x150 [ 111.854772][ T5619] sysfs_create_dir_ns+0x271/0x2a0 [ 111.854808][ T5619] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.854808][ T5619] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.854842][ T5619] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 111.854872][ T5619] ? rt_spin_unlock+0x160/0x200 [ 111.854902][ T5619] kobject_add_internal+0x631/0xd10 [ 111.854933][ T5619] kobject_add+0x163/0x240 [ 111.854962][ T5619] ? __pfx_kobject_add+0x10/0x10 [ 111.854993][ T5619] ? get_device_parent+0x370/0x3a0 [ 111.855025][ T5619] device_add+0x408/0xb90 [ 111.855056][ T5619] hci_conn_add_sysfs+0xd5/0x210 [ 111.855090][ T5619] le_conn_complete_evt+0x10e6/0x16b0 [ 111.855124][ T5619] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 111.855150][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.855181][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.855213][ T5619] ? skb_pull_data+0xfb/0x200 [ 111.855239][ T5619] hci_le_conn_complete_evt+0x187/0x470 [ 111.855271][ T5619] hci_event_packet+0x659/0xef0 [ 111.855310][ T5619] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.855336][ T5619] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 111.855358][ T5619] ? __pfx_hci_event_packet+0x10/0x10 [ 111.855391][ T5619] ? rt_spin_unlock+0x14f/0x200 [ 111.855425][ T5619] ? hci_send_to_monitor+0xe2/0x590 [ 111.855454][ T5619] hci_rx_work+0x3ee/0x1040 [ 111.855498][ T5619] ? process_one_work+0x8be/0x1630 [ 111.855524][ T5619] process_one_work+0x98b/0x1630 [ 111.855573][ T5619] ? __pfx_process_one_work+0x10/0x10 [ 111.855598][ T5619] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.855643][ T5619] worker_thread+0xb49/0x1140 [ 111.855678][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.855718][ T5619] kthread+0x388/0x470 [ 111.855734][ T5619] ? __pfx_worker_thread+0x10/0x10 [ 111.855753][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.855773][ T5619] ret_from_fork+0x514/0xb70 [ 111.855807][ T5619] ? __pfx_ret_from_fork+0x10/0x10 [ 111.855828][ T5619] ? __switch_to+0xc79/0x1410 [ 111.855857][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.855876][ T5619] ret_from_fork_asm+0x1a/0x30 [ 111.855914][ T5619] [ 111.859198][ T5619] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 111.859243][ T5619] Bluetooth: hci3: failed to register connection device [ 111.875557][ T9] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 111.936271][ T5619] ================================================================== [ 111.936289][ T5619] BUG: KASAN: slab-use-after-free in l2cap_sock_ready_cb+0xe3/0x180 [ 111.936330][ T5619] Read of size 8 at addr ffff88803d7c8200 by task kworker/u9:5/5619 [ 111.936348][ T5619] [ 111.936359][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.936382][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 111.936396][ T5619] Workqueue: hci3 hci_rx_work [ 111.936429][ T5619] Call Trace: [ 111.936437][ T5619] [ 111.936446][ T5619] dump_stack_lvl+0xe8/0x150 [ 111.936474][ T5619] print_address_description+0x55/0x1e0 [ 111.936502][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.936532][ T5619] print_report+0x58/0x70 [ 111.936574][ T5619] kasan_report+0x117/0x150 [ 111.936605][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.936639][ T5619] l2cap_sock_ready_cb+0xe3/0x180 [ 111.936669][ T5619] l2cap_le_start+0x25b/0x1960 [ 111.936698][ T5619] ? __pfx_l2cap_le_start+0x10/0x10 [ 111.936726][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.936756][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.936794][ T5619] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 111.936826][ T5619] ? mutex_lock_nested+0x152/0x1d0 [ 111.936851][ T5619] ? l2cap_connect_cfm+0x894/0x1560 [ 111.936880][ T5619] l2cap_connect_cfm+0x8d5/0x1560 [ 111.936912][ T5619] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 111.936938][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.936970][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.936998][ T5619] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 111.937028][ T5619] ? mutex_lock_nested+0x152/0x1d0 [ 111.937050][ T5619] ? hci_connect_cfm+0x2c/0x140 [ 111.937070][ T5619] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 111.937094][ T5619] hci_connect_cfm+0x95/0x140 [ 111.937116][ T5619] le_conn_complete_evt+0x1134/0x16b0 [ 111.937144][ T5619] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 111.937167][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.937195][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.937228][ T5619] ? skb_pull_data+0xfb/0x200 [ 111.937248][ T5619] hci_le_conn_complete_evt+0x187/0x470 [ 111.937273][ T5619] hci_event_packet+0x659/0xef0 [ 111.937305][ T5619] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.937329][ T5619] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 111.937349][ T5619] ? __pfx_hci_event_packet+0x10/0x10 [ 111.937379][ T5619] ? rt_spin_unlock+0x14f/0x200 [ 111.937408][ T5619] ? hci_send_to_monitor+0xe2/0x590 [ 111.937435][ T5619] hci_rx_work+0x3ee/0x1040 [ 111.937467][ T5619] ? process_one_work+0x8be/0x1630 [ 111.937493][ T5619] process_one_work+0x98b/0x1630 [ 111.937523][ T5619] ? __pfx_process_one_work+0x10/0x10 [ 111.937543][ T5619] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.937572][ T5619] worker_thread+0xb49/0x1140 [ 111.937597][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.937626][ T5619] kthread+0x388/0x470 [ 111.937643][ T5619] ? __pfx_worker_thread+0x10/0x10 [ 111.937664][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.937680][ T5619] ret_from_fork+0x514/0xb70 [ 111.937700][ T5619] ? __pfx_ret_from_fork+0x10/0x10 [ 111.937719][ T5619] ? __switch_to+0xc79/0x1410 [ 111.937744][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.937760][ T5619] ret_from_fork_asm+0x1a/0x30 [ 111.937795][ T5619] [ 111.937802][ T5619] [ 111.937806][ T5619] Allocated by task 6104: [ 111.937817][ T5619] kasan_save_track+0x3e/0x80 [ 111.937843][ T5619] __kasan_kmalloc+0x93/0xb0 [ 111.937863][ T5619] __kmalloc_noprof+0x3e7/0x7b0 [ 111.937884][ T5619] sk_prot_alloc+0xe7/0x210 [ 111.937905][ T5619] sk_alloc+0x3a/0x390 [ 111.937926][ T5619] bt_sock_alloc+0x3b/0x310 [ 111.937941][ T5619] l2cap_sock_create+0x147/0x330 [ 111.937962][ T5619] bt_sock_create+0x163/0x240 [ 111.937978][ T5619] __sock_create+0x4e3/0x960 [ 111.937994][ T5619] __sys_socket+0xd9/0x330 [ 111.938011][ T5619] __x64_sys_socket+0x7a/0x90 [ 111.938028][ T5619] do_syscall_64+0x15f/0xf80 [ 111.938042][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.938057][ T5619] [ 111.938061][ T5619] Freed by task 6101: [ 111.938068][ T5619] kasan_save_track+0x3e/0x80 [ 111.938086][ T5619] kasan_save_free_info+0x46/0x50 [ 111.938101][ T5619] __kasan_slab_free+0x5c/0x80 [ 111.938121][ T5619] kfree+0x1c5/0x6c0 [ 111.938142][ T5619] __sk_destruct+0x74b/0x9d0 [ 111.938163][ T5619] l2cap_sock_release+0x1c1/0x270 [ 111.938182][ T5619] __sock_release+0xb9/0x250 [ 111.938197][ T5619] sock_close+0x1c/0x30 [ 111.938211][ T5619] __fput+0x461/0xa70 [ 111.938228][ T5619] task_work_run+0x1d9/0x270 [ 111.938243][ T5619] exit_to_user_mode_loop+0xf3/0x4d0 [ 111.938266][ T5619] do_syscall_64+0x33e/0xf80 [ 111.938280][ T5619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.938296][ T5619] [ 111.938300][ T5619] The buggy address belongs to the object at ffff88803d7c8000 [ 111.938300][ T5619] which belongs to the cache kmalloc-2k of size 2048 [ 111.938314][ T5619] The buggy address is located 512 bytes inside of [ 111.938314][ T5619] freed 2048-byte region [ffff88803d7c8000, ffff88803d7c8800) [ 111.938332][ T5619] [ 111.938336][ T5619] The buggy address belongs to the physical page: [ 111.938353][ T5619] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d7c8 [ 111.938369][ T5619] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 111.938383][ T5619] flags: 0x80000000000040(head|node=0|zone=1) [ 111.938404][ T5619] page_type: f5(slab) [ 111.938420][ T5619] raw: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 111.938436][ T5619] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 111.938452][ T5619] head: 0080000000000040 ffff88813fea2000 dead000000000100 dead000000000122 [ 111.938466][ T5619] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000 [ 111.938482][ T5619] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 111.938496][ T5619] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 111.938505][ T5619] page dumped because: kasan: bad access detected [ 111.938513][ T5619] page_owner tracks the page as allocated [ 111.938519][ T5619] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5610, tgid 5610 (syz-executor), ts 79425424481, free_ts 79285286319 [ 111.938550][ T5619] post_alloc_hook+0x1f9/0x250 [ 111.938570][ T5619] get_page_from_freelist+0x27d6/0x2850 [ 111.938593][ T5619] __alloc_frozen_pages_noprof+0x18d/0x380 [ 111.938615][ T5619] allocate_slab+0x74/0x5e0 [ 111.938631][ T5619] refill_objects+0x33c/0x3d0 [ 111.938646][ T5619] __pcs_replace_empty_main+0x373/0x720 [ 111.938663][ T5619] __kvmalloc_node_noprof+0x6f4/0x8e0 [ 111.938686][ T5619] page_pool_create_percpu+0x30d/0xc90 [ 111.938702][ T5619] nsim_open+0x3c4/0xa20 [ 111.938727][ T5619] __dev_open+0x44d/0x830 [ 111.938744][ T5619] __dev_change_flags+0x2fa/0x7e0 [ 111.938765][ T5619] netif_change_flags+0x88/0x1a0 [ 111.938786][ T5619] do_setlink+0xfa5/0x45a0 [ 111.938812][ T5619] rtnl_newlink+0x15ad/0x1bb0 [ 111.938832][ T5619] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 111.938851][ T5619] netlink_rcv_skb+0x232/0x4b0 [ 111.938877][ T5619] page last free pid 5610 tgid 5610 stack trace: [ 111.938886][ T5619] __free_frozen_pages+0x1075/0x11b0 [ 111.938907][ T5619] __slab_free+0x252/0x2a0 [ 111.938927][ T5619] qlist_free_all+0x99/0x100 [ 111.938944][ T5619] kasan_quarantine_reduce+0x148/0x160 [ 111.938962][ T5619] __kasan_slab_alloc+0x22/0x80 [ 111.938982][ T5619] kmem_cache_alloc_lru_noprof+0x33c/0x680 [ 111.939002][ T5619] alloc_inode+0x6a/0x1b0 [ 111.939017][ T5619] new_inode+0x22/0x170 [ 111.939034][ T5619] __debugfs_create_file+0xb8/0x400 [ 111.939051][ T5619] debugfs_create_file_full+0x3f/0x60 [ 111.939068][ T5619] nsim_create+0x759/0x1170 [ 111.939082][ T5619] __nsim_dev_port_add+0x857/0xd30 [ 111.939102][ T5619] nsim_dev_port_add_all+0x37/0xf0 [ 111.939120][ T5619] nsim_drv_probe+0x90d/0xc30 [ 111.939138][ T5619] really_probe+0x267/0xaf0 [ 111.939161][ T5619] __driver_probe_device+0x1e2/0x350 [ 111.939183][ T5619] [ 111.939187][ T5619] Memory state around the buggy address: [ 111.939196][ T5619] ffff88803d7c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.939207][ T5619] ffff88803d7c8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.939218][ T5619] >ffff88803d7c8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.939227][ T5619] ^ [ 111.939235][ T5619] ffff88803d7c8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.939246][ T5619] ffff88803d7c8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 111.939255][ T5619] ================================================================== [ 111.942399][ T5619] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 111.942424][ T5619] CPU: 0 UID: 0 PID: 5619 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 111.942450][ T5619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 111.942465][ T5619] Workqueue: hci3 hci_rx_work [ 111.942512][ T5619] Call Trace: [ 111.942527][ T5619] [ 111.942537][ T5619] vpanic+0x56c/0xa60 [ 111.942576][ T5619] ? __pfx_vpanic+0x10/0x10 [ 111.942620][ T5619] panic+0xc5/0xd0 [ 111.942649][ T5619] ? __pfx_panic+0x10/0x10 [ 111.942679][ T5619] ? preempt_schedule_thunk+0x16/0x40 [ 111.942713][ T5619] ? preempt_schedule_thunk+0x16/0x40 [ 111.942745][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.942775][ T5619] check_panic_on_warn+0x89/0xb0 [ 111.942797][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.942826][ T5619] end_report+0x73/0x170 [ 111.942856][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.942884][ T5619] kasan_report+0x128/0x150 [ 111.942915][ T5619] ? l2cap_sock_ready_cb+0xe3/0x180 [ 111.942949][ T5619] l2cap_sock_ready_cb+0xe3/0x180 [ 111.942980][ T5619] l2cap_le_start+0x25b/0x1960 [ 111.943009][ T5619] ? __pfx_l2cap_le_start+0x10/0x10 [ 111.943053][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.943085][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.943115][ T5619] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 111.943148][ T5619] ? mutex_lock_nested+0x152/0x1d0 [ 111.943172][ T5619] ? l2cap_connect_cfm+0x894/0x1560 [ 111.943200][ T5619] l2cap_connect_cfm+0x8d5/0x1560 [ 111.943236][ T5619] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 111.943263][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.943294][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.943322][ T5619] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 111.943355][ T5619] ? mutex_lock_nested+0x152/0x1d0 [ 111.943376][ T5619] ? hci_connect_cfm+0x2c/0x140 [ 111.943398][ T5619] ? __pfx_l2cap_connect_cfm+0x10/0x10 [ 111.943425][ T5619] hci_connect_cfm+0x95/0x140 [ 111.943448][ T5619] le_conn_complete_evt+0x1134/0x16b0 [ 111.943477][ T5619] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 111.943502][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.943534][ T5619] ? lockdep_hardirqs_on+0x7a/0x110 [ 111.943566][ T5619] ? skb_pull_data+0xfb/0x200 [ 111.943588][ T5619] hci_le_conn_complete_evt+0x187/0x470 [ 111.943691][ T5619] hci_event_packet+0x659/0xef0 [ 111.943727][ T5619] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 111.943754][ T5619] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 111.943776][ T5619] ? __pfx_hci_event_packet+0x10/0x10 [ 111.943810][ T5619] ? rt_spin_unlock+0x14f/0x200 [ 111.943839][ T5619] ? hci_send_to_monitor+0xe2/0x590 [ 111.943867][ T5619] hci_rx_work+0x3ee/0x1040 [ 111.943903][ T5619] ? process_one_work+0x8be/0x1630 [ 111.943930][ T5619] process_one_work+0x98b/0x1630 [ 111.943966][ T5619] ? __pfx_process_one_work+0x10/0x10 [ 111.943991][ T5619] ? do_raw_spin_lock+0x12b/0x2f0 [ 111.944027][ T5619] worker_thread+0xb49/0x1140 [ 111.944056][ T5619] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 111.944087][ T5619] kthread+0x388/0x470 [ 111.944106][ T5619] ? __pfx_worker_thread+0x10/0x10 [ 111.944129][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.944147][ T5619] ret_from_fork+0x514/0xb70 [ 111.944169][ T5619] ? __pfx_ret_from_fork+0x10/0x10 [ 111.944192][ T5619] ? __switch_to+0xc79/0x1410 [ 111.944221][ T5619] ? __pfx_kthread+0x10/0x10 [ 111.944242][ T5619] ret_from_fork_asm+0x1a/0x30 [ 111.944276][ T5619] [ 111.944426][ T5619] Kernel Offset: disabled