last executing test programs: 14.333814708s ago: executing program 1 (id=357): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(cipher_null)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x406, r1) fcntl$setstatus(r1, 0x4, 0x42000) recvmmsg$unix(r2, &(0x7f0000005280), 0x400018e, 0x10040, 0x0) 9.020771114s ago: executing program 3 (id=378): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r1 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffff2, 0x822b01) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000080)={0x0, 0x0, 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x1c0, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x2, 0x2, 0x1, 0x0, {0x6, 0x1ff8, 0x0, 0x5e, 0x0, 0x0, 0x1, 0x1}, 0x1, 0x1, 0xf8}}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0xc, 0x2, 0x0, 0x0, {0x2d9, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x400, 0x5, 0x4}}, @NL80211_ATTR_KEYS={0xe8, 0x51, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_KEY_TYPE={0x8, 0x7, 0x1}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x5}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_SEQ={0x4}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "57f70e40edabdfd4cdc34bebb3"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "f9e295886488529dd5056e0c6b"}]}, {0x4}, {0x30, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "0cb53d6782"}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_MODE={0x5, 0x9, 0x1}, @NL80211_KEY_SEQ={0x12, 0x4, "8b32a83334bface6ef2fc4bc9dae"}]}, {0x40, 0x0, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_TYPE={0x8}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x3}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "4b1b984881c733244749b2596d"}]}]}, @NL80211_ATTR_HIDDEN_SSID={0x8, 0x7e, @random="38649981"}, @NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x8000, 0x1, 0x7, 0x0, {0x100000001, 0x0, 0x0, 0x10, 0x0, 0x1, 0x0, 0x3}, 0x706, 0x1580, 0x8c}}, @NL80211_ATTR_MESH_CONFIG={0x4}, @NL80211_ATTR_KEYS={0x4c, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_SEQ={0x6, 0x4, "8f3d"}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT={0x4}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "96b8503caa5411809c10d8f28e"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}]}, 0x1c0}, 0x1, 0x0, 0x0, 0xc890}, 0x40008851) write$char_usb(r1, &(0x7f0000000040)="e2", 0xff0f) 8.603318554s ago: executing program 3 (id=380): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000100)=0x80000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x9, 0x31, 0xffffffffffffffff, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000140)={@host}) 8.321408591s ago: executing program 3 (id=381): r0 = socket$nl_route(0x10, 0x3, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000200)={0x40, 0x4, 0x8, 0x6, 0xd, 0x0, 0x3, 0x0, 0x1, 0x1, 0x4, 0x10}, 0xe) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$bt_hci(r0, 0x84, 0x80, &(0x7f0000000000)=""/4079, &(0x7f0000001040)=0xfef) 8.031739578s ago: executing program 3 (id=382): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) dup2(r0, r1) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={0x0, 0x8000}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) sendto$inet6(r1, &(0x7f0000000040)='l', 0x1, 0x7ddfdbdfaba51c5d, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) 7.1167889s ago: executing program 3 (id=384): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x55, &(0x7f0000000180)=ANY=[@ANYBLOB="12010002020000402505a7a400010000000109024300020100c001090400000102020100052400100104240202052401000105240600010705810308000a09040100020a00000007058202000200070503020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev/ttyACM0\x00', 0x2, 0x1) syz_usb_control_io(r0, 0x0, 0x0) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, 0x0) 4.221877439s ago: executing program 2 (id=395): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x4e20, 0x22000003, @empty, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1, 0x2}]}, 0x10) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x8}, 0x1c) 3.946897056s ago: executing program 2 (id=396): socket(0x10, 0x803, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x3, 0xe7b, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x100}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, 0x0, 0x0, 0x1, &(0x7f0000000340)={0x2e, 0x45, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x300, 0x0, {}, 0x0, r0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) 3.371393439s ago: executing program 0 (id=398): symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000004c0)='./bus\x00', 0x40) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000140)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}]}) chdir(&(0x7f0000000000)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) chmod(&(0x7f0000000240)='./file0\x00', 0x0) 3.065297477s ago: executing program 0 (id=399): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) futex(0x0, 0x6, 0x0, 0x0, 0x0, 0x0) 2.788928453s ago: executing program 2 (id=400): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f0000000280)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) chdir(&(0x7f00000003c0)='./bus\x00') linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) 2.493253751s ago: executing program 2 (id=401): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 2.271311106s ago: executing program 2 (id=402): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x2}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@rand_addr=0x64010100, 0x1, 0x7fff, 0x4e23, 0x25, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@mcast1, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffffb}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x20048041}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000009c0)=@newsa={0x148, 0x1a, 0x1, 0xfffffffe, 0x100, {{@in=@multicast2, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x4e20, 0x71c, 0x4e21, 0x5, 0x2, 0x0, 0x20, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x300, 0xf, 0x6, 0xfffffffffffffbff, 0x8251c, 0xffffffffffff37a6, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1ff, 0xfffffffffffffffe}, {0xfffffffe, 0x3fc}, 0x80, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @XFRMA_SET_MARK={0x8, 0x1d, 0xfffffeff}, @XFRMA_SET_MARK_MASK={0x8}]}, 0x148}}, 0x844) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x3, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) 1.922616504s ago: executing program 0 (id=403): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000680)=@newtfilter={0x94, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x1}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x5}}]}, 0x94}}, 0x0) 1.801181597s ago: executing program 2 (id=404): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001030000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000040)={0x18, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f00000005c0)={0x60, 0xc, 0x1, '!'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.511884154s ago: executing program 0 (id=405): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000040)=0x1) ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000200)=@userptr={0x0, 0x1, 0x4, 0x2, 0x0, {0x77359400}, {0x2, 0x2, 0x0, 0x0, 0x0, 0x0, '#\x00'}, 0x0, 0x2, {0x0}}) 1.124483443s ago: executing program 1 (id=406): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0}, &(0x7f0000000840), &(0x7f0000000880)=r1}, 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000000c0)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @local}, {0x11, 0xff, 0x0, @multicast2}}}}}, 0x0) 925.190658ms ago: executing program 1 (id=407): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, 0x0, 0x0) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000002c0)={r2, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r2, 0x1, 0x6, @remote}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x100, {0x0, 0x0, 0x0, r2, {0xe, 0x1}}}, 0x24}}, 0x4) 606.898916ms ago: executing program 1 (id=408): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x5, 0x6, 0x8, 0x40, 0xc0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x20, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x50, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffcac, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xfffffffffffffeef) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r1, 0x0, 0x0}, 0x10) 381.801881ms ago: executing program 3 (id=409): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0x43, 0x1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x1, r1}) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000005c0)={0x0, r1}) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000500)=' ,1\t#|^q', 0x8}], 0x1) 368.534841ms ago: executing program 1 (id=417): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2000850) 253.152284ms ago: executing program 0 (id=410): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f000016d000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0}) bind$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x5, 0x9, 0x3, 0x4, 0x7, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 128.549737ms ago: executing program 1 (id=411): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(&(0x7f0000000100)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='romfs\x00', 0x4004, 0x0) 0s ago: executing program 0 (id=412): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0x2}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newtfilter={0x48, 0x2c, 0xd2f, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x3}, {}, {0x8, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "f2c47d4007080fe0974c91f29a972c4d"}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.77' (ED25519) to the list of known hosts. [ 89.582798][ T5762] cgroup: Unknown subsys name 'net' [ 89.733171][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.525430][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 93.251217][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.264827][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 93.273146][ T5787] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 93.282073][ T5787] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 93.290484][ T5787] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 93.298849][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 93.325642][ T5792] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 93.333872][ T5792] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 93.342311][ T5792] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 93.349142][ T5789] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.356741][ T5792] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 93.357660][ T5789] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.372710][ T5789] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.377270][ T5792] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 93.383423][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 93.394356][ T5792] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 93.401844][ T5789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 93.412779][ T5085] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 93.421052][ T5085] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 93.429051][ T5085] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 93.460982][ T5794] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 93.497937][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 93.516567][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 93.525428][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 93.977089][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 94.048937][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 94.188155][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 94.207378][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 94.258846][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.266594][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.274861][ T5784] bridge_slave_0: entered allmulticast mode [ 94.282928][ T5784] bridge_slave_0: entered promiscuous mode [ 94.302036][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.309333][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.316713][ T5784] bridge_slave_1: entered allmulticast mode [ 94.324290][ T5784] bridge_slave_1: entered promiscuous mode [ 94.345865][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.353118][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.361133][ T5780] bridge_slave_0: entered allmulticast mode [ 94.368607][ T5780] bridge_slave_0: entered promiscuous mode [ 94.416554][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.426781][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.434149][ T5780] bridge_slave_1: entered allmulticast mode [ 94.441397][ T5780] bridge_slave_1: entered promiscuous mode [ 94.513720][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.535527][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.547524][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.582166][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.642585][ T5784] team0: Port device team_slave_0 added [ 94.661001][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.668522][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.679081][ T5779] bridge_slave_0: entered allmulticast mode [ 94.686628][ T5779] bridge_slave_0: entered promiscuous mode [ 94.708134][ T5784] team0: Port device team_slave_1 added [ 94.730179][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.737840][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.745532][ T5779] bridge_slave_1: entered allmulticast mode [ 94.752931][ T5779] bridge_slave_1: entered promiscuous mode [ 94.764211][ T5780] team0: Port device team_slave_0 added [ 94.774099][ T5780] team0: Port device team_slave_1 added [ 94.793035][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.800716][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.808259][ T5785] bridge_slave_0: entered allmulticast mode [ 94.816164][ T5785] bridge_slave_0: entered promiscuous mode [ 94.858337][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.865810][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.873060][ T5785] bridge_slave_1: entered allmulticast mode [ 94.881733][ T5785] bridge_slave_1: entered promiscuous mode [ 94.915546][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.925743][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.933007][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.959713][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.992795][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.023420][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.030715][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.058359][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.072333][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.079943][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.106549][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.119103][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.132839][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.159094][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.199258][ T5779] team0: Port device team_slave_0 added [ 95.210056][ T5779] team0: Port device team_slave_1 added [ 95.240627][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.253072][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.331843][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.339063][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.365784][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.382996][ T5780] hsr_slave_0: entered promiscuous mode [ 95.390748][ T5780] hsr_slave_1: entered promiscuous mode [ 95.412457][ T5785] team0: Port device team_slave_0 added [ 95.421877][ T5785] team0: Port device team_slave_1 added [ 95.429572][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.437598][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.463823][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.491127][ T5784] hsr_slave_0: entered promiscuous mode [ 95.498146][ T5784] hsr_slave_1: entered promiscuous mode [ 95.505779][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 95.513977][ T5784] Cannot create hsr debugfs directory [ 95.524983][ T5787] Bluetooth: hci3: command tx timeout [ 95.525003][ T5783] Bluetooth: hci0: command tx timeout [ 95.525307][ T5783] Bluetooth: hci2: command tx timeout [ 95.589182][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.596468][ T5783] Bluetooth: hci1: command tx timeout [ 95.602086][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.628562][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.642446][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.649953][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.676156][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.712067][ T5779] hsr_slave_0: entered promiscuous mode [ 95.718807][ T5779] hsr_slave_1: entered promiscuous mode [ 95.725358][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 95.733003][ T5779] Cannot create hsr debugfs directory [ 95.922046][ T5785] hsr_slave_0: entered promiscuous mode [ 95.929516][ T5785] hsr_slave_1: entered promiscuous mode [ 95.936563][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 95.944347][ T5785] Cannot create hsr debugfs directory [ 96.254604][ T5779] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.276140][ T5779] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.290404][ T5779] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.301336][ T5779] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.425219][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.447075][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.470781][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.482807][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.616275][ T5784] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.634780][ T5784] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 96.646659][ T5784] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 96.658621][ T5784] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 96.702723][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.770320][ T5785] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 96.783151][ T5785] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 96.807706][ T5785] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 96.820703][ T5785] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 96.847515][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.887342][ T997] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.894817][ T997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.908990][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.956070][ T4295] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.963275][ T4295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.975604][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.000655][ T1146] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.007915][ T1146] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.058910][ T1146] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.066429][ T1146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.118491][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.214527][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.292537][ T4295] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.299905][ T4295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.335960][ T4295] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.343198][ T4295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.381250][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.499707][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.524384][ T9] cfg80211: failed to load regulatory.db [ 97.549544][ T997] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.556841][ T997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.599111][ T5783] Bluetooth: hci3: command tx timeout [ 97.599156][ T5085] Bluetooth: hci0: command tx timeout [ 97.604915][ T5783] Bluetooth: hci2: command tx timeout [ 97.620832][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.628216][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.674111][ T5085] Bluetooth: hci1: command tx timeout [ 97.745925][ T5785] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 97.810697][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.967523][ T5779] veth0_vlan: entered promiscuous mode [ 97.991756][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.002826][ T5779] veth1_vlan: entered promiscuous mode [ 98.115143][ T5779] veth0_macvtap: entered promiscuous mode [ 98.146230][ T5779] veth1_macvtap: entered promiscuous mode [ 98.220630][ T5780] veth0_vlan: entered promiscuous mode [ 98.239877][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.256709][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.275320][ T5780] veth1_vlan: entered promiscuous mode [ 98.291515][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.304275][ T5779] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.313315][ T5779] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.327878][ T5779] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.337125][ T5779] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.392602][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.497218][ T5784] veth0_vlan: entered promiscuous mode [ 98.507459][ T5780] veth0_macvtap: entered promiscuous mode [ 98.520713][ T5780] veth1_macvtap: entered promiscuous mode [ 98.552747][ T5784] veth1_vlan: entered promiscuous mode [ 98.592685][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.603873][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.650454][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 98.662579][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.678591][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.743065][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 98.754889][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.766936][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.779715][ T5784] veth0_macvtap: entered promiscuous mode [ 98.791128][ T5785] veth0_vlan: entered promiscuous mode [ 98.808414][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.813050][ T5784] veth1_macvtap: entered promiscuous mode [ 98.823080][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.833372][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.843321][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.852251][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.861102][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.894287][ T5785] veth1_vlan: entered promiscuous mode [ 98.973334][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 98.995024][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.006743][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 99.017917][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.030032][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.052951][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.067615][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.077975][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.088869][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.101525][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.151176][ T5784] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.183788][ T5784] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.192681][ T5784] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.228248][ T5784] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.256498][ T997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.314113][ T997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.352599][ T5785] veth0_macvtap: entered promiscuous mode [ 99.389219][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.400352][ T5785] veth1_macvtap: entered promiscuous mode [ 99.407031][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.488300][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 99.511133][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.526400][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 99.541187][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.549287][ T5842] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 99.555246][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 99.571035][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.585504][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.607777][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.627440][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.638271][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.650732][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.662179][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 99.673243][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 99.677688][ T5085] Bluetooth: hci0: command tx timeout [ 99.689136][ T5787] Bluetooth: hci2: command tx timeout [ 99.690102][ T5783] Bluetooth: hci3: command tx timeout [ 99.750117][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.764098][ T5783] Bluetooth: hci1: command tx timeout [ 99.821397][ T5785] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.867953][ T5785] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.886692][ T5785] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.898310][ T5785] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.992630][ T1146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.005305][ T1146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.171414][ T997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.209955][ T997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.252740][ T5855] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.7'. [ 100.265879][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.295327][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.410641][ T1129] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.459704][ T1129] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.553976][ T5860] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.755005][ T5783] Bluetooth: hci3: command tx timeout [ 101.755047][ T5085] Bluetooth: hci0: command tx timeout [ 101.761963][ T5783] Bluetooth: hci2: command tx timeout [ 101.835358][ T5783] Bluetooth: hci1: command tx timeout [ 102.203979][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 102.415456][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 102.427515][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 102.438299][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 102.456727][ T9] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 102.466971][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.499081][ T9] usb 1-1: config 0 descriptor?? [ 102.947681][ T9] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 103.012358][ T9] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 103.712694][ T5927] loop4: detected capacity change from 0 to 7 [ 103.734691][ T5927] Dev loop4: unable to read RDB block 7 [ 103.754913][ T5927] loop4: AHDI p2 [ 103.758674][ T5927] loop4: partition table partially beyond EOD, truncated [ 104.338191][ T5936] netlink: 28 bytes leftover after parsing attributes in process `syz.3.36'. [ 105.139913][ T5955] syz.0.42[5955]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 105.176200][ T5955] loop0: detected capacity change from 0 to 256 [ 105.226850][ T8] usb 1-1: USB disconnect, device number 2 [ 105.311110][ T5955] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x4ec6003b, utbl_chksum : 0xe619d30d) [ 105.782447][ T5963] gadgetfs: bound to dummy_udc driver [ 111.438676][ T5977] bridge0: entered allmulticast mode [ 111.713659][ T8] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 111.914061][ T8] usb 4-1: Using ep0 maxpacket: 8 [ 111.940229][ T8] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 111.953400][ T8] usb 4-1: config 179 has no interface number 0 [ 111.970186][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 112.018797][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 112.046812][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 112.058710][ T8] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 112.075973][ T8] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 112.127078][ T8] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 112.162527][ T8] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.199691][ T5979] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 112.760006][ T6012] batadv_slave_1: entered promiscuous mode [ 112.791943][ T6011] batadv_slave_1: left promiscuous mode [ 112.870249][ T8] input: Generic X-Box pad as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:179.65/input/input5 [ 114.052955][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 114.061470][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 114.071878][ T8] usb 4-1: USB disconnect, device number 2 [ 114.420714][ T6053] loop1: detected capacity change from 0 to 512 [ 114.451427][ T6053] EXT4-fs: Ignoring removed mblk_io_submit option [ 114.464439][ T6053] EXT4-fs: Ignoring removed bh option [ 114.535137][ T6053] EXT4-fs error (device loop1): ext4_iget_extra_inode:4740: inode #15: comm syz.1.76: corrupted in-inode xattr: e_value size too large [ 114.573311][ T6053] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.76: couldn't read orphan inode 15 (err -117) [ 114.613406][ T6053] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 114.982023][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.003968][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.011477][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.034393][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.063654][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.082435][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.113704][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.121212][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.150752][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.169763][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.188867][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.203537][ T5824] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 115.213290][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.231404][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.245127][ T8] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 115.250168][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.270641][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.296358][ T8] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 115.306037][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.306084][ T23] hid-generic 0008:0008:0001.0002: unknown main item tag 0x0 [ 115.326995][ T23] hid-generic 0008:0008:0001.0002: hidraw1: HID v0.04 Device [syz1] on syz0 [ 115.459642][ T5824] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 115.481407][ T5824] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 115.525507][ T5824] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 115.568158][ T5824] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.629199][ T5824] hub 2-1:4.0: USB hub found [ 115.834469][ T5824] hub 2-1:4.0: 14 ports detected [ 115.839564][ T5824] usb 2-1: selecting invalid altsetting 1 [ 115.863539][ T5824] hub 2-1:4.0: Using single TT (err -22) [ 115.874094][ T5824] hub 2-1:4.0: insufficient power available to use all downstream ports [ 115.999750][ T6066] loop3: detected capacity change from 0 to 40427 [ 116.015197][ T6066] ======================================================= [ 116.015197][ T6066] WARNING: The mand mount option has been deprecated and [ 116.015197][ T6066] and is ignored by this kernel. Remove the mand [ 116.015197][ T6066] option from the mount to silence this warning. [ 116.015197][ T6066] ======================================================= [ 116.054737][ T5824] hub 2-1:4.0: hub_hub_status failed (err = -71) [ 116.061899][ T5824] hub 2-1:4.0: config failed, can't get hub status (err -71) [ 116.120728][ T6066] F2FS-fs (loop3): Found nat_bits in checkpoint [ 116.134143][ T5824] usb 2-1: USB disconnect, device number 2 [ 116.336488][ T6066] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 116.534752][ T5780] syz-executor: attempt to access beyond end of device [ 116.534752][ T5780] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 116.587330][ T5780] F2FS-fs (loop3): Stopped filesystem due to reason: 3 [ 116.757423][ T5784] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 117.058168][ T6099] loop2: detected capacity change from 0 to 256 [ 117.090948][ T6099] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 119.309739][ T6163] netlink: 'syz.3.116': attribute type 15 has an invalid length. [ 119.318547][ T6163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.116'. [ 119.341560][ T6163] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 119.350876][ T6163] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 119.359788][ T6163] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 119.369581][ T6163] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 119.382740][ T6163] netlink: 'syz.3.116': attribute type 15 has an invalid length. [ 119.390869][ T6163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.116'. [ 119.400403][ T6163] Zero length message leads to an empty skb [ 120.044216][ T6188] netlink: 8 bytes leftover after parsing attributes in process `syz.3.125'. [ 120.058949][ T6188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.069628][ T6188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.080187][ T6188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.092493][ T6188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.113534][ T6188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.136101][ T6188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.147256][ T6188] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.161042][ T6188] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.177151][ T6189] netlink: 8 bytes leftover after parsing attributes in process `syz.3.125'. [ 120.235320][ T6189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.263589][ T6189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.283614][ T6189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.314906][ T6189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.339938][ T6189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.359143][ T6189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.369288][ T6189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 120.380164][ T6189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 120.634861][ T6196] netlink: 24 bytes leftover after parsing attributes in process `syz.0.128'. [ 120.842157][ T6184] loop1: detected capacity change from 0 to 32768 [ 120.962502][ T6184] loop1: p1 p3 < > [ 120.973648][ T5821] IPVS: starting estimator thread 0... [ 121.064110][ T6205] IPVS: using max 17 ests per chain, 40800 per kthread [ 122.855584][ T6227] netlink: 8 bytes leftover after parsing attributes in process `syz.0.141'. [ 122.867556][ T6227] netlink: 160 bytes leftover after parsing attributes in process `syz.0.141'. [ 123.002344][ T6231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.143'. [ 123.042282][ T23] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 123.172837][ T6233] input: syz1 as /devices/virtual/input/input6 [ 123.244405][ T23] usb 3-1: Using ep0 maxpacket: 16 [ 123.260982][ T23] usb 3-1: New USB device found, idVendor=041e, idProduct=4018, bcdDevice=ed.b4 [ 123.278991][ T23] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.293770][ T23] usb 3-1: Product: syz [ 123.298976][ T23] usb 3-1: Manufacturer: syz [ 123.307390][ T23] usb 3-1: SerialNumber: syz [ 123.331586][ T23] usb 3-1: config 0 descriptor?? [ 123.356404][ T23] gspca_main: spca508-2.14.0 probing 041e:4018 [ 123.532315][ T6239] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 123.609862][ T6239] overlayfs: failed to look up (tracing) for ino (-66) [ 123.621522][ T23] gspca_spca508: reg_read err -32 [ 123.641846][ T23] gspca_spca508: reg_read err -32 [ 123.652085][ T23] gspca_spca508: reg_read err -32 [ 123.661603][ T23] gspca_spca508: reg_read err -32 [ 123.875734][ T23] gspca_spca508: reg write: error -71 [ 123.881323][ T23] spca508: probe of 3-1:0.0 failed with error -71 [ 123.911269][ T23] usb 3-1: USB disconnect, device number 2 [ 123.969109][ T5764] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 124.004106][ T5764] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 124.233673][ T5824] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 124.440608][ T5824] usb 1-1: unable to get BOS descriptor or descriptor too short [ 124.458263][ T5824] usb 1-1: config 129 has an invalid interface number: 135 but max is 0 [ 124.482948][ T5824] usb 1-1: config 129 has an invalid interface number: 5 but max is 0 [ 124.504151][ T5824] usb 1-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 124.516397][ T5824] usb 1-1: config 129 has no interface number 0 [ 124.522736][ T5824] usb 1-1: config 129 has no interface number 1 [ 124.535163][ T5824] usb 1-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 124.551445][ T5824] usb 1-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 124.566398][ T5824] usb 1-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 124.600162][ T5824] usb 1-1: config 129 interface 135 has no altsetting 0 [ 124.615061][ T5824] usb 1-1: config 129 interface 5 has no altsetting 0 [ 124.638951][ T5824] usb 1-1: string descriptor 0 read error: -22 [ 124.653714][ T5824] usb 1-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 124.669101][ T5824] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 124.709407][ T5824] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 124.722780][ T5824] usb 1-1: MIDIStreaming interface descriptor not found [ 124.793762][ T56] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 125.006313][ T56] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.026909][ T56] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 125.048118][ T6269] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.058485][ T56] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 125.070879][ T56] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 125.086426][ T6269] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.086664][ T56] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 125.104689][ T56] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 125.139924][ T5821] usb 1-1: USB disconnect, device number 3 [ 125.248961][ T6270] vlan2: entered promiscuous mode [ 125.254335][ T6270] bridge0: entered promiscuous mode [ 125.273673][ T23] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 125.453809][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 125.474847][ T23] usb 4-1: unable to get BOS descriptor or descriptor too short [ 125.490957][ T23] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 125.501489][ T23] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 125.515465][ T23] usb 4-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.40 [ 125.531958][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.540392][ T23] usb 4-1: Product: syz [ 125.550680][ T23] usb 4-1: Manufacturer: syz [ 125.563774][ T23] usb 4-1: SerialNumber: syz [ 125.818438][ T23] usb 4-1: unit 4 not found! [ 125.829897][ T23] usb 4-1: unit 0 not found! [ 126.209598][ T56] [drm] Initialized gud 1.0.0 20200422 for 2-1:1.0 on minor 2 [ 126.346005][ T6267] loop3: detected capacity change from 0 to 512 [ 126.390466][ T6267] EXT4-fs error (device loop3): ext4_orphan_get:1404: inode #15: comm syz.3.156: inode has both inline data and extents flags [ 126.419141][ T6267] EXT4-fs error (device loop3): ext4_orphan_get:1409: comm syz.3.156: couldn't read orphan inode 15 (err -117) [ 126.473199][ T6267] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 126.542030][ T56] gud 2-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 126.607825][ T56] usb 2-1: USB disconnect, device number 3 [ 126.647036][ T5764] usb 4-1: USB disconnect, device number 3 [ 127.191298][ T6294] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 127.329112][ T5780] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 127.405849][ T6295] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.456381][ T6295] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.489458][ T6295] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 127.505569][ T6295] bond0 (unregistering): Released all slaves [ 127.532992][ T6303] netlink: 20 bytes leftover after parsing attributes in process `syz.3.167'. [ 127.549613][ T6304] netlink: 20 bytes leftover after parsing attributes in process `syz.3.167'. [ 127.633623][ T56] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 127.873536][ T56] usb 2-1: Using ep0 maxpacket: 32 [ 127.883062][ T56] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 127.903628][ T56] usb 2-1: config 0 has no interface number 0 [ 127.917259][ T56] usb 2-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 127.937710][ T56] usb 2-1: config 0 interface 184 has no altsetting 0 [ 127.947642][ T56] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 127.963539][ T56] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.983072][ T56] usb 2-1: Product: syz [ 127.987673][ T56] usb 2-1: Manufacturer: syz [ 127.992355][ T56] usb 2-1: SerialNumber: syz [ 128.000693][ T56] usb 2-1: config 0 descriptor?? [ 128.006938][ T6300] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 128.017194][ T56] smsc75xx v1.0.0 [ 128.159212][ T6316] netlink: 8 bytes leftover after parsing attributes in process `syz.3.172'. [ 128.238863][ T6300] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 128.681821][ T56] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 128.717001][ T56] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 128.962439][ T6324] loop0: detected capacity change from 0 to 512 [ 128.994103][ T6324] EXT4-fs error (device loop0): ext4_validate_block_bitmap:430: comm syz.0.175: bg 0: block 5: invalid block bitmap [ 129.019516][ T6324] EXT4-fs (loop0): Remounting filesystem read-only [ 129.039576][ T6324] EXT4-fs (loop0): 2 truncates cleaned up [ 129.055421][ T6324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 129.169602][ T5779] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.183667][ T56] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71 [ 129.207148][ T56] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71 [ 129.233751][ T56] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 129.274296][ T56] smsc75xx: probe of 2-1:0.184 failed with error -71 [ 129.295335][ T56] usb 2-1: USB disconnect, device number 4 [ 131.543539][ T56] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 131.751877][ T56] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 131.771478][ T56] usb 1-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 131.781694][ T56] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.022295][ T6406] syz.3.188 uses obsolete (PF_INET,SOCK_PACKET) [ 132.240667][ T56] wacom 0003:056A:033B.0005: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 132.258662][ T56] wacom 0003:056A:033B.0005: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.0-1/input0 [ 132.287536][ T56] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/0003:056A:033B.0005/input/input7 [ 132.489298][ T5821] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 132.679922][ T5821] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.693270][ T5821] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 132.703604][ T5821] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 132.720091][ T5821] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 132.729500][ T5821] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.740267][ T8] usb 1-1: USB disconnect, device number 4 [ 132.751232][ T5821] usb 4-1: config 0 descriptor?? [ 132.764478][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805cfd5800: rx timeout, send abort [ 132.775282][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88805cfd5800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 133.224963][ T5821] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving [ 133.248232][ T5821] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 133.371496][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.378621][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.884913][ T5821] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 133.896695][ T5821] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 134.167531][ T5821] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 134.556060][ C0] plantronics 0003:047F:FFFF.0006: usb_submit_urb(ctrl) failed: -1 [ 134.694644][ T8] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 134.959171][ T6427] ceph: No mds server is up or the cluster is laggy [ 135.184169][ T56] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 135.387161][ T56] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 135.387467][ T5821] usb 4-1: USB disconnect, device number 4 [ 135.407424][ T56] usb 3-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 135.429135][ T56] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.598724][ T28] audit: type=1326 audit(1787670224.734:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.680629][ T28] audit: type=1326 audit(1787670224.754:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.746741][ T28] audit: type=1326 audit(1787670224.764:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.820973][ T28] audit: type=1326 audit(1787670224.764:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.882607][ T28] audit: type=1326 audit(1787670224.764:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.939622][ T56] wacom 0003:056A:033B.0007: Unknown device_type for 'HID 056a:033b'. Assuming pen. [ 135.965779][ T28] audit: type=1326 audit(1787670224.764:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 135.998664][ T56] wacom 0003:056A:033B.0007: hidraw0: USB HID v1.11 Device [HID 056a:033b] on usb-dummy_hcd.2-1/input0 [ 136.035237][ T56] input: Wacom Intuos S 2 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/0003:056A:033B.0007/input/input10 [ 136.043930][ T28] audit: type=1326 audit(1787670224.764:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 136.143831][ T28] audit: type=1326 audit(1787670224.764:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 136.227221][ T28] audit: type=1326 audit(1787670224.764:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 136.282735][ T28] audit: type=1326 audit(1787670224.764:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6459 comm="syz.3.209" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f76f819e0d9 code=0x7ffc0000 [ 136.509580][ T5821] usb 3-1: USB disconnect, device number 3 [ 138.538459][ T6486] syz.2.218 (6486): drop_caches: 2 [ 139.478782][ T6482] netlink: 12 bytes leftover after parsing attributes in process `syz.0.216'. [ 139.518001][ T6484] netlink: 60 bytes leftover after parsing attributes in process `syz.0.216'. [ 139.690839][ T6498] loop1: detected capacity change from 0 to 1024 [ 139.764998][ T6498] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 140.254816][ T5784] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 140.918153][ T6513] syz.3.228 (6513): drop_caches: 2 [ 140.936790][ T27] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 141.229306][ T27] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 141.367669][ T6513] syz.3.228 (6513): drop_caches: 2 [ 141.764720][ T27] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 142.006096][ T6516] ceph: No mds server is up or the cluster is laggy [ 142.103070][ T27] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 142.302664][ T27] usb 2-1: config 1 interface 0 altsetting 13 endpoint 0x2 has an invalid bInterval 32, changing to 9 [ 142.343634][ T27] usb 2-1: config 1 interface 0 has no altsetting 0 [ 142.358880][ T27] usb 2-1: string descriptor 0 read error: -22 [ 142.367969][ T27] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 142.380772][ T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 142.849339][ T27] keytouch 0003:0926:3333.0008: fixing up Keytouch IEC report descriptor [ 142.893862][ T27] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/0003:0926:3333.0008/input/input13 [ 143.105389][ T27] keytouch 0003:0926:3333.0008: input,hidraw0: USB HID v0.05 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 143.172398][ T27] usb 2-1: USB disconnect, device number 5 [ 143.357465][ T6548] fido_id[6548]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 143.663664][ T56] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 143.868244][ T56] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 143.894430][ T56] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 143.910588][ T56] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 143.927143][ T6560] loop1: detected capacity change from 0 to 1024 [ 143.943528][ T56] usb 3-1: New USB device found, idVendor=15a4, idProduct=9020, bcdDevice= 1.00 [ 143.982841][ T56] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.008144][ T56] usb 3-1: Product: syz [ 144.020627][ T56] usb 3-1: Manufacturer: syz [ 144.033994][ T56] usb 3-1: SerialNumber: syz [ 144.060818][ T6551] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 144.105911][ T56] af9005: boot packet bulk message failed: -22 (252/0) [ 144.121544][ T56] dvb-usb: found a 'Afatech DVB-T USB1.1 stick' in cold state, will try to load a firmware [ 144.177149][ T56] usb 3-1: Direct firmware load for af9005.fw failed with error -2 [ 144.197024][ T56] usb 3-1: Falling back to sysfs fallback for: af9005.fw [ 144.383984][ T6566] Driver unsupported XDP return value 0 on prog (id 20) dev N/A, expect packet loss! [ 144.760368][ C1] hrtimer: interrupt took 1563106 ns [ 146.104900][ T6596] gadgetfs: bound to dummy_udc driver [ 146.775398][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805bc2b400: rx timeout, send abort [ 147.190454][ T6614] netlink: 8 bytes leftover after parsing attributes in process `syz.3.265'. [ 147.276061][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805bc28400: rx timeout, send abort [ 147.284722][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805bc2b400: abort rx timeout. Force session deactivation [ 147.488609][ T6616] IPv4: Oversized IP packet from 127.202.26.0 [ 147.689713][ T6620] erspan0: entered promiscuous mode [ 147.729240][ T6620] macsec1: entered promiscuous mode [ 147.737795][ T6620] macsec1: entered allmulticast mode [ 147.744888][ T6620] erspan0: entered allmulticast mode [ 147.767617][ T6620] erspan0: left allmulticast mode [ 147.784524][ C0] vcan0: j1939_tp_rxtimer: 0xffff88805bc28400: abort rx timeout. Force session deactivation [ 147.796774][ T6620] erspan0: left promiscuous mode [ 147.939769][ T28] kauditd_printk_skb: 17 callbacks suppressed [ 147.939789][ T28] audit: type=1804 audit(1787670237.064:29): pid=6624 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.270" name="file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" dev="ramfs" ino=9824 res=1 errno=0 [ 147.987953][ C0] vkms_vblank_simulate: vblank timer overrun [ 148.648693][ T6634] input: syz0 as /devices/virtual/input/input14 [ 150.144188][ T6658] "syz.2.283" (6658) uses obsolete ecb(arc4) skcipher [ 150.401429][ T6662] tipc: Started in network mode [ 150.453758][ T6662] tipc: Node identity ac1414aa, cluster identity 4711 [ 150.535937][ T6662] tipc: Enabled bearer , priority 10 [ 151.555092][ T27] tipc: Node number set to 2886997162 [ 152.728713][ T6676] loop0: detected capacity change from 0 to 32768 [ 152.834276][ T6676] XFS (loop0): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 153.004862][ T6676] XFS (loop0): Ending clean mount [ 153.087157][ T6676] XFS (loop0): Quotacheck needed: Please wait. [ 153.287717][ T6676] XFS (loop0): Quotacheck: Done. [ 153.785930][ T5779] XFS (loop0): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a [ 154.326514][ T6713] netlink: 12 bytes leftover after parsing attributes in process `syz.2.302'. [ 154.359761][ T6713] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.369020][ T6713] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.378000][ T6713] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.386871][ T6713] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.448066][ T6713] netlink: 12 bytes leftover after parsing attributes in process `syz.2.302'. [ 154.677626][ T6715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.301'. [ 154.707638][ T6715] netlink: 'syz.0.301': attribute type 12 has an invalid length. [ 154.818291][ T6715] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.828847][ T6715] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.839615][ T6715] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.850098][ T6715] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 154.958346][ T6715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.301'. [ 154.994046][ T6715] netlink: 'syz.0.301': attribute type 12 has an invalid length. [ 155.427006][ T6727] process 'syz.0.308' launched '/dev/fd/6' with NULL argv: empty string added [ 156.231682][ T6741] loop1: detected capacity change from 0 to 128 [ 156.277508][ T6741] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 156.334701][ T6741] ext4 filesystem being mounted at /76/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 156.842304][ T5784] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 159.502962][ T6781] loop2: detected capacity change from 0 to 4096 [ 159.554912][ T6781] EXT4-fs: Ignoring removed orlov option [ 159.629732][ T6781] EXT4-fs (loop2): Test dummy encryption mode enabled [ 159.737055][ T6781] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 160.395626][ T6781] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 160.542683][ T6779] loop1: detected capacity change from 0 to 32768 [ 160.605395][ T6779] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.329 (6779) [ 160.688612][ T5785] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.801811][ T6779] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 160.884047][ T6779] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm [ 160.938747][ T6779] BTRFS info (device loop1): setting nodatasum [ 160.958619][ T6779] BTRFS info (device loop1): force zlib compression, level 3 [ 161.004067][ T6779] BTRFS info (device loop1): setting incompat feature flag for COMPRESS_LZO (0x8) [ 161.046440][ T6779] BTRFS info (device loop1): use lzo compression, level 0 [ 161.083855][ T6779] BTRFS info (device loop1): turning on flush-on-commit [ 161.154070][ T6779] BTRFS info (device loop1): enabling auto defrag [ 161.161908][ T6779] BTRFS info (device loop1): max_inline at 4096 [ 161.200672][ T6779] BTRFS info (device loop1): using free space tree [ 161.479699][ T6779] BTRFS info (device loop1): enabling ssd optimizations [ 161.667664][ T28] audit: type=1800 audit(1787670250.804:30): pid=6779 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.329" name="file1" dev="loop1" ino=260 res=0 errno=0 [ 161.753613][ T6817] Bluetooth: MGMT ver 1.22 [ 161.780816][ T6817] Bluetooth: hci0: invalid len left 7, exp >= 102 [ 162.201432][ T6819] netlink: 'syz.0.338': attribute type 1 has an invalid length. [ 162.331267][ T6819] bond1: entered promiscuous mode [ 162.338808][ T6819] 8021q: adding VLAN 0 to HW filter on device bond1 [ 162.420702][ T5784] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 162.577841][ T6819] 8021q: adding VLAN 0 to HW filter on device bond1 [ 162.620217][ T6819] bond1: (slave ip6tnl1): The slave device specified does not support setting the MAC address [ 162.658736][ T6819] bond1: (slave ip6tnl1): Setting fail_over_mac to active for active-backup mode [ 162.727897][ T6819] bond1: (slave ip6tnl1): making interface the new active one [ 162.767009][ T6819] ip6tnl1: entered promiscuous mode [ 162.815325][ T6819] bond1: (slave ip6tnl1): Enslaving as an active interface with an up link [ 163.157478][ T6826] loop0: detected capacity change from 0 to 512 [ 163.219070][ T6826] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a803c02c, mo2=0002] [ 163.244798][ T6826] System zones: 1-12 [ 163.344121][ T6826] EXT4-fs error (device loop0): ext4_xattr_inode_iget:446: comm syz.0.340: error while reading EA inode 32 err=-116 [ 163.409270][ T6826] EXT4-fs (loop0): Remounting filesystem read-only [ 163.428485][ T6826] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2855: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 163.500312][ T6826] EXT4-fs warning (device loop0): ext4_evict_inode:257: couldn't mark inode dirty (err -5) [ 163.538561][ T6826] EXT4-fs (loop0): 1 orphan inode deleted [ 163.568652][ T6826] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 164.171081][ T5779] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 164.857161][ T6843] loop2: detected capacity change from 0 to 128 [ 164.949460][ T5782] udevd[5782]: incorrect ext4 checksum on /dev/loop2 [ 165.018033][ T6843] EXT4-fs (loop2): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 165.114968][ T6843] ext4 filesystem being mounted at /93/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 165.313842][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 165.407870][ T5785] EXT4-fs (loop2): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 165.526742][ T9] usb 2-1: config index 0 descriptor too short (expected 28277, got 36) [ 165.558397][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 165.599685][ T9] usb 2-1: config 0 has no interfaces? [ 165.630488][ T9] usb 2-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 165.670885][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 165.710168][ T9] usb 2-1: config 0 descriptor?? [ 166.044123][ T23] usb 2-1: USB disconnect, device number 6 [ 166.170840][ C0] Unknown status report in ack skb [ 166.898581][ T6872] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 170.443452][ C0] sched: RT throttling activated [ 170.732045][ T6912] loop2: detected capacity change from 0 to 131072 [ 170.759848][ T6912] F2FS-fs (loop2): invalid crc value [ 170.836888][ T6912] F2FS-fs (loop2): Found nat_bits in checkpoint [ 170.903838][ T6912] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4 [ 171.873576][ T6923] trusted_key: syz.0.377 sent an empty control message without MSG_MORE. [ 172.494746][ T28] audit: type=1326 audit(1787670261.634:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6925 comm="syz.0.379" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f401cf9e0d9 code=0x0 [ 174.414758][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 174.632072][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a7, bcdDevice= 1.00 [ 174.675896][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.842785][ T6952] kAFS: No cell specified [ 174.956792][ T9] cdc_acm 4-1:1.0: ttyACM0: USB ACM device [ 178.626933][ T6988] netlink: 'syz.2.401': attribute type 4 has an invalid length. [ 178.692697][ T6988] netlink: 'syz.2.401': attribute type 4 has an invalid length. [ 180.145726][ T7000] batadv_slave_0: entered promiscuous mode [ 180.152913][ T7000] netlink: 4 bytes leftover after parsing attributes in process `syz.1.407'. [ 180.163293][ T7000] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 180.280685][ T7000] batadv_slave_0 (unregistering): left promiscuous mode [ 180.288248][ T7000] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 180.574353][ T6265] usb 4-1: USB disconnect, device number 5 [ 181.655722][ T7013] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 181.731314][ C0] ------------[ cut here ]------------ [ 181.739400][ C0] WARNING: CPU: 0 PID: 7011 at net/mac80211/tx.c:5048 __ieee80211_beacon_get+0x1141/0x1520 [ 181.755334][ C0] Modules linked in: [ 181.757255][ T7013] syz.1.411: attempt to access beyond end of device [ 181.757255][ T7013] loop1: rw=0, sector=0, nr_sectors = 2 limit=0 [ 181.762391][ C0] CPU: 0 PID: 7011 Comm: syz.1.411 Not tainted syzkaller #0 [ 181.762442][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 181.762465][ C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 181.762509][ C0] Code: f7 4c 89 ef e8 b0 c0 b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 bb de 79 f7 0f 0b e9 61 f8 ff ff e8 af de 79 f7 <0f> 0b e9 85 fb ff ff e8 a3 de 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 181.762529][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 181.762553][ C0] RAX: ffffffff8a0d93c1 RBX: dffffc0000000000 RCX: ffff888029d79e00 [ 181.762572][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 181.762617][ C0] RBP: 0000000000000000 R08: ffff888029d79e00 R09: 0000000000000003 [ 181.762633][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805c602440 [ 181.762649][ C0] R13: ffff88801d711024 R14: ffff88805c602930 R15: ffff88801d711000 [ 181.762666][ C0] FS: 00007fef241f66c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 181.762687][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.762703][ C0] CR2: 00007f339fb424c3 CR3: 0000000079567000 CR4: 00000000003506f0 [ 181.762725][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 181.762739][ C0] DR3: 0000000000000001 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 181.762754][ C0] Call Trace: [ 181.762765][ C0] [ 181.762777][ C0] ? __ieee80211_beacon_get+0x36/0x1520 [ 181.762824][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 181.762869][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 181.762916][ C0] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 181.762953][ C0] __iterate_interfaces+0x225/0x4c0 [ 181.762980][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 181.763008][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 181.763037][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 181.763065][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 181.763097][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 181.763122][ C0] ? hw_scan_work+0xf10/0xf10 [ 181.763147][ C0] __hrtimer_run_queues+0x525/0xc10 [ 181.763195][ C0] ? hrtimer_interrupt+0x980/0x980 [ 181.763219][ C0] ? read_tsc+0x9/0x20 [ 181.763255][ C0] hrtimer_run_softirq+0x177/0x290 [ 181.763287][ C0] handle_softirqs+0x27d/0x820 [ 181.763309][ C0] ? read_tsc+0x9/0x20 [ 181.763332][ C0] ? ktime_get+0x24b/0x280 [ 181.763362][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 181.763389][ C0] ? do_softirq+0x1a0/0x1a0 [ 182.043936][ T0] NOHZ tick-stop error: local softirq work is pending, handler #44!!! [ 182.048796][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 182.067183][ C0] __irq_exit_rcu+0xd3/0x190 [ 182.071857][ C0] ? irq_exit_rcu+0x20/0x20 [ 182.076473][ C0] irq_exit_rcu+0x9/0x20 [ 182.080878][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 182.086813][ C0] [ 182.089955][ C0] [ 182.092966][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 182.099083][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 182.105739][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 1b a8 c3 f6 65 8b 05 7c 76 6a 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 182.125468][ C0] RSP: 0018:ffffc9000386f740 EFLAGS: 00000206 [ 182.131618][ C0] RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 60fa456f6cf14100 [ 182.139702][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 182.147786][ C0] RBP: ffffc9000386f7c0 R08: ffffffff8e8c866f R09: 1ffffffff1d190cd [ 182.155925][ C0] R10: dffffc0000000000 R11: fffffbfff1d190ce R12: dffffc0000000000 [ 182.164108][ C0] R13: ffff8880b8e29bf8 R14: ffff8880b8e295c0 R15: 1ffff9200070dee8 [ 182.172174][ C0] ? _raw_spin_unlock+0x40/0x40 [ 182.177142][ C0] ? detach_timer+0x13d/0x2b0 [ 182.181888][ C0] __try_to_del_timer_sync+0x1c2/0x280 [ 182.187473][ C0] ? __timer_delete_sync+0x10e/0x2e0 [ 182.192932][ C0] __timer_delete_sync+0x223/0x2e0 [ 182.198159][ C0] ? timer_delete_sync+0x20/0x20 [ 182.203218][ C0] schedule_timeout+0x192/0x2d0 [ 182.208240][ C0] ? console_conditional_schedule+0x40/0x40 [ 182.214342][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 182.220438][ C0] ? update_process_times+0x1b0/0x1b0 [ 182.225998][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 182.231266][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 182.236589][ C0] ? snd_rawmidi_write+0x371/0xb90 [ 182.241776][ C0] snd_rawmidi_write+0x3bd/0xb90 [ 182.246842][ C0] ? snd_rawmidi_read+0x6d0/0x6d0 [ 182.251980][ C0] ? do_task_dead+0xd0/0xd0 [ 182.256617][ C0] ? end_current_label_crit_section+0x149/0x170 [ 182.262924][ C0] ? common_file_perm+0x198/0x1f0 [ 182.268122][ C0] ? fsnotify_perm+0x5d/0x5e0 [ 182.272860][ C0] ? security_file_permission+0x79/0xa0 [ 182.278514][ C0] do_iter_write+0x4e5/0xc50 [ 182.283196][ C0] ? snd_rawmidi_read+0x6d0/0x6d0 [ 182.288330][ C0] ? vfs_iter_write+0xa0/0xa0 [ 182.293074][ C0] ? __import_iovec+0x3fa/0x850 [ 182.298201][ C0] ? import_iovec+0x73/0xa0 [ 182.302796][ C0] do_writev+0x27f/0x480 [ 182.307250][ C0] ? do_readv+0x460/0x460 [ 182.311682][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 182.317789][ C0] ? lock_chain_count+0x20/0x20 [ 182.322699][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 182.328025][ C0] do_syscall_64+0x55/0xb0 [ 182.332513][ C0] ? clear_bhb_loop+0x40/0x90 [ 182.337309][ C0] ? clear_bhb_loop+0x40/0x90 [ 182.342130][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 182.348131][ C0] RIP: 0033:0x7fef25f9e0d9 [ 182.352638][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 182.372525][ C0] RSP: 002b:00007fef241f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 182.381247][ C0] RAX: ffffffffffffffda RBX: 00007fef26225fa0 RCX: 00007fef25f9e0d9 [ 182.389334][ C0] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000004 [ 182.397410][ C0] RBP: 00007fef26035024 R08: 0000000000000000 R09: 0000000000000000 [ 182.405478][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 182.405705][ T0] NOHZ tick-stop error: local softirq work is pending, handler #04!!! [ 182.413617][ C0] R13: 00007fef26226038 R14: 00007fef26225fa0 R15: 00007ffdb1fe11c8 [ 182.429762][ C0] [ 182.432815][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 182.440213][ C0] CPU: 0 PID: 7011 Comm: syz.1.411 Not tainted syzkaller #0 [ 182.447559][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 182.457635][ C0] Call Trace: [ 182.460939][ C0] [ 182.463827][ C0] dump_stack_lvl+0x18c/0x250 [ 182.468582][ C0] ? show_regs_print_info+0x20/0x20 [ 182.473930][ C0] ? load_image+0x420/0x420 [ 182.478493][ C0] panic+0x2ca/0x720 [ 182.482457][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 182.487034][ C0] __warn+0x2e0/0x470 [ 182.491093][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.496915][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.502852][ C0] report_bug+0x2be/0x4f0 [ 182.507329][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.513639][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.519438][ C0] ? __ieee80211_beacon_get+0x1143/0x1520 [ 182.525218][ C0] handle_bug+0xcf/0x120 [ 182.529551][ C0] exc_invalid_op+0x1a/0x50 [ 182.533598][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 182.542459][ C0] asm_exc_invalid_op+0x1a/0x20 [ 182.547367][ C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 182.553747][ C0] Code: f7 4c 89 ef e8 b0 c0 b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 bb de 79 f7 0f 0b e9 61 f8 ff ff e8 af de 79 f7 <0f> 0b e9 85 fb ff ff e8 a3 de 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 182.573465][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 182.579617][ C0] RAX: ffffffff8a0d93c1 RBX: dffffc0000000000 RCX: ffff888029d79e00 [ 182.583613][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 182.595849][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 182.604225][ C0] RBP: 0000000000000000 R08: ffff888029d79e00 R09: 0000000000000003 [ 182.612243][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805c602440 [ 182.620976][ C0] R13: ffff88801d711024 R14: ffff88805c602930 R15: ffff88801d711000 [ 182.629093][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.633637][ T0] NOHZ tick-stop error: local softirq work is pending, handler #06!!! [ 182.643051][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 182.648918][ C0] ? __ieee80211_beacon_get+0x36/0x1520 [ 182.654536][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 182.660240][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 182.667071][ C0] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 182.672903][ C0] __iterate_interfaces+0x225/0x4c0 [ 182.678254][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 182.684574][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 182.691869][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 182.698194][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 182.705282][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 182.710547][ C0] ? hw_scan_work+0xf10/0xf10 [ 182.715299][ C0] __hrtimer_run_queues+0x525/0xc10 [ 182.720577][ C0] ? hrtimer_interrupt+0x980/0x980 [ 182.725832][ C0] ? read_tsc+0x9/0x20 [ 182.729947][ C0] hrtimer_run_softirq+0x177/0x290 [ 182.735109][ C0] handle_softirqs+0x27d/0x820 [ 182.739943][ C0] ? read_tsc+0x9/0x20 [ 182.744051][ C0] ? ktime_get+0x24b/0x280 [ 182.748499][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 182.753329][ C0] ? do_softirq+0x1a0/0x1a0 [ 182.757925][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 182.763203][ C0] __irq_exit_rcu+0xd3/0x190 [ 182.767856][ C0] ? irq_exit_rcu+0x20/0x20 [ 182.772421][ C0] irq_exit_rcu+0x9/0x20 [ 182.776712][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 182.782408][ C0] [ 182.785465][ C0] [ 182.788434][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 182.794460][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 182.801024][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 1b a8 c3 f6 65 8b 05 7c 76 6a 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 182.820678][ C0] RSP: 0018:ffffc9000386f740 EFLAGS: 00000206 [ 182.826798][ C0] RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 60fa456f6cf14100 [ 182.834926][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 182.842945][ C0] RBP: ffffc9000386f7c0 R08: ffffffff8e8c866f R09: 1ffffffff1d190cd [ 182.850971][ C0] R10: dffffc0000000000 R11: fffffbfff1d190ce R12: dffffc0000000000 [ 182.858990][ C0] R13: ffff8880b8e29bf8 R14: ffff8880b8e295c0 R15: 1ffff9200070dee8 [ 182.867095][ C0] ? _raw_spin_unlock+0x40/0x40 [ 182.872037][ C0] ? detach_timer+0x13d/0x2b0 [ 182.876781][ C0] __try_to_del_timer_sync+0x1c2/0x280 [ 182.882306][ C0] ? __timer_delete_sync+0x10e/0x2e0 [ 182.883568][ T0] NOHZ tick-stop error: local softirq work is pending, handler #86!!! [ 182.895830][ C0] __timer_delete_sync+0x223/0x2e0 [ 182.901023][ C0] ? timer_delete_sync+0x20/0x20 [ 182.906021][ C0] schedule_timeout+0x192/0x2d0 [ 182.910954][ C0] ? console_conditional_schedule+0x40/0x40 [ 182.916918][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 182.922956][ C0] ? update_process_times+0x1b0/0x1b0 [ 182.928420][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 182.933604][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 182.941930][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 182.947275][ C0] ? snd_rawmidi_write+0x371/0xb90 [ 182.952415][ C0] snd_rawmidi_write+0x3bd/0xb90 [ 182.957417][ C0] ? snd_rawmidi_read+0x6d0/0x6d0 [ 182.962501][ C0] ? do_task_dead+0xd0/0xd0 [ 182.967150][ C0] ? end_current_label_crit_section+0x149/0x170 [ 182.973469][ C0] ? common_file_perm+0x198/0x1f0 [ 182.978567][ C0] ? fsnotify_perm+0x5d/0x5e0 [ 182.983305][ C0] ? security_file_permission+0x79/0xa0 [ 182.983643][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 182.997190][ C0] do_iter_write+0x4e5/0xc50 [ 183.001858][ C0] ? snd_rawmidi_read+0x6d0/0x6d0 [ 183.006933][ C0] ? vfs_iter_write+0xa0/0xa0 [ 183.011665][ C0] ? __import_iovec+0x3fa/0x850 [ 183.016603][ C0] ? import_iovec+0x73/0xa0 [ 183.021205][ C0] do_writev+0x27f/0x480 [ 183.025506][ C0] ? do_readv+0x460/0x460 [ 183.030015][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 183.036070][ C0] ? lock_chain_count+0x20/0x20 [ 183.040999][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 183.046272][ C0] do_syscall_64+0x55/0xb0 [ 183.051011][ C0] ? clear_bhb_loop+0x40/0x90 [ 183.055740][ C0] ? clear_bhb_loop+0x40/0x90 [ 183.060597][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 183.066576][ C0] RIP: 0033:0x7fef25f9e0d9 [ 183.071050][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 183.090837][ C0] RSP: 002b:00007fef241f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 183.099519][ C0] RAX: ffffffffffffffda RBX: 00007fef26225fa0 RCX: 00007fef25f9e0d9 [ 183.107540][ C0] RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000004 [ 183.115563][ C0] RBP: 00007fef26035024 R08: 0000000000000000 R09: 0000000000000000 [ 183.123582][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 183.131598][ C0] R13: 00007fef26226038 R14: 00007fef26225fa0 R15: 00007ffdb1fe11c8 [ 183.139642][ C0] [ 183.143283][ C0] Kernel Offset: disabled [ 183.147711][ C0] Rebooting in 86400 seconds..