last executing test programs: 22.276491261s ago: executing program 1 (id=2): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f0000000ac0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") creat(&(0x7f0000000380)='./bus\x00', 0x0) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x139) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x19, 0x5, "ef359f413bb93852f7d6a4ae5c70f20ff8ee09e737ff0edf1139c2eb4b68c660e677df7019051caafa00afaaf755a314a10400", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a323ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000522100000001", [0x8, 0x100]}) ioctl$PIO_SCRNMAP(r0, 0x4b41, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2200020, 0x0) 21.417074591s ago: executing program 1 (id=8): r0 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000200)={r0}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r1, &(0x7f0000000340)={&(0x7f0000000140)={0x2d, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) 20.673613288s ago: executing program 1 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000080)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') 19.973389583s ago: executing program 32 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/strings/0x409/s1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000080)='./config/usb_gadget/g1/functions/mass_storage.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./config/usb_gadget/g1/configs/c.1/mass_storage.usb0\x00') 19.961558231s ago: executing program 2 (id=3): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan1\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, r2, 0x200, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24010844}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r4) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000980)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xd}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8004000}, 0x4008804) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102400, 0x19000) setxattr$incfs_metadata(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r8 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r9 = dup2(r8, r8) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x40000000, 0x10}) ioctl$BLKTRACETEARDOWN(r9, 0x1276, 0x0) ioctl$SCSI_IOCTL_GET_PCI(0xffffffffffffffff, 0x5393, &(0x7f0000000000)) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r5, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5, 0x34, 0x4}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}]}, 0x68}, 0x1, 0x0, 0x0, 0x8084}, 0x20040000) 18.686682053s ago: executing program 2 (id=17): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'lo\x00', &(0x7f0000000140)=@ethtool_regs={0x4, 0x200, 0xb, "075a90a940b00c3d69e19e"}}) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0xffffffa6, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x0) 17.5131023s ago: executing program 2 (id=21): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) 15.841643537s ago: executing program 2 (id=28): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x36, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa22}, 0x94) socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, 0x0, 0x0) bind$tipc(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r2) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x20, r3, 0x6a98047402e98331, 0x4070bd29, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004110}, 0x8800) bind$tipc(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6, &(0x7f0000000300)=[{}, {}], 0x10, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x8, 0x0, 0x0}}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r7, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x48, 0x24, 0xf0b, 0x70bd2e, 0x400000, {0x0, 0x0, 0x12, r8, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x298c, 0x2, 0x0, 0x401}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x3c000001}, 0x0) 14.388946308s ago: executing program 2 (id=34): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x1ff, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f00000003c0)={0x0, 0x4, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000001300)=@usbdevfs_driver={0x0, 0x4, 0x0}) 10.630599435s ago: executing program 3 (id=47): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0xffff, 0x3}, {}, {0x7, 0x8}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x20044004) r8 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000200)=[{&(0x7f00000005c0)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4) socket$netlink(0x10, 0x3, 0x0) 9.003332704s ago: executing program 3 (id=51): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newsa={0x13c, 0x10, 0x413, 0x70bd28, 0x40, {{@in=@rand_addr=0x64010102, @in=@multicast1, 0x4620, 0x7, 0x4e23, 0x4, 0xa, 0x0, 0x20, 0x2b}, {@in=@dev={0xac, 0x14, 0x14, 0x38}, 0x4d4, 0x32}, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, {0x80000000800, 0x17d, 0x0, 0x40000000000004, 0xffffffffffffffff, 0x6, 0x7f, 0x2}, {0x0, 0x21fd, 0x4, 0x2}, {0xf6, 0x4, 0x8}, 0x0, 0x34ff, 0xa, 0x4, 0xbe, 0x33}, [@algo_aead={0x4c, 0x12, {{'rfc4309(ccm(aes))\x00'}, 0x0, 0x80}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x4040840}, 0x4000804) 7.811641123s ago: executing program 3 (id=56): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f00000009c0)={'syztnl1\x00', 0x0, 0x29, 0x0, 0x1, 0x65b, 0x0, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x0, 0x8}}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) 7.003590034s ago: executing program 4 (id=59): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() capset(&(0x7f00000001c0)={0x19980330, r0}, &(0x7f0000000200)={0x0, 0x5, 0x5, 0xff, 0xaf26, 0xa0}) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) 5.537761512s ago: executing program 5 (id=61): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1ff) 5.1850124s ago: executing program 3 (id=64): r0 = socket(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0x2, @loopback, 0x6}, 0x1c) socket$vsock_stream(0x28, 0x1, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0x3, 0x40) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000700)=0x2000008, 0x4) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) recvfrom(r4, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 5.182102422s ago: executing program 5 (id=65): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000180)={'security\x00', 0x2, [{}, {}]}, 0x48) 4.097694101s ago: executing program 0 (id=67): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x2, 0x0, 0x1, 0x1009, 0x7f}, {0x12, 0x2, 0x1000, 0x401, 0x8001}, 0x40000, 0x4000004, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) 3.821279033s ago: executing program 4 (id=68): r0 = inotify_init() r1 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000000c0)={@multicast2=0xe0004000, @dev={0xac, 0x14, 0x14, 0x2f}, r2}, 0xc) close_range(r0, 0xffffffffffffffff, 0x0) 3.509319264s ago: executing program 0 (id=69): socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000900)={0x2, 0x5, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x61e5cc96}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x6bb, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20082f5}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000040)="39000000130003474cbb65e1c3e4ffff06000d0001000000", 0x18}], 0x1) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 3.326688251s ago: executing program 4 (id=70): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers_probe\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='se', 0x2) 2.990141665s ago: executing program 3 (id=71): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) close(r3) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) 2.937294241s ago: executing program 4 (id=72): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000100)="ea", 0xffdb, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto(r0, &(0x7f00000002c0), 0xfffffffffffffe92, 0x100007f, 0x0, 0x0) 2.917095546s ago: executing program 2 (id=73): unshare(0x60000600) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0x2804000, &(0x7f0000000140)={[{@jqfmt_vfsv0}, {@nomblk_io_submit}, {@noblock_validity}, {@nomblk_io_submit}, {@inlinecrypt}, {@grpquota}, {@nomblk_io_submit}, {@noinit_itable}, {@dioread_nolock}]}, 0x1, 0x5aa, &(0x7f0000000e40)="$eJzs3T1sG2UfAPD/neOmH3nf9JXeV3pBHSpAKlJVJ+kHFKZ2RVSq1AGJBSLXjao4dRU70ESRSPcK0QEB6lI2GBhBDAyIhZGVhY8ZqaIRSE0HMHJ8TtPUDk6oY4h/P+ns57k7+/9/fH4e353u5AAG1uHGQxrxREScTyJG1y0bimzh4eZ6K8uLxfvLi8Uk6vULPyeRRMS95cVia/0kez4QEUsR8f+I+CofcTRde8s9rUJ1fmF6slwuzWb1sdrM1bHq/MKxyzOTU6Wp0pUTz79w6vTJUxPHJ9ane7++vpbfWltvfH/z7RvfvHT75sefHFoqvjuZxJkYyZatb8fj1PxM8nFmw/yTvQjWR0m/E2Bbclk/b3Sl/8Vo5LJe3059/eAwvCPpAT1UH46or1lXBAZAotPDgGrtBzSOf1vTTu5/3DnbPABpxF1ZXiy+Fa34Q81zE7F39dhk/y/JQ0cmjePNgzuZKLvS0vWIGB8aevT7n2Tfv+0bfxwJ0lNfnm1uqEe3f7o2/kSb8Wekde70L2qNfyvZ+LfSJn6uw/h3vssYv7364wcd418fjifbxk/W4idt4qcR8XqX8W+98vnpTsvqH0YcifbxW5LNzw+PXbpcLo03H9vG+OLIoRc7tz9if4f4zXO2e1cTWd/+PVlOaZft/+zrT59a2iT+s09vvv3bff77IuKdLuP/595HL3dadud6crexF7DV7Z9EPm53Gf+5M4e/y4rOGgIAAAAAAAAAwGOUrl7LlqSFtXKaFgrNe3j/G/vTcqVaO3qpMpfLrnk7GPm0daXVaLOeNOoT2fW4rfrxDfUTuSxgbt9qvVCslC/2ue0AAAAAAAAAAAAAAAAAAADwd3Fgw/3/v+ZW7//f+HfVwG7V+S+/gd1O/4fB9XD/T/qWB7Dz/P7DwKpv3v/tD8Bu5vcfBpf+D4NL/4fB1bb/79v5PICd5/cfBpf+DwAAAAAAAAAAAAAAAAAAAAAAAAAAPXH+3LnGVL+/vFhs1C8Ozc9NV944drFUnS7MzBULxcrs1cJUpTJVLhWKlZk/e7+kUrk6Hlfmro3VStXaWHV+4bWZytyV1n+IlfI9bxEAAAAAAAAAAAAAAAAAAAD884ysTklaiMg362laKET8KyIOJpFculwujUfEvyPi21x+uFGf6HfSAAAAAAAAAAAAAAAAAAAAsMtU5xemJ8vl0mzvCkNZqO5e9UOtp/kMbWXliFjadJ181rSu02i845ZzbkXp7WYakEKuy+/hwBf6NCABAAAAAAAAAAAAAAAAAMAAe3DTb7ev+L23CQEAAAAAAAAAAAAAAAAAAMBASn9KIqIxHRl9ZmTj0j3JSm71OSLevHXhvWuTtdrsRGP+3bX5tfez+cf7kT/QrVY/TSOi0Y8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAB6rzC9OT5XJpdpuF4S7W6XcbAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALbjjwAAAP//QKjKig==") r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, 0x0, 0x0) 2.810553791s ago: executing program 0 (id=74): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan1\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, r2, 0x200, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x24010844}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r4) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000980)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0xd}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8004000}, 0x4008804) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000032680)=""/102400, 0x19000) setxattr$incfs_metadata(&(0x7f0000000040)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r8 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r9 = dup2(r8, r8) ioctl$BLKTRACESETUP(r9, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x40000000, 0x10}) 1.55667069s ago: executing program 0 (id=75): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="8b330008000000000000050000000c00990000000000faffffff050006"], 0x30}}, 0x0) 1.555258983s ago: executing program 5 (id=76): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x14, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}}, 0x14}}, 0x0) 1.249119587s ago: executing program 4 (id=77): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1802000005000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000b40d00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000a00850000008200000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xc11, 0x0, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 903.36938ms ago: executing program 5 (id=78): mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='control/header/h\x00', 0x1ff) symlink(&(0x7f0000001000)='control/header/h\x00', &(0x7f0000001100)='control/class/fs/h\x00') 718.844412ms ago: executing program 3 (id=79): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x8, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000044) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_WASH={0x8, 0xd, 0x1}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040a1}, 0x4890) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r6, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f00000004c0)="1307622fb9f5d6c0e21b8e36450ff1df", 0x10}], 0x1}, 0x4) 710.564541ms ago: executing program 4 (id=80): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x5}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3, 0x3}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd24, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x5, 0x7, 0x0, 0x7fffffff}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x24000804) 647.219545ms ago: executing program 0 (id=81): mkdir(&(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/functions/midi.usb0/out_ports\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='2', 0x1) 327.182927ms ago: executing program 5 (id=82): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f00000004c0)='\n', 0x1) 124.998296ms ago: executing program 0 (id=83): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r1, &(0x7f00000002c0)={'#! ', './file0', [{0x20, '\t\t\xf2`:y\xd4H\xfa\xee=d\xd7T\x0f7\x93`\xc6\xd84\xa3\xacQT\x8cj\x83\xa8\xb1\x88H\xe3\x16\xeb\x16\xaa\x91Pn\xcd\xde}$\xad`\xd6(\xa8\xaa\xc67?anM_\xa0\xcf\x82\x84\xf8\xb0\x8amlKL!\xd7\xaaKS\xffn*\xcf\t\\\xces\x04\x1e*p\x9e\xf2\x16\x01`\x00\x00\x00B\x1d\xc7\xd8\xb5\x81\x15\x0f[D8\x88@A$\x88\xa5O&\xae\xe3\b\xa8\xd4\x9b\xab\x81\xf4\xd1\f\"e\xcdzA\xf49\xc1\xc8\f\x8c\xb1)*O\xe3\xc3L\xd6J\ta\xf5\xc6\xee\xa2\xd4\xde\xe5\x1b\x1e\x00\xb4\xc2\xac\xacT\xedq\x10\xb1HW\xben\xbc\x9b\x03\xb6#\xd6z\xe5\xf5\xb4\xcdBA(\xd1\xf3Sx\xad\xa37\xda7\xc6\xc3\xcc\xf6w\x19m_O\xc9C\xb4\xea\xd5U\xb3\x82\xab1\x8e\xfc\xe3\xa8\x89\xb1?\xbf\x84\xdb\x01\x00\xc1\r\x16\x15\x8a\x1d\xa1\x98\x0fS\xd1c\x01O\xd7oi\x96\ts\a \x90Y\xe4\xc2\xcbcC\xdb\xa9\x85'}]}, 0x10a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/uac1.usb0/p_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000200)='0\n', 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f0000000040)="20c879ebbdc50bcd6d000000", 0xc) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac1.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000600)='dummy_udc.0\n\x00', 0xc) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) close(r1) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r0, &(0x7f000000c1c0)={0x0, 0x0, &(0x7f000000c080)=[{&(0x7f000000acc0)=""/4096, 0x1000}, {&(0x7f000000bec0)=""/27, 0x1b}], 0x2}, 0x20) 0s ago: executing program 5 (id=84): bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="20002abd7000fedbdf2509000000840004801300010062726f6164636173742d6c696e6b00004c00078008000400070000000800020082b00000080001000200000008000400d538004008000300010001000800040007000000080002000300000008000400040000000800030005"], 0x98}, 0x1, 0x0, 0x0, 0x48c0}, 0x80) r0 = socket(0x400000000010, 0x3, 0x0) write(r0, &(0x7f0000000040)="3a03000018002551075c0165ff0ffc02802000030011000500e1000c0400070080000700", 0x33a) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.0' (ED25519) to the list of known hosts. [ 94.447238][ T5605] cgroup: Unknown subsys name 'net' [ 94.604116][ T5605] cgroup: Unknown subsys name 'cpuset' [ 94.617491][ T5605] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 96.334594][ T5605] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.721383][ T29] cfg80211: failed to load regulatory.db [ 100.628576][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.642124][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.643588][ T5633] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 100.650008][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.668963][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.676785][ T5639] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 100.677286][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 100.692488][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 100.699802][ T5639] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 100.700530][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 100.719697][ T4934] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 100.729708][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 100.738286][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 100.749602][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 100.769652][ T5642] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 100.770327][ T5644] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.779287][ T5642] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 100.795093][ T5642] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 100.795947][ T5644] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 100.803922][ T5642] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 100.816023][ T5644] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 100.818899][ T5642] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 100.832078][ T5642] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 100.835825][ T5644] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 100.854701][ T5644] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 100.882930][ T5644] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 100.894355][ T5644] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 100.903633][ T5644] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 100.917346][ T5644] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 100.929321][ T5644] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 102.797482][ T5639] Bluetooth: hci1: command tx timeout [ 102.797486][ T5644] Bluetooth: hci0: command tx timeout [ 102.877075][ T5644] Bluetooth: hci2: command tx timeout [ 102.887352][ T5644] Bluetooth: hci3: command tx timeout [ 102.957502][ T5644] Bluetooth: hci4: command tx timeout [ 102.964258][ T5639] Bluetooth: hci5: command tx timeout [ 103.302551][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.311011][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.318794][ T5627] bridge_slave_0: entered allmulticast mode [ 103.328268][ T5627] bridge_slave_0: entered promiscuous mode [ 103.392510][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.400208][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.407644][ T5627] bridge_slave_1: entered allmulticast mode [ 103.415459][ T5627] bridge_slave_1: entered promiscuous mode [ 103.555509][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.612483][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.794875][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.802516][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.809828][ T5626] bridge_slave_0: entered allmulticast mode [ 103.817954][ T5626] bridge_slave_0: entered promiscuous mode [ 103.825777][ T5635] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.832983][ T5635] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.840601][ T5635] bridge_slave_0: entered allmulticast mode [ 103.848576][ T5635] bridge_slave_0: entered promiscuous mode [ 103.866124][ T5630] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.873410][ T5630] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.880692][ T5630] bridge_slave_0: entered allmulticast mode [ 103.888696][ T5630] bridge_slave_0: entered promiscuous mode [ 103.899594][ T5627] team0: Port device team_slave_0 added [ 103.914525][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.923057][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.930377][ T5626] bridge_slave_1: entered allmulticast mode [ 103.938682][ T5626] bridge_slave_1: entered promiscuous mode [ 103.946450][ T5635] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.953721][ T5635] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.961472][ T5635] bridge_slave_1: entered allmulticast mode [ 103.969373][ T5635] bridge_slave_1: entered promiscuous mode [ 103.990113][ T5630] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.999362][ T5630] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.006564][ T5630] bridge_slave_1: entered allmulticast mode [ 104.014990][ T5630] bridge_slave_1: entered promiscuous mode [ 104.025527][ T5627] team0: Port device team_slave_1 added [ 104.172750][ T5635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.182348][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.189985][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.197307][ T5628] bridge_slave_0: entered allmulticast mode [ 104.204961][ T5628] bridge_slave_0: entered promiscuous mode [ 104.216909][ T5630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.227390][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.234439][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.260497][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.289857][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.301777][ T5635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.311448][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.318737][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.325955][ T5628] bridge_slave_1: entered allmulticast mode [ 104.334062][ T5628] bridge_slave_1: entered promiscuous mode [ 104.344663][ T5630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.368385][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.375434][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.401950][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.413417][ T5629] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.420845][ T5629] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.428160][ T5629] bridge_slave_0: entered allmulticast mode [ 104.435787][ T5629] bridge_slave_0: entered promiscuous mode [ 104.446413][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.506209][ T5629] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.513671][ T5629] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.521685][ T5629] bridge_slave_1: entered allmulticast mode [ 104.529956][ T5629] bridge_slave_1: entered promiscuous mode [ 104.579468][ T5630] team0: Port device team_slave_0 added [ 104.588571][ T5630] team0: Port device team_slave_1 added [ 104.622284][ T5635] team0: Port device team_slave_0 added [ 104.631573][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.671080][ T5626] team0: Port device team_slave_0 added [ 104.679410][ T5635] team0: Port device team_slave_1 added [ 104.688135][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.729188][ T5629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.741056][ T5626] team0: Port device team_slave_1 added [ 104.810885][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.817992][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.844537][ T5630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.859762][ T5629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.876852][ T5639] Bluetooth: hci1: command tx timeout [ 104.886785][ T5639] Bluetooth: hci0: command tx timeout [ 104.933623][ T5627] hsr_slave_0: entered promiscuous mode [ 104.940473][ T5627] hsr_slave_1: entered promiscuous mode [ 104.948545][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.955616][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.981924][ T5630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.992553][ T5639] Bluetooth: hci3: command tx timeout [ 104.998243][ T5639] Bluetooth: hci2: command tx timeout [ 105.027082][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.034222][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.060538][ T5644] Bluetooth: hci4: command tx timeout [ 105.061173][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.066836][ T5639] Bluetooth: hci5: command tx timeout [ 105.080791][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.089336][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.115928][ T5635] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.131645][ T5628] team0: Port device team_slave_0 added [ 105.141128][ T5628] team0: Port device team_slave_1 added [ 105.178209][ T5629] team0: Port device team_slave_0 added [ 105.185659][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.192725][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.219080][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.231057][ T5635] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.238513][ T5635] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.264550][ T5635] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.287623][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.294626][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.320678][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.335335][ T5629] team0: Port device team_slave_1 added [ 105.413258][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.420671][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.447334][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.473465][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 105.480473][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.506502][ T5629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 105.520999][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.528012][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.554095][ T5629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.662027][ T5630] hsr_slave_0: entered promiscuous mode [ 105.669023][ T5630] hsr_slave_1: entered promiscuous mode [ 105.676017][ T5630] debugfs: 'hsr0' already exists in 'hsr' [ 105.681921][ T5630] Cannot create hsr debugfs directory [ 105.713899][ T5626] hsr_slave_0: entered promiscuous mode [ 105.720630][ T5626] hsr_slave_1: entered promiscuous mode [ 105.728669][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 105.734434][ T5626] Cannot create hsr debugfs directory [ 105.748067][ T5635] hsr_slave_0: entered promiscuous mode [ 105.754788][ T5635] hsr_slave_1: entered promiscuous mode [ 105.761625][ T5635] debugfs: 'hsr0' already exists in 'hsr' [ 105.767422][ T5635] Cannot create hsr debugfs directory [ 105.959556][ T5629] hsr_slave_0: entered promiscuous mode [ 105.966303][ T5629] hsr_slave_1: entered promiscuous mode [ 105.973181][ T5629] debugfs: 'hsr0' already exists in 'hsr' [ 105.979082][ T5629] Cannot create hsr debugfs directory [ 106.013326][ T5628] hsr_slave_0: entered promiscuous mode [ 106.019991][ T5628] hsr_slave_1: entered promiscuous mode [ 106.026406][ T5628] debugfs: 'hsr0' already exists in 'hsr' [ 106.032430][ T5628] Cannot create hsr debugfs directory [ 106.670216][ T5627] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 106.685467][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.712190][ T5627] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 106.723777][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.732150][ T5627] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 106.743554][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.770933][ T5627] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 106.783492][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.852065][ T5635] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.863850][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.878751][ T5635] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.889772][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.898390][ T5635] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.910563][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.935952][ T5635] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 106.948617][ T5635] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.957436][ T5644] Bluetooth: hci1: command tx timeout [ 106.962956][ T5639] Bluetooth: hci0: command tx timeout [ 107.037502][ T5644] Bluetooth: hci2: command tx timeout [ 107.043171][ T5639] Bluetooth: hci3: command tx timeout [ 107.060414][ T5630] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 107.071260][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.080330][ T5630] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 107.092279][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.105719][ T5630] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 107.117230][ T5644] Bluetooth: hci4: command tx timeout [ 107.119485][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.122688][ T5639] Bluetooth: hci5: command tx timeout [ 107.131568][ T5630] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 107.146104][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.275583][ T5626] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.286600][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.294655][ T5626] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.306207][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.315211][ T5626] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.326080][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.334446][ T5626] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.344761][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.420305][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.502803][ T5628] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 107.513637][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.523513][ T5628] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 107.533366][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.542923][ T5628] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 107.554401][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.564246][ T5628] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 107.574764][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.593026][ T5627] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.655265][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.663364][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.684947][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.692165][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.784128][ T5629] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 107.795146][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.821522][ T5629] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 107.832597][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.861534][ T5629] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 107.873711][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.886044][ T5635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.902725][ T5629] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 107.913086][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.971340][ T5630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.060750][ T5635] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.108712][ T5630] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.121653][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.128880][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.188479][ T114] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.195697][ T114] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.212382][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.219598][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.259676][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.285089][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.293021][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.384027][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.430523][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.454341][ T5628] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.495632][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.502829][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.534106][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.541481][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.582321][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.589567][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.634534][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.641816][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.755857][ T5629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.935131][ T5629] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.020062][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.027290][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.038926][ T5639] Bluetooth: hci0: command tx timeout [ 109.044663][ T5644] Bluetooth: hci1: command tx timeout [ 109.104024][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.111259][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.126022][ T5639] Bluetooth: hci3: command tx timeout [ 109.131643][ T5644] Bluetooth: hci2: command tx timeout [ 109.182204][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.197675][ T5639] Bluetooth: hci4: command tx timeout [ 109.204065][ T5644] Bluetooth: hci5: command tx timeout [ 110.530798][ T5635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.645248][ T5630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.832404][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.872068][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.929485][ T5627] veth0_vlan: entered promiscuous mode [ 111.018245][ T5627] veth1_vlan: entered promiscuous mode [ 111.085383][ T5635] veth0_vlan: entered promiscuous mode [ 111.105967][ T5630] veth0_vlan: entered promiscuous mode [ 111.167497][ T5635] veth1_vlan: entered promiscuous mode [ 111.185262][ T5629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.203146][ T5630] veth1_vlan: entered promiscuous mode [ 111.313956][ T5627] veth0_macvtap: entered promiscuous mode [ 111.330716][ T5626] veth0_vlan: entered promiscuous mode [ 111.350183][ T5627] veth1_macvtap: entered promiscuous mode [ 111.382280][ T5626] veth1_vlan: entered promiscuous mode [ 111.423785][ T5635] veth0_macvtap: entered promiscuous mode [ 111.442698][ T5630] veth0_macvtap: entered promiscuous mode [ 111.470016][ T5635] veth1_macvtap: entered promiscuous mode [ 111.483597][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.495583][ T5630] veth1_macvtap: entered promiscuous mode [ 111.514814][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.563192][ T5805] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.574257][ T5805] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.604966][ T5805] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.614460][ T5805] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.640477][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.649651][ T5629] veth0_vlan: entered promiscuous mode [ 111.671420][ T5626] veth0_macvtap: entered promiscuous mode [ 111.701600][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.712406][ T5626] veth1_macvtap: entered promiscuous mode [ 111.729208][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.763132][ T5628] veth0_vlan: entered promiscuous mode [ 111.773145][ T5805] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.783081][ T5805] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.797383][ T5629] veth1_vlan: entered promiscuous mode [ 111.812701][ T5635] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.821162][ T5805] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.858319][ T5805] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.886592][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.940367][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.951011][ T143] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.960485][ T143] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.993480][ T143] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.002452][ T143] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.013919][ T5628] veth1_vlan: entered promiscuous mode [ 112.076197][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.087099][ T5805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.093233][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.098425][ T5805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.137345][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.174377][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.190269][ T5804] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.198803][ T5804] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.227391][ T5629] veth0_macvtap: entered promiscuous mode [ 112.276772][ T5629] veth1_macvtap: entered promiscuous mode [ 112.303538][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.312874][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.414224][ T5804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.420845][ T5628] veth0_macvtap: entered promiscuous mode [ 112.429196][ T5804] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.437590][ T5628] veth1_macvtap: entered promiscuous mode [ 112.460775][ T5627] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 112.485257][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.531005][ T5805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.539408][ T5805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.562811][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.679699][ T5805] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.708888][ T5805] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.723308][ T5858] loop4: detected capacity change from 0 to 512 [ 112.738097][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.767396][ T5805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.793323][ T5858] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 112.804817][ T5805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.819487][ T5858] EXT4-fs (loop4): orphan cleanup on readonly fs [ 112.833410][ T5858] Quota error (device loop4): find_block_dqentry: Quota for id 0 referenced but not present [ 112.846956][ T5858] Quota error (device loop4): qtree_read_dquot: Can't read quota structure for id 0 [ 112.863546][ T5861] loop1: detected capacity change from 0 to 512 [ 112.882459][ T5858] EXT4-fs error (device loop4): ext4_acquire_dquot:7039: comm syz.4.5: Failed to acquire dquot type 1 [ 112.911106][ T5858] loop4: lost filesystem error report for type 5 error -5 [ 112.914083][ T5858] EXT4-fs (loop4): Remounting filesystem read-only [ 112.921523][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 112.921632][ C0] EXT4-fs (loop4): initial error at time 1785000255: ext4_acquire_dquot:7039 [ 112.921677][ C0] EXT4-fs (loop4): last error at time 1785000255: ext4_acquire_dquot:7039 [ 112.966315][ T1167] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.978556][ T1167] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.996406][ T5858] EXT4-fs (loop4): 1 truncate cleaned up [ 113.014242][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.032950][ T5861] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 113.051336][ T5861] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 113.051545][ T5858] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 113.077488][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.088719][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.113201][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.139847][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.177636][ T143] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.212010][ T143] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.233267][ T143] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.244850][ T5861] loop1: detected capacity change from 512 to 0 [ 113.251874][ T143] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.261605][ T5627] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.273266][ T5861] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 113.302022][ T5861] EXT4-fs (loop1): I/O error while writing superblock [ 113.600754][ T5868] loop3: detected capacity change from 0 to 1024 [ 113.626024][ T5868] EXT4-fs: inline encryption not supported [ 113.695204][ T5871] loop0: detected capacity change from 0 to 736 [ 113.734420][ T5630] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.761478][ T5630] Buffer I/O error on dev loop1, logical block 0, lost sync page write [ 113.766009][ T5868] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.783971][ T5630] EXT4-fs (loop1): I/O error while writing superblock [ 113.798709][ T5862] Buffer I/O error on dev loop1, logical block 12, lost sync page write [ 113.802466][ T5805] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.827942][ T5805] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.054898][ T5635] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.286245][ T5804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.320211][ T5804] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.594522][ T5805] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.681429][ T5817] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.707184][ T5817] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.927882][ T5805] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.096509][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.127988][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.975479][ T5805] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 116.685602][ T5907] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 116.692321][ T5907] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 116.729963][ T5907] vhci_hcd vhci_hcd.0: Device attached [ 116.755658][ T5911] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(6) [ 116.762264][ T5911] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 116.780520][ T5905] configfs-gadget.g1 gadget.32: uvc: uvc_function_bind() [ 116.795046][ T5911] vhci_hcd vhci_hcd.0: Device attached [ 116.873782][ T5907] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(5) [ 116.880496][ T5907] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 116.938907][ T5911] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(10) [ 116.945575][ T5911] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 117.015052][ T5907] vhci_hcd vhci_hcd.0: Device attached [ 117.040851][ T5911] vhci_hcd vhci_hcd.0: Device attached [ 117.048144][ T5856] usb 41-1: new high-speed USB device number 2 using vhci_hcd [ 117.076914][ T5920] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(9) [ 117.083482][ T5920] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 117.139992][ T5920] vhci_hcd vhci_hcd.0: Device attached [ 117.184031][ T5921] vhci_hcd: connection closed [ 117.185326][ T5918] vhci_hcd: connection closed [ 117.195071][ T5915] vhci_hcd: connection closed [ 117.200467][ T5912] vhci_hcd: connection closed [ 117.205259][ T5909] vhci_hcd: connection reset by peer [ 117.216173][ T36] vhci_hcd vhci_hcd.4: stop threads [ 117.300380][ T36] vhci_hcd vhci_hcd.4: release socket [ 117.342778][ T36] vhci_hcd vhci_hcd.4: disconnect device [ 117.370004][ T36] vhci_hcd vhci_hcd.4: stop threads [ 117.391542][ T36] vhci_hcd vhci_hcd.4: release socket [ 117.421074][ T36] vhci_hcd vhci_hcd.4: disconnect device [ 117.461208][ T36] vhci_hcd vhci_hcd.4: stop threads [ 117.473256][ T5805] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.529871][ T36] vhci_hcd vhci_hcd.4: release socket [ 117.553279][ T5639] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 117.564273][ T5639] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 117.573465][ T5639] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 117.587297][ T5639] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 117.601693][ T5639] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 117.622030][ T36] vhci_hcd vhci_hcd.4: disconnect device [ 117.671427][ T36] vhci_hcd vhci_hcd.4: stop threads [ 117.721029][ T36] vhci_hcd vhci_hcd.4: release socket [ 117.776842][ T36] vhci_hcd vhci_hcd.4: disconnect device [ 117.834582][ T36] vhci_hcd vhci_hcd.4: stop threads [ 117.871484][ T36] vhci_hcd vhci_hcd.4: release socket [ 117.905483][ T36] vhci_hcd vhci_hcd.4: disconnect device [ 118.172365][ T5938] con [ 118.590739][ T5751] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 118.681612][ T5751] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 119.088411][ T5805] bridge_slave_1: left allmulticast mode [ 119.099081][ T5950] fido_id[5950]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/0000:0000:0000.0001/report_descriptor': No such device [ 119.123089][ T5805] bridge_slave_1: left promiscuous mode [ 119.139134][ T5805] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.208844][ T5805] bridge_slave_0: left allmulticast mode [ 119.237943][ T5805] bridge_slave_0: left promiscuous mode [ 119.265297][ T5805] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.320761][ T5959] capability: warning: `syz.0.27' uses 32-bit capabilities (legacy support in use) [ 119.342760][ T5959] program syz.0.27 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 119.362807][ T5960] configfs-gadget.g1 gadget.32: uvc: uvc_function_unbind() [ 119.677144][ T5639] Bluetooth: hci4: command tx timeout [ 119.740589][ T5973] loop0: detected capacity change from 0 to 128 [ 119.762778][ T5973] ======================================================= [ 119.762778][ T5973] WARNING: The mand mount option has been deprecated and [ 119.762778][ T5973] and is ignored by this kernel. Remove the mand [ 119.762778][ T5973] option from the mount to silence this warning. [ 119.762778][ T5973] ======================================================= [ 119.927581][ T5973] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 119.944123][ T5973] ext4 filesystem being mounted at /3/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 120.210257][ T5805] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 120.224263][ T5805] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 120.238947][ T5805] bond0 (unregistering): Released all slaves [ 120.294721][ T5626] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 120.646944][ T5988] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 120.653520][ T5988] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.719086][ T5988] vhci_hcd vhci_hcd.0: Device attached [ 120.731105][ T5994] vhci_hcd vhci_hcd.0: pdev(3) rhport(1) sockfd(6) [ 120.737668][ T5994] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.748272][ T5994] vhci_hcd vhci_hcd.0: Device attached [ 120.786012][ T5988] vhci_hcd vhci_hcd.0: pdev(3) rhport(2) sockfd(5) [ 120.792592][ T5988] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.815679][ T5988] vhci_hcd vhci_hcd.0: Device attached [ 120.853137][ T5988] vhci_hcd vhci_hcd.0: pdev(3) rhport(3) sockfd(9) [ 120.859745][ T5988] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 120.914651][ T5988] vhci_hcd vhci_hcd.0: Device attached [ 120.937116][ T5634] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 120.954665][ T6002] vhci_hcd: connection closed [ 120.954991][ T5999] vhci_hcd: connection closed [ 120.960394][ T114] vhci_hcd vhci_hcd.3: stop threads [ 120.966597][ T5995] vhci_hcd: connection closed [ 120.971815][ T5989] vhci_hcd: connection closed [ 120.977614][ T24] usb 39-1: new high-speed USB device number 2 using vhci_hcd [ 121.017449][ T5990] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 121.023316][ T114] vhci_hcd vhci_hcd.3: release socket [ 121.055443][ T114] vhci_hcd vhci_hcd.3: disconnect device [ 121.069302][ T6005] loop5: detected capacity change from 0 to 512 [ 121.082941][ T114] vhci_hcd vhci_hcd.3: stop threads [ 121.089214][ T114] vhci_hcd vhci_hcd.3: release socket [ 121.094781][ T114] vhci_hcd vhci_hcd.3: disconnect device [ 121.105932][ T114] vhci_hcd vhci_hcd.3: stop threads [ 121.119678][ T114] vhci_hcd vhci_hcd.3: release socket [ 121.131954][ T114] vhci_hcd vhci_hcd.3: disconnect device [ 121.149276][ T114] vhci_hcd vhci_hcd.3: stop threads [ 121.157791][ T114] vhci_hcd vhci_hcd.3: release socket [ 121.173954][ T5634] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 121.196474][ T114] vhci_hcd vhci_hcd.3: disconnect device [ 121.212667][ T5634] usb 1-1: New USB device found, idVendor=041e, idProduct=4068, bcdDevice= 0.40 [ 121.218813][ T6005] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 121.234295][ T5634] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.234352][ T5634] usb 1-1: Product: syz [ 121.234378][ T5634] usb 1-1: Manufacturer: syz [ 121.264425][ T5634] usb 1-1: SerialNumber: syz [ 121.293103][ T6005] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 121.672248][ T5634] gspca_main: ov519-2.14.0 probing 041e:4068 [ 121.755581][ T5634] ov519 1-1:1.0: reg_w 5a failed -71 [ 121.767732][ T5639] Bluetooth: hci4: command tx timeout [ 122.441319][ T6024] loop3: detected capacity change from 0 to 512 [ 122.495371][ T6024] EXT4-fs: Ignoring removed orlov option [ 122.513849][ T5628] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 122.537465][ T5856] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 122.571506][ T6024] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.641241][ T5805] hsr_slave_0: left promiscuous mode [ 122.685288][ T5805] hsr_slave_1: left promiscuous mode [ 122.749867][ T5805] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 122.785639][ T5805] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 122.850356][ T5805] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 122.876685][ T5805] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 123.028390][ T5805] veth1_macvtap: left promiscuous mode [ 123.034102][ T5805] veth0_macvtap: left promiscuous mode [ 123.064345][ T6043] syz.0.42 uses obsolete (PF_INET,SOCK_PACKET) [ 123.080252][ T5805] veth1_vlan: left promiscuous mode [ 123.106186][ T5805] veth0_vlan: left promiscuous mode [ 123.836719][ T5639] Bluetooth: hci4: command tx timeout [ 123.904853][ T5805] team0 (unregistering): Port device team_slave_1 removed [ 123.933494][ T5805] team0 (unregistering): Port device team_slave_0 removed [ 124.148298][ T5635] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 124.228362][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1 [ 124.381073][ T6051] syzkaller0: entered promiscuous mode [ 124.397765][ T6051] syzkaller0: entered allmulticast mode [ 125.765739][ T6076] syzkaller0: entered promiscuous mode [ 125.773629][ T6076] syzkaller0: entered allmulticast mode [ 125.859719][ T6097] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 125.866389][ T6097] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 125.886324][ T6097] vhci_hcd vhci_hcd.0: Device attached [ 125.913474][ T6097] vhci_hcd vhci_hcd.0: pdev(5) rhport(1) sockfd(5) [ 125.917404][ T5639] Bluetooth: hci4: command tx timeout [ 125.920164][ T6097] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 125.937434][ T6097] vhci_hcd vhci_hcd.0: Device attached [ 125.968656][ T6097] vhci_hcd vhci_hcd.0: pdev(5) rhport(2) sockfd(7) [ 125.975502][ T6097] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 125.989027][ T6097] vhci_hcd vhci_hcd.0: Device attached [ 126.023262][ T6100] vhci_hcd: connection closed [ 126.023570][ T6103] vhci_hcd: connection closed [ 126.027677][ T6098] vhci_hcd: connection closed [ 126.033108][ T36] vhci_hcd vhci_hcd.5: stop threads [ 126.049089][ T6104] loop4: detected capacity change from 0 to 512 [ 126.075847][ T36] vhci_hcd vhci_hcd.5: release socket [ 126.092697][ T36] vhci_hcd vhci_hcd.5: disconnect device [ 126.100042][ T36] vhci_hcd vhci_hcd.5: stop threads [ 126.117996][ T5856] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 126.127647][ T36] vhci_hcd vhci_hcd.5: release socket [ 126.168059][ T6099] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 126.178210][ T36] vhci_hcd vhci_hcd.5: disconnect device [ 126.179063][ T24] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 126.200844][ T36] vhci_hcd vhci_hcd.5: stop threads [ 126.219841][ T36] vhci_hcd vhci_hcd.5: release socket [ 126.240461][ T36] vhci_hcd vhci_hcd.5: disconnect device [ 126.258165][ T6104] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 126.339760][ T6104] ext4 filesystem being mounted at /13/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 126.668332][ T5627] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 126.988138][ T6129] loop5: detected capacity change from 0 to 512 [ 127.011279][ T6132] loop0: detected capacity change from 0 to 512 [ 127.055314][ T6129] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 127.094617][ T6132] EXT4-fs (loop0): 1 truncate cleaned up [ 127.155598][ T6129] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 48 vs 41 free clusters [ 127.171328][ T6132] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 127.174193][ T6129] Quota error (device loop5): write_blk: dquota write failed [ 127.183529][ C1] EXT4-fs (loop5): error count since last fsck: 1 [ 127.183560][ C1] EXT4-fs (loop5): initial error at time 1785000269: ext4_mb_generate_buddy:1314 [ 127.183603][ C1] EXT4-fs (loop5): last error at time 1785000269: ext4_mb_generate_buddy:1314 [ 127.266441][ T6129] Quota error (device loop5): find_free_dqentry: Can't write quota data block 5 [ 127.292521][ T6132] EXT4-fs error (device loop0): ext4_find_dest_de:2049: inode #2: block 13: comm syz.0.55: bad entry in directory: directory entry overrun - offset=76, inode=0, rec_len=1024, size=1024 fake=0 [ 127.351391][ T6129] Quota error (device loop5): write_blk: dquota write failed [ 127.386988][ T6129] Quota error (device loop5): qtree_write_dquot: Error -28 occurred while creating quota [ 127.451435][ T6129] EXT4-fs error (device loop5): ext4_acquire_dquot:7039: comm syz.5.54: Failed to acquire dquot type 1 [ 127.466767][ T6129] loop5: lost filesystem error report for type 5 error -28 [ 127.471105][ T6129] EXT4-fs (loop5): 1 truncate cleaned up [ 127.511885][ T6129] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 127.688177][ T5626] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 127.740095][ T6129] EXT4-fs error (device loop5): __ext4_remount:6844: comm syz.5.54: Abort forced by user [ 127.768240][ T5923] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.780060][ T5923] bridge0: port 1(bridge_slave_0) entered disabled state [ 127.789478][ T5923] bridge_slave_0: entered allmulticast mode [ 127.808135][ T6129] EXT4-fs (loop5): Remounting filesystem read-only [ 127.809434][ T5923] bridge_slave_0: entered promiscuous mode [ 127.850713][ T6129] EXT4-fs (loop5): re-mounted 00000000-0000-0000-0000-000000000000. [ 127.880057][ T5923] bridge0: port 2(bridge_slave_1) entered blocking state [ 127.912009][ T5923] bridge0: port 2(bridge_slave_1) entered disabled state [ 127.949414][ T5923] bridge_slave_1: entered allmulticast mode [ 127.963942][ T6151] netlink: 12 bytes leftover after parsing attributes in process `syz.0.58'. [ 127.973035][ T5923] bridge_slave_1: entered promiscuous mode [ 128.054001][ T5628] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 128.322111][ T5923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.507751][ T5923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.562490][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 129.707228][ T5923] team0: Port device team_slave_0 added [ 129.740515][ T5923] team0: Port device team_slave_1 added [ 129.987359][ T6170] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.996439][ T6170] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.036441][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 130.068272][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.146800][ T5923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 130.442591][ T5923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 130.461716][ T5923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 130.518287][ T5923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 130.856753][ T5634] ov519 1-1:1.0: Can't determine sensor slave IDs [ 130.863316][ T5634] ov519 1-1:1.0: OV519 Config failed [ 130.881790][ T5634] ov519 1-1:1.0: probe with driver ov519 failed with error -22 [ 130.982889][ T5634] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 131.062190][ T5634] usb 1-1: 4:0: cannot get min/max values for control 2 (id 4) [ 131.086808][ T5634] usb 1-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 131.115176][ T5634] usb 1-1: [4] FU [Mic Playback Volume] ch = 1, val = 0/1/1 [ 131.154797][ T5923] hsr_slave_0: entered promiscuous mode [ 131.170510][ T5634] usb 1-1: 4:0: cannot get min/max values for control 2 (id 4) [ 131.180148][ T5634] usb 1-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 131.185121][ T5923] hsr_slave_1: entered promiscuous mode [ 131.194068][ T5634] usb 1-1: [4] FU [Mic Playback Volume] ch = 1, val = 0/1/1 [ 131.225185][ T5923] debugfs: 'hsr0' already exists in 'hsr' [ 131.233571][ T5923] Cannot create hsr debugfs directory [ 131.242286][ T5634] usb 1-1: 4:0: cannot get min/max values for control 3 (id 4) [ 131.270900][ T6184] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 131.289995][ T5856] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 131.473000][ T5634] usb 1-1: 4:0: cannot get min/max values for control 3 (id 4) [ 131.565660][ T5634] usb 1-1: 4:0: cannot get min/max values for control 2 (id 4) [ 131.633963][ T5634] usb 1-1: USB disconnect, device number 2 [ 131.821253][ T5963] udevd[5963]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 132.604834][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.624961][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.170422][ T6213] loop2: detected capacity change from 0 to 1024 [ 133.243787][ T6213] EXT4-fs: Ignoring removed nomblk_io_submit option [ 133.344538][ T6213] EXT4-fs: Ignoring removed nomblk_io_submit option [ 133.402489][ T6213] EXT4-fs: inline encryption not supported [ 133.470622][ T6213] EXT4-fs: Ignoring removed nomblk_io_submit option [ 133.828587][ T6213] EXT4-fs (loop2): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.924692][ T6213] ext4 filesystem being mounted at /5/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 134.751780][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3 [ 135.143352][ T6256] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 135.149940][ T6259] netlink: 642 bytes leftover after parsing attributes in process `syz.5.84'. [ 135.182171][ T6256] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 135.222066][ T6261] process 'syz.0.83' launched './file0' with NULL argv: empty string added [ 135.235283][ T6256] ================================================================== [ 135.243399][ T6256] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x8a/0x90 [ 135.251177][ T6256] Read of size 8 at addr ffff8880762749f0 by task syz.0.83/6256 [ 135.258824][ T6256] [ 135.261171][ T6256] CPU: 1 UID: 0 PID: 6256 Comm: syz.0.83 Not tainted syzkaller #0 PREEMPT(full) [ 135.261222][ T6256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 135.261247][ T6256] Call Trace: [ 135.261259][ T6256] [ 135.261273][ T6256] dump_stack_lvl+0x100/0x190 [ 135.261322][ T6256] print_report+0x13d/0x4b0 [ 135.261382][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.261431][ T6256] ? __virt_addr_valid+0x239/0x430 [ 135.261481][ T6256] ? dummy_free_request+0x8a/0x90 [ 135.261544][ T6256] kasan_report+0xdf/0x1c0 [ 135.261586][ T6256] ? dummy_free_request+0x8a/0x90 [ 135.261655][ T6256] dummy_free_request+0x8a/0x90 [ 135.261717][ T6256] uvc_function_bind+0x181a/0x1939 [ 135.261764][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.261814][ T6256] ? __pfx_uvc_function_bind+0x10/0x10 [ 135.261864][ T6256] usb_add_function+0x219/0x890 [ 135.261923][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.261977][ T6256] configfs_composite_bind+0xd83/0x1960 [ 135.262040][ T6256] ? kernfs_create_link+0x1bd/0x240 [ 135.262090][ T6256] gadget_bind_driver+0x28c/0xbf0 [ 135.262129][ T6256] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 135.262190][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.262238][ T6256] ? __pfx_gadget_bind_driver+0x10/0x10 [ 135.262281][ T6256] really_probe+0x241/0xa60 [ 135.262336][ T6256] __driver_probe_device+0x20e/0x450 [ 135.262392][ T6256] driver_probe_device+0x4a/0x140 [ 135.262446][ T6256] __driver_attach+0x21f/0x5b0 [ 135.262499][ T6256] ? __pfx___driver_attach+0x10/0x10 [ 135.262552][ T6256] bus_for_each_dev+0x13e/0x1d0 [ 135.262593][ T6256] ? __pfx_bus_for_each_dev+0x10/0x10 [ 135.262633][ T6256] ? bus_add_driver+0x2b5/0x5b0 [ 135.262677][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.262732][ T6256] bus_add_driver+0x305/0x5b0 [ 135.262780][ T6256] driver_register+0x1e2/0x360 [ 135.262844][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.262898][ T6256] usb_gadget_register_driver_owner+0x132/0x210 [ 135.262943][ T6256] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 135.262999][ T6256] configfs_write_iter+0x302/0x4e0 [ 135.263066][ T6256] vfs_write+0x6ac/0x1050 [ 135.263116][ T6256] ? __pfx_configfs_write_iter+0x10/0x10 [ 135.263179][ T6256] ? __pfx_vfs_write+0x10/0x10 [ 135.263245][ T6256] ksys_write+0x12a/0x250 [ 135.263293][ T6256] ? __pfx_ksys_write+0x10/0x10 [ 135.263345][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.263398][ T6256] do_syscall_64+0x115/0x870 [ 135.263451][ T6256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.263492][ T6256] RIP: 0033:0x7fdc1e39de99 [ 135.263522][ T6256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.263561][ T6256] RSP: 002b:00007fdc1f1b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 135.263597][ T6256] RAX: ffffffffffffffda RBX: 00007fdc1e625fa0 RCX: 00007fdc1e39de99 [ 135.263624][ T6256] RDX: 000000000000000c RSI: 0000200000000600 RDI: 0000000000000006 [ 135.263649][ T6256] RBP: 00007fdc1e433eaf R08: 0000000000000000 R09: 0000000000000000 [ 135.263674][ T6256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 135.263698][ T6256] R13: 00007fdc1e626038 R14: 00007fdc1e625fa0 R15: 00007ffce4009d68 [ 135.263740][ T6256] [ 135.263753][ T6256] [ 135.582876][ T6256] Allocated by task 5905: [ 135.587205][ T6256] kasan_save_stack+0x30/0x50 [ 135.591932][ T6256] kasan_save_track+0x14/0x30 [ 135.596660][ T6256] __kasan_kmalloc+0xaa/0xb0 [ 135.601291][ T6256] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 135.606692][ T6256] kthread_create_worker_on_node+0xe2/0x220 [ 135.612624][ T6256] uvcg_video_init+0x278/0x6e0 [ 135.617411][ T6256] uvc_function_bind+0x136e/0x1939 [ 135.622542][ T6256] usb_add_function+0x219/0x890 [ 135.627420][ T6256] configfs_composite_bind+0xd83/0x1960 [ 135.632994][ T6256] gadget_bind_driver+0x28c/0xbf0 [ 135.638135][ T6256] really_probe+0x241/0xa60 [ 135.642709][ T6256] __driver_probe_device+0x20e/0x450 [ 135.648022][ T6256] driver_probe_device+0x4a/0x140 [ 135.653071][ T6256] __driver_attach+0x21f/0x5b0 [ 135.657858][ T6256] bus_for_each_dev+0x13e/0x1d0 [ 135.662720][ T6256] bus_add_driver+0x305/0x5b0 [ 135.667498][ T6256] driver_register+0x1e2/0x360 [ 135.672295][ T6256] usb_gadget_register_driver_owner+0x132/0x210 [ 135.678555][ T6256] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 135.684210][ T6256] configfs_write_iter+0x302/0x4e0 [ 135.689349][ T6256] vfs_write+0x6ac/0x1050 [ 135.693699][ T6256] ksys_write+0x12a/0x250 [ 135.698048][ T6256] do_syscall_64+0x115/0x870 [ 135.702668][ T6256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.708574][ T6256] [ 135.710892][ T6256] The buggy address belongs to the object at ffff888076274900 [ 135.710892][ T6256] which belongs to the cache kmalloc-128 of size 128 [ 135.724950][ T6256] The buggy address is located 120 bytes to the right of [ 135.724950][ T6256] allocated 120-byte region [ffff888076274900, ffff888076274978) [ 135.739633][ T6256] [ 135.741959][ T6256] The buggy address belongs to the physical page: [ 135.748367][ T6256] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x76274 [ 135.757144][ T6256] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 135.764269][ T6256] page_type: f5(slab) [ 135.768303][ T6256] raw: 00fff00000000000 ffff88813fe21a00 dead000000000100 dead000000000122 [ 135.776908][ T6256] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 135.785506][ T6256] page dumped because: kasan: bad access detected [ 135.791943][ T6256] page_owner tracks the page as allocated [ 135.797740][ T6256] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13, tgid 13 (kworker/u8:1), ts 115217268695, free_ts 111487372273 [ 135.818400][ T6256] post_alloc_hook+0xfd/0x120 [ 135.823117][ T6256] get_page_from_freelist+0xf48/0x3530 [ 135.828610][ T6256] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 135.834541][ T6256] new_slab+0xa2/0x640 [ 135.838636][ T6256] refill_objects+0xe3/0x410 [ 135.843257][ T6256] __pcs_replace_empty_main+0x376/0x680 [ 135.848826][ T6256] __kmalloc_cache_noprof+0x479/0x6c0 [ 135.854270][ T6256] __hw_addr_create+0x57/0x220 [ 135.859070][ T6256] __hw_addr_add_ex+0x32b/0x650 [ 135.863960][ T6256] dev_mc_add+0xb6/0x110 [ 135.868216][ T6256] igmp6_group_added+0x3e4/0x4c0 [ 135.873191][ T6256] __ipv6_dev_mc_inc+0x701/0xbd0 [ 135.878166][ T6256] addrconf_dad_work+0x276/0x1360 [ 135.883208][ T6256] process_one_work+0xa23/0x1940 [ 135.888246][ T6256] worker_thread+0x5ef/0xe50 [ 135.892862][ T6256] kthread+0x370/0x450 [ 135.897019][ T6256] page last free pid 15 tgid 15 stack trace: [ 135.903042][ T6256] __free_frozen_pages+0x79f/0x1090 [ 135.908269][ T6256] rcu_core+0x5a2/0x10d0 [ 135.912538][ T6256] handle_softirqs+0x1ea/0x9b0 [ 135.917334][ T6256] run_ksoftirqd+0x38/0x60 [ 135.921810][ T6256] smpboot_thread_fn+0x3d3/0xaa0 [ 135.926793][ T6256] kthread+0x370/0x450 [ 135.930950][ T6256] ret_from_fork+0x72b/0xd50 [ 135.935566][ T6256] ret_from_fork_asm+0x1a/0x30 [ 135.940362][ T6256] [ 135.942764][ T6256] Memory state around the buggy address: [ 135.948391][ T6256] ffff888076274880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 135.956513][ T6256] ffff888076274900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 135.964628][ T6256] >ffff888076274980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 135.972730][ T6256] ^ [ 135.980450][ T6256] ffff888076274a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 135.988526][ T6256] ffff888076274a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 135.996594][ T6256] ================================================================== [ 136.033587][ T6256] Disabling lock debugging due to kernel taint [ 136.042525][ T6256] ------------[ cut here ]------------ [ 136.048034][ T6256] !list_empty(&req->queue) [ 136.048055][ T6256] WARNING: drivers/usb/gadget/udc/dummy_hcd.c:691 at dummy_free_request+0x7d/0x90, CPU#0: syz.0.83/6256 [ 136.064187][ T6256] Modules linked in: [ 136.068347][ T6256] CPU: 0 UID: 0 PID: 6256 Comm: syz.0.83 Tainted: G B syzkaller #0 PREEMPT(full) [ 136.079241][ T6256] Tainted: [B]=BAD_PAGE [ 136.084374][ T6256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 136.094517][ T6256] RIP: 0010:dummy_free_request+0x7d/0x90 [ 136.100287][ T6256] Code: 42 9e fa e8 05 d0 3a fa 5b 5d e9 89 d5 40 f9 e8 f9 cf 3a fa 90 0f 0b 90 e8 f0 cf 3a fa 5b 5d e9 74 d5 40 f9 e8 e4 cf 3a fa 90 <0f> 0b 90 eb c7 48 89 ef e8 56 5e aa fa eb b4 0f 1f 40 00 90 90 90 [ 136.120964][ T6256] RSP: 0018:ffffc9000351f890 EFLAGS: 00010246 [ 136.127655][ T6256] RAX: 0000000000080000 RBX: ffff888076274a00 RCX: ffffc90003e61000 [ 136.135742][ T6256] RDX: 0000000000080000 RSI: ffffffff87cf6b9c RDI: ffff88802de33e00 [ 136.144068][ T6256] RBP: ffff8880762749f0 R08: 0000000000000007 R09: 0000000000000000 [ 136.152140][ T6256] R10: 0000000000000000 R11: 6e696c6261736944 R12: ffff888026754c00 [ 136.160328][ T6256] R13: 00000000ffffffea R14: 0000000000000400 R15: ffff888035b26528 [ 136.168381][ T6256] FS: 00007fdc1f1b26c0(0000) GS:ffff888123ddf000(0000) knlGS:0000000000000000 [ 136.177464][ T6256] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 136.184067][ T6256] CR2: 00007fdc1e3eb580 CR3: 000000002db20000 CR4: 0000000000350ef0 [ 136.192115][ T6256] Call Trace: [ 136.195400][ T6256] [ 136.198417][ T6256] uvc_function_bind+0x181a/0x1939 [ 136.203606][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.209351][ T6256] ? __pfx_uvc_function_bind+0x10/0x10 [ 136.214853][ T6256] usb_add_function+0x219/0x890 [ 136.220484][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.226732][ T6256] configfs_composite_bind+0xd83/0x1960 [ 136.232366][ T6256] ? kernfs_create_link+0x1bd/0x240 [ 136.237644][ T6256] gadget_bind_driver+0x28c/0xbf0 [ 136.242698][ T6256] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 136.248422][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.254091][ T6256] ? __pfx_gadget_bind_driver+0x10/0x10 [ 136.259737][ T6256] really_probe+0x241/0xa60 [ 136.264331][ T6256] __driver_probe_device+0x20e/0x450 [ 136.269767][ T6256] driver_probe_device+0x4a/0x140 [ 136.274838][ T6256] __driver_attach+0x21f/0x5b0 [ 136.279697][ T6256] ? __pfx___driver_attach+0x10/0x10 [ 136.285036][ T6256] bus_for_each_dev+0x13e/0x1d0 [ 136.289967][ T6256] ? __pfx_bus_for_each_dev+0x10/0x10 [ 136.295365][ T6256] ? bus_add_driver+0x2b5/0x5b0 [ 136.300285][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.306002][ T6256] bus_add_driver+0x305/0x5b0 [ 136.310801][ T6256] driver_register+0x1e2/0x360 [ 136.315608][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.321965][ T6256] usb_gadget_register_driver_owner+0x132/0x210 [ 136.328813][ T6256] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 136.334508][ T6256] configfs_write_iter+0x302/0x4e0 [ 136.339707][ T6256] vfs_write+0x6ac/0x1050 [ 136.344158][ T6256] ? __pfx_configfs_write_iter+0x10/0x10 [ 136.349875][ T6256] ? __pfx_vfs_write+0x10/0x10 [ 136.354784][ T6256] ksys_write+0x12a/0x250 [ 136.359314][ T6256] ? __pfx_ksys_write+0x10/0x10 [ 136.364299][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.370033][ T6256] do_syscall_64+0x115/0x870 [ 136.374754][ T6256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.380717][ T6256] RIP: 0033:0x7fdc1e39de99 [ 136.385144][ T6256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.406075][ T6256] RSP: 002b:00007fdc1f1b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.408197][ T6224] EXT4-fs error (device loop2): ext4_validate_block_bitmap:440: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 136.414841][ T6256] RAX: ffffffffffffffda RBX: 00007fdc1e625fa0 RCX: 00007fdc1e39de99 [ 136.438339][ T6256] RDX: 000000000000000c RSI: 0000200000000600 RDI: 0000000000000006 [ 136.446332][ T6256] RBP: 00007fdc1e433eaf R08: 0000000000000000 R09: 0000000000000000 [ 136.454387][ T6256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.462412][ T6256] R13: 00007fdc1e626038 R14: 00007fdc1e625fa0 R15: 00007ffce4009d68 [ 136.470479][ T6256] [ 136.473508][ T6256] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 136.480822][ T6256] CPU: 0 UID: 0 PID: 6256 Comm: syz.0.83 Tainted: G B syzkaller #0 PREEMPT(full) [ 136.491521][ T6256] Tainted: [B]=BAD_PAGE [ 136.495680][ T6256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 136.505728][ T6256] Call Trace: [ 136.509028][ T6256] [ 136.511952][ T6256] dump_stack_lvl+0x100/0x190 [ 136.516641][ T6256] vpanic+0x552/0x970 [ 136.520722][ T6256] ? __pfx_vpanic+0x10/0x10 [ 136.525259][ T6256] ? lock_release+0x24d/0x310 [ 136.529993][ T6256] panic+0xd1/0xe0 [ 136.533771][ T6256] ? __pfx_panic+0x10/0x10 [ 136.538295][ T6256] check_panic_on_warn.cold+0x19/0x34 [ 136.543694][ T6256] ? dummy_free_request+0x7d/0x90 [ 136.548844][ T6256] __warn.cold+0x191/0x318 [ 136.553275][ T6256] __report_bug+0x30f/0x440 [ 136.557805][ T6256] ? dummy_free_request+0x7d/0x90 [ 136.562863][ T6256] ? __pfx___report_bug+0x10/0x10 [ 136.567906][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.573557][ T6256] ? _printk+0xcf/0x110 [ 136.577724][ T6256] ? __pfx__printk+0x10/0x10 [ 136.582347][ T6256] ? dummy_free_request+0x8a/0x90 [ 136.587409][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.593059][ T6256] ? preempt_schedule_common+0x42/0xc0 [ 136.598574][ T6256] ? dummy_free_request+0x7d/0x90 [ 136.603632][ T6256] report_bug+0xb2/0x220 [ 136.607907][ T6256] ? dummy_free_request+0x7d/0x90 [ 136.612969][ T6256] handle_bug+0x16a/0x2a0 [ 136.617414][ T6256] exc_invalid_op+0x17/0x50 [ 136.622030][ T6256] asm_exc_invalid_op+0x1a/0x20 [ 136.626892][ T6256] RIP: 0010:dummy_free_request+0x7d/0x90 [ 136.632563][ T6256] Code: 42 9e fa e8 05 d0 3a fa 5b 5d e9 89 d5 40 f9 e8 f9 cf 3a fa 90 0f 0b 90 e8 f0 cf 3a fa 5b 5d e9 74 d5 40 f9 e8 e4 cf 3a fa 90 <0f> 0b 90 eb c7 48 89 ef e8 56 5e aa fa eb b4 0f 1f 40 00 90 90 90 [ 136.652219][ T6256] RSP: 0018:ffffc9000351f890 EFLAGS: 00010246 [ 136.658398][ T6256] RAX: 0000000000080000 RBX: ffff888076274a00 RCX: ffffc90003e61000 [ 136.666474][ T6256] RDX: 0000000000080000 RSI: ffffffff87cf6b9c RDI: ffff88802de33e00 [ 136.674472][ T6256] RBP: ffff8880762749f0 R08: 0000000000000007 R09: 0000000000000000 [ 136.682454][ T6256] R10: 0000000000000000 R11: 6e696c6261736944 R12: ffff888026754c00 [ 136.690432][ T6256] R13: 00000000ffffffea R14: 0000000000000400 R15: ffff888035b26528 [ 136.698505][ T6256] ? dummy_free_request+0x7c/0x90 [ 136.703573][ T6256] uvc_function_bind+0x181a/0x1939 [ 136.708709][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.714369][ T6256] ? __pfx_uvc_function_bind+0x10/0x10 [ 136.719843][ T6256] usb_add_function+0x219/0x890 [ 136.724835][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.730498][ T6256] configfs_composite_bind+0xd83/0x1960 [ 136.736166][ T6256] ? kernfs_create_link+0x1bd/0x240 [ 136.741502][ T6256] gadget_bind_driver+0x28c/0xbf0 [ 136.746556][ T6256] ? __pfx_dummy_udc_set_speed+0x10/0x10 [ 136.752228][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.757887][ T6256] ? __pfx_gadget_bind_driver+0x10/0x10 [ 136.763479][ T6256] really_probe+0x241/0xa60 [ 136.768013][ T6256] __driver_probe_device+0x20e/0x450 [ 136.773330][ T6256] driver_probe_device+0x4a/0x140 [ 136.778384][ T6256] __driver_attach+0x21f/0x5b0 [ 136.783174][ T6256] ? __pfx___driver_attach+0x10/0x10 [ 136.788485][ T6256] bus_for_each_dev+0x13e/0x1d0 [ 136.793356][ T6256] ? __pfx_bus_for_each_dev+0x10/0x10 [ 136.798737][ T6256] ? bus_add_driver+0x2b5/0x5b0 [ 136.803605][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.809418][ T6256] bus_add_driver+0x305/0x5b0 [ 136.814118][ T6256] driver_register+0x1e2/0x360 [ 136.818912][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.824570][ T6256] usb_gadget_register_driver_owner+0x132/0x210 [ 136.830830][ T6256] gadget_dev_desc_UDC_store+0x1b0/0x2e0 [ 136.836496][ T6256] configfs_write_iter+0x302/0x4e0 [ 136.841650][ T6256] vfs_write+0x6ac/0x1050 [ 136.846124][ T6256] ? __pfx_configfs_write_iter+0x10/0x10 [ 136.851878][ T6256] ? __pfx_vfs_write+0x10/0x10 [ 136.856679][ T6256] ksys_write+0x12a/0x250 [ 136.861036][ T6256] ? __pfx_ksys_write+0x10/0x10 [ 136.865917][ T6256] ? srso_alias_return_thunk+0x5/0xfbef5 [ 136.871573][ T6256] do_syscall_64+0x115/0x870 [ 136.876190][ T6256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.882100][ T6256] RIP: 0033:0x7fdc1e39de99 [ 136.886523][ T6256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.906198][ T6256] RSP: 002b:00007fdc1f1b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.914642][ T6256] RAX: ffffffffffffffda RBX: 00007fdc1e625fa0 RCX: 00007fdc1e39de99 [ 136.922631][ T6256] RDX: 000000000000000c RSI: 0000200000000600 RDI: 0000000000000006 [ 136.930615][ T6256] RBP: 00007fdc1e433eaf R08: 0000000000000000 R09: 0000000000000000 [ 136.938607][ T6256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.946584][ T6256] R13: 00007fdc1e626038 R14: 00007fdc1e625fa0 R15: 00007ffce4009d68 [ 136.954582][ T6256] [ 136.957891][ T6256] Kernel Offset: disabled [ 136.962212][ T6256] Rebooting in 86400 seconds..