last executing test programs: 8.474569736s ago: executing program 2 (id=3): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) write$sndseq(r1, &(0x7f0000000700)=[{0x2, 0x7, 0x81, 0x3, @tick=0x1000, {0xf7, 0x2}, {0x8, 0x2b}, @quote={{0x2, 0x1}, 0x8}}], 0x1c) r2 = dup(r0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x48, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x6, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) shutdown(r1, 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xeffffff2, @empty, 0x5}}, 0x10001fc, 0x6, 0xffff1896, 0x3, 0x26, 0xffffffb9, 0x1a}, 0x9c) 7.8950014s ago: executing program 2 (id=7): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x14, 0x14, 0x301, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 7.462034068s ago: executing program 2 (id=9): syz_usb_connect(0x3, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40cd060f010001010203010902740001010080fa090400000effffff00070581024000000705820240000007058302400000070584024000000705850240000007058602400000070587024000000705010240000007050202"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/ttyUSB0\x00', 0x2, 0x0) write(r0, &(0x7f00000014c0)="5c64e9d542f372633819fe534e7430bbf282dfd6b128acf2d6099cdb18c913d22f7d565ac2e8898818824d19a00c439ef3c3acdb1463032339d933d0bd25e7c1793ba6dfa19b2a4a4d9b3837b6cc65e679c5c6bb09", 0x55) 5.559444726s ago: executing program 3 (id=11): syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000240)=@mgmt_frame=@beacon={{{}, {}, @broadcast, @broadcast, @from_mac=@device_b}, 0x0, @random=0x9, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @void, @void, @void, @void, @void, @val={0x25, 0x3, {0x1, 0x6c}}, @void, @val={0x3c, 0x4, {0x1, 0x3, 0x1, 0xf3}}, @val={0x2d, 0x1a, {0xc, 0x0, 0x3, 0x0, {0xe920, 0x4, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x0, 0x7ff, 0x8}}, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0x4}}, @void}, 0x5c) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0xfffffffe, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x4004800) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x3e7, &(0x7f0000000200)={&(0x7f0000000a00)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) 5.48303658s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/ocfs2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='127.0.0.1', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='77', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='1\n', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/cluster/ocfs2/node/node0/local\x00', 0x20141, 0x0) write(r4, &(0x7f0000000540)='1\n', 0x2) 5.241073288s ago: executing program 4 (id=5): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x166}]}}}]}]}], {0x14}}, 0xd4}}, 0x0) listen(r0, 0xfff) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2, 0x3, @loopback, 0x8}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r2, &(0x7f00000000c0)="b2", 0x1, 0x24008844, &(0x7f0000000040)={0xa, 0x2, 0x80398, @empty, 0xfffffffe}, 0x1c) 4.79680387s ago: executing program 1 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac1.usb0/c_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uac1.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/uac1.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='dummy_udc.0\n', 0xc) 4.735631669s ago: executing program 2 (id=13): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff0000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/156, 0x1000000, 0x1000}, 0x20) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000180)={0x0, 0x10c000, 0x0, 0x20000000}, 0x20) syz_clone(0xc200000, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) 4.388416923s ago: executing program 4 (id=14): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x402) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x207, 0x7, 0xfffffffe}) 4.227886602s ago: executing program 3 (id=15): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) syz_usb_disconnect(0x3) 3.918197236s ago: executing program 4 (id=16): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d89600001010203010902200001010080320904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x10000001d, 0x8041) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000740)={0x20, 0xe}, 0x0, 0x0}) 3.784149272s ago: executing program 0 (id=1): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 3.520797934s ago: executing program 1 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010028bd7000ffdbcd246c00040008000300", @ANYRES32=r1, @ANYBLOB='\b\x00&\x00q\t'], 0x24}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0) syz_80211_inject_frame(&(0x7f0000000040)=@device_b, &(0x7f0000000000)=@data_frame={@a_msdu=@type01={{0x0, 0x2, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x6}, @device_b, @from_mac=@device_b, @initial, {0x2, 0x7}, "", @void, @value=@ver_80211n={0x0, 0x3, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1}}, @a_msdu}, 0x1c) 1.987574045s ago: executing program 0 (id=18): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="60000000020601080000000000000000000000010500010006000000050005000200000005000400000000000900020073797a3100000000140007800800064000000003080013400000040511000300686173683a69702c6d61726b"], 0x60}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x8c, 0x44, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x71, 0x1, 0x0, 0x1, [@generic="c78c42412853ec1e921ede6c39658fb028fcee3547aa485e20bea0210f8ffbe4dcf77806dbf6e042b498445afeb5e4a91de8bc7b72377be5fb59ff6b03b640d7bd736308b725e7fa1e2fc71ca09de48d27f4529f315fa1aeab3018edc394863c02db7fc8d899cc5ec2cfc8a94d"]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x200408d1}, 0x4008094) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 1.649170691s ago: executing program 1 (id=19): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000540)={'syz1\x00', {0x6, 0x7fff, 0xb25, 0xb}, 0x6, [0x9, 0x8, 0x5, 0x6, 0x6, 0x3, 0xafc, 0x32, 0x838, 0x9, 0x6ff5, 0x9f5, 0x5, 0x1000000, 0x0, 0x6, 0x8001, 0x6, 0x4a4c, 0x3, 0xfffffffd, 0x9, 0x10, 0x8001, 0x5, 0x2, 0xd4a, 0xffefe87a, 0x1, 0x8, 0x0, 0x9, 0x8, 0x9, 0x0, 0xe, 0xf9c6, 0x3ff, 0x3ff, 0x4, 0xd, 0xff, 0x8, 0x9, 0x80000001, 0x83f5, 0x0, 0x2, 0xfe0, 0x7ff, 0x8, 0x3, 0x4, 0x2, 0xa45, 0x1df, 0xffff, 0x0, 0x2, 0x9, 0xf, 0x901, 0x200, 0x9a0], [0x3, 0x8, 0x6, 0xd, 0x1, 0xad10, 0x6, 0x13a0, 0x86, 0x7fff, 0x101, 0x8, 0x5, 0x1, 0x2, 0xffff, 0x4, 0x4a, 0xf, 0xfffff32a, 0xfffffff7, 0x4c4, 0x400, 0x7f, 0x10000, 0x7, 0x4, 0x8, 0x30, 0x9, 0x1, 0x3, 0x4c6fbc51, 0x10001, 0xd35, 0xa, 0x63, 0x0, 0x1, 0x200, 0x20, 0x9, 0x0, 0x3ec8d8d2, 0x0, 0x3, 0x3, 0x2, 0x8, 0x6, 0xe51, 0x1, 0x7, 0x8, 0x3, 0x2, 0x0, 0x62, 0x7, 0x6, 0x4, 0x6, 0xfff, 0x4], [0x1, 0x9, 0x6, 0x10000, 0x6, 0x8, 0xffffffff, 0xfd, 0x20, 0x8, 0x9, 0x74, 0x283, 0x2, 0x4d, 0x6, 0x4, 0x3ff, 0x10000, 0x5, 0x40, 0x4, 0x8, 0x0, 0x4, 0x2, 0x80008001, 0x9, 0x1, 0xffff, 0x5, 0x7, 0x1, 0x9, 0x4, 0xfff, 0x3, 0x0, 0x5, 0x80000001, 0x53c2, 0x4, 0x4, 0x3, 0x80, 0x50, 0x3, 0xc, 0x8, 0x5, 0x4, 0x400, 0x3, 0x5, 0x86, 0x6, 0x400000, 0xb, 0x4, 0x0, 0x420, 0xfe6c, 0x2, 0x9], [0x3, 0x9, 0xffffffff, 0x2, 0x66, 0xffff, 0x401, 0x6, 0x8, 0x3, 0x101, 0x4, 0x9, 0x7, 0xce, 0x2, 0x8001, 0x1, 0x7, 0x6, 0x601000, 0x9, 0x5, 0xd, 0x1, 0x446, 0x800, 0x3, 0x0, 0x3, 0x2, 0x375, 0xfffffff1, 0x5, 0x5, 0x4, 0x7fff, 0x4, 0x3a2, 0x3, 0x2005, 0xe, 0xee6, 0x800, 0x7, 0x3, 0x1, 0x7, 0x3, 0x9, 0xc, 0x3, 0x1, 0x1, 0x3, 0x296, 0x6, 0xb, 0xf, 0x4, 0x6, 0x7, 0xd, 0x400]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6, 0x101}, 0xfffffffd, [0x8, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x3, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x3, 0x0, 0x8, 0x0, 0x0, 0xfffffff9, 0x0, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x3], [0xfffffffd, 0x3, 0x6, 0x6, 0x0, 0x2, 0x3, 0xff, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e2b, 0x0, 0xfffffffa, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x4, 0xfd5], [0x0, 0xfffffffc, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x4, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x3, 0x8000000, 0x4, 0x0, 0x0, 0x99, 0xfffffffd, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x836, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4bdf, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0xfffffffe, 0x0, 0x5, 0x8, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) 1.374834301s ago: executing program 3 (id=20): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'geneve1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000300"/20, @ANYRES32=r2, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c0002800500040001"], 0x3c}, 0x1, 0x2}, 0x0) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000002780)={0x11, 0xf6, r2, 0x1, 0x0, 0x6, @remote}, 0x14) 1.076608569s ago: executing program 0 (id=21): syz_open_dev$vim2m(0x0, 0xb, 0x2) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) 876.227951ms ago: executing program 3 (id=22): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xf, r0, 0x8000000007, 0xffffffffffffffff) 562.354616ms ago: executing program 2 (id=23): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) write(r0, &(0x7f0000000040)="616e306d058d8ef0ea4e8c880aeaacc859553d3372cce5142d560fdad57b7811d200157f21cc0200285a159d9a2c227ab14697b2828cfef2646cbe9ca0be240196db44", 0x43) write(r1, 0x0, 0x0) 522.835126ms ago: executing program 3 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='sl811-hcd\x00', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/drivers/sl811-hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='pcspkr\x00', 0x7) close(r1) 357.124708ms ago: executing program 2 (id=25): r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x73, 0x141641) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000dc0)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)={0x20, 0x0, 0x4}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) 226.633905ms ago: executing program 3 (id=26): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0xb, 0x2) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f0000000500)={0x23, 0x1, 0x15, 0x1, 0x0, 0x3e8, 0x0}) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r0, 0x5521) r1 = syz_open_dev$usbfs(&(0x7f0000000200), 0xc, 0x2) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000600)={0x23, 0x1, 0x15, 0x1, 0x0, 0x3e8, 0x0}) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r1, 0x5521) r2 = syz_open_dev$usbfs(&(0x7f0000000300), 0xd, 0x2) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, &(0x7f0000000700)={0x23, 0x1, 0x15, 0x1, 0x0, 0x3e8, 0x0}) ioctl$USBDEVFS_ALLOW_SUSPEND(r2, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r2, 0x5521) r3 = syz_open_dev$usbfs(&(0x7f0000000400), 0xe, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000000800)={0x23, 0x1, 0x15, 0x1, 0x0, 0x3e8, 0x0}) ioctl$USBDEVFS_ALLOW_SUSPEND(r3, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r3, 0x5521) 112.535011ms ago: executing program 1 (id=27): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='0x1234\n\x00', 0x7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='0x5678\n\x00', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)='usbip-vudc.0\n\x00', 0xd) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/platform/usbip-vudc.0/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000000640)='3\n\x00', 0x2) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) write(r1, &(0x7f0000000700)="000000010000000100"/48, 0x30) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/platform/usbip-vudc.0/usbip_sockfd\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='-1\n\x00', 0x3) close(r0) close(r1) nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0) 0s ago: executing program 4 (id=28): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc1105518, &(0x7f0000000c40)={{0x1, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x80, 0x0, 0xfffffffffffffffc, 0x7, 0x80000, 0xf, 0x80000000000000, 0x0, 0x9, 0x0, 0xfffffffffffffffd, 0x4, 0x7, 0x0, 0x7, 0x7ff, 0xfffffffe, 0x0, 0x40, 0x0, 0x0, 0x100000002, 0x8, 0xfffffffffffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffd, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0x4, 0x0, 0x0, 0x40, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x5, 0x401, 0x0, 0x8000000000000000, 0x0, 0x0, 0x2000, 0x400000000000, 0x3, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x7, 0x2, 0x0, 0x8, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffc, 0x0, 0x0, 0x3, 0x0, 0xfffffffffffffffc, 0x80000000000000, 0xfffffffc, 0x1, 0x8, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0x1, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0xfffffffffffffffd, 0xde4, 0x2000000007, 0x0, 0x100000000]}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.123' (ED25519) to the list of known hosts. [ 77.511354][ T5586] cgroup: Unknown subsys name 'net' [ 77.753456][ T5586] cgroup: Unknown subsys name 'cpuset' [ 77.807356][ T5586] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.617181][ T5586] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.025873][ T5609] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.071024][ T5617] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.094460][ T5611] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.100017][ T5617] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.126454][ T5617] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.126501][ T5611] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.131426][ T5617] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.132433][ T5617] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.139592][ T5617] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.140918][ T5617] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.142896][ T5617] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.154146][ T5606] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.158083][ T5611] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.159288][ T5619] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.161093][ T5619] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.169452][ T5619] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.186700][ T5619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.192098][ T5619] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.206548][ T5619] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.228313][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.270550][ T5618] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.294655][ T5611] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.313576][ T5611] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.338962][ T5619] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.367569][ T5619] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 84.288344][ T4915] Bluetooth: hci0: command tx timeout [ 84.366759][ T5609] Bluetooth: hci1: command tx timeout [ 84.366947][ T4915] Bluetooth: hci3: command tx timeout [ 84.446821][ T5609] Bluetooth: hci2: command tx timeout [ 84.446983][ T4915] Bluetooth: hci4: command tx timeout [ 84.522828][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.523528][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.523650][ T5599] bridge_slave_0: entered allmulticast mode [ 84.525734][ T5599] bridge_slave_0: entered promiscuous mode [ 84.590871][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.590967][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.591076][ T5599] bridge_slave_1: entered allmulticast mode [ 84.592927][ T5599] bridge_slave_1: entered promiscuous mode [ 84.706206][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.706333][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.707266][ T5603] bridge_slave_0: entered allmulticast mode [ 84.712966][ T5603] bridge_slave_0: entered promiscuous mode [ 84.745657][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.745763][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.745913][ T5602] bridge_slave_0: entered allmulticast mode [ 84.757794][ T5602] bridge_slave_0: entered promiscuous mode [ 84.799830][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.799922][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.800021][ T5603] bridge_slave_1: entered allmulticast mode [ 84.802326][ T5603] bridge_slave_1: entered promiscuous mode [ 84.809167][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.809466][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.809616][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.810025][ T5602] bridge_slave_1: entered allmulticast mode [ 84.815878][ T5602] bridge_slave_1: entered promiscuous mode [ 84.826551][ T5600] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.827563][ T5600] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.830489][ T5600] bridge_slave_0: entered allmulticast mode [ 84.836264][ T5600] bridge_slave_0: entered promiscuous mode [ 84.871967][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.872210][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.872643][ T5601] bridge_slave_0: entered allmulticast mode [ 84.880745][ T5601] bridge_slave_0: entered promiscuous mode [ 84.968338][ T5600] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.968472][ T5600] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.968602][ T5600] bridge_slave_1: entered allmulticast mode [ 84.970318][ T5600] bridge_slave_1: entered promiscuous mode [ 84.973886][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.974288][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.974372][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.974509][ T5601] bridge_slave_1: entered allmulticast mode [ 84.976388][ T5601] bridge_slave_1: entered promiscuous mode [ 85.092018][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.094844][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.151632][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.153688][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.156222][ T5600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.165768][ T5599] team0: Port device team_slave_0 added [ 85.191155][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.228014][ T5600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.229919][ T5599] team0: Port device team_slave_1 added [ 85.232076][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.313186][ T5603] team0: Port device team_slave_0 added [ 85.315992][ T5602] team0: Port device team_slave_0 added [ 85.375466][ T5603] team0: Port device team_slave_1 added [ 85.380584][ T5602] team0: Port device team_slave_1 added [ 85.390821][ T5600] team0: Port device team_slave_0 added [ 85.392093][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.392103][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.392120][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.395887][ T5601] team0: Port device team_slave_0 added [ 85.467765][ T5600] team0: Port device team_slave_1 added [ 85.468480][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.468489][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.468506][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.470767][ T5601] team0: Port device team_slave_1 added [ 85.574865][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.574877][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.574892][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.582043][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.582078][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.582133][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.678337][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.678354][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.678380][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.679510][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.679520][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.679538][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.681000][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.681008][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.681024][ T5600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.683343][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.683353][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.683370][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.764508][ T5600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.764549][ T5600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.764611][ T5600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.823468][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.823517][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.823586][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.971222][ T5599] hsr_slave_0: entered promiscuous mode [ 85.972228][ T5599] hsr_slave_1: entered promiscuous mode [ 86.367057][ T4915] Bluetooth: hci0: command tx timeout [ 86.401620][ T5602] hsr_slave_0: entered promiscuous mode [ 86.402715][ T5602] hsr_slave_1: entered promiscuous mode [ 86.403430][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 86.403515][ T5602] Cannot create hsr debugfs directory [ 86.448092][ T5609] Bluetooth: hci1: command tx timeout [ 86.448163][ T4915] Bluetooth: hci3: command tx timeout [ 86.455706][ T5603] hsr_slave_0: entered promiscuous mode [ 86.475295][ T5603] hsr_slave_1: entered promiscuous mode [ 86.488085][ T5603] debugfs: 'hsr0' already exists in 'hsr' [ 86.488108][ T5603] Cannot create hsr debugfs directory [ 86.526763][ T5609] Bluetooth: hci2: command tx timeout [ 86.526842][ T4915] Bluetooth: hci4: command tx timeout [ 86.537937][ T10] cfg80211: failed to load regulatory.db [ 86.618097][ T5600] hsr_slave_0: entered promiscuous mode [ 86.619204][ T5600] hsr_slave_1: entered promiscuous mode [ 86.620097][ T5600] debugfs: 'hsr0' already exists in 'hsr' [ 86.620123][ T5600] Cannot create hsr debugfs directory [ 86.677285][ T5601] hsr_slave_0: entered promiscuous mode [ 86.678494][ T5601] hsr_slave_1: entered promiscuous mode [ 86.679271][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 86.679292][ T5601] Cannot create hsr debugfs directory [ 87.574217][ T5599] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 87.630257][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.649687][ T5599] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.692073][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.693888][ T5599] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.730701][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.754358][ T5599] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.791929][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.912164][ T5602] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.950227][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.965008][ T5602] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.993200][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.996212][ T5602] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.041343][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.070596][ T5602] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.099584][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.231989][ T5603] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 88.260371][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.264863][ T5603] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 88.293512][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.304627][ T5603] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 88.330829][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.373541][ T5603] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 88.411380][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.447212][ T4915] Bluetooth: hci0: command tx timeout [ 88.526828][ T5609] Bluetooth: hci1: command tx timeout [ 88.526901][ T4915] Bluetooth: hci3: command tx timeout [ 88.577991][ T5600] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.607129][ T5609] Bluetooth: hci2: command tx timeout [ 88.607213][ T4915] Bluetooth: hci4: command tx timeout [ 88.612534][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.639933][ T5600] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.660208][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.674933][ T5600] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.705077][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.743643][ T5600] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.780559][ T5600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.811041][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.931319][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.933911][ T5601] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.981252][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.998835][ T5601] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.040141][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.043992][ T5601] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.079677][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.088411][ T5601] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.122377][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.151493][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.151656][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.212270][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.226083][ T3343] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.237616][ T3343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.316310][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.366450][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.376978][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.377093][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.440127][ T3372] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.440220][ T3372] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.533695][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.592002][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.592183][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.625365][ T5600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.652728][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.652898][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.758924][ T5600] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.858734][ T1193] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.858827][ T1193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.877737][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.921057][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.921171][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.025732][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.111672][ T1029] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.111793][ T1029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.205687][ T3343] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.205811][ T3343] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.455295][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.527365][ T4915] Bluetooth: hci0: command tx timeout [ 90.606859][ T5609] Bluetooth: hci1: command tx timeout [ 90.606902][ T4915] Bluetooth: hci3: command tx timeout [ 90.687240][ T5609] Bluetooth: hci2: command tx timeout [ 90.687284][ T4915] Bluetooth: hci4: command tx timeout [ 90.944525][ T5599] veth0_vlan: entered promiscuous mode [ 90.975492][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.016020][ T5599] veth1_vlan: entered promiscuous mode [ 91.206389][ T5599] veth0_macvtap: entered promiscuous mode [ 91.241151][ T5599] veth1_macvtap: entered promiscuous mode [ 91.279331][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.334005][ T5602] veth0_vlan: entered promiscuous mode [ 91.379970][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.405046][ T5602] veth1_vlan: entered promiscuous mode [ 91.432916][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.516441][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.540274][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.543440][ T5600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.567872][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.572117][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.874860][ T5602] veth0_macvtap: entered promiscuous mode [ 91.945160][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.959807][ T5602] veth1_macvtap: entered promiscuous mode [ 92.075395][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.130268][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.136030][ T5600] veth0_vlan: entered promiscuous mode [ 92.165429][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.179213][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.238790][ T5603] veth0_vlan: entered promiscuous mode [ 92.239783][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.280621][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.303238][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.320303][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.320736][ T5600] veth1_vlan: entered promiscuous mode [ 92.343626][ T3372] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.343651][ T3372] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.427361][ T5603] veth1_vlan: entered promiscuous mode [ 92.435676][ T5601] veth0_vlan: entered promiscuous mode [ 92.589368][ T5601] veth1_vlan: entered promiscuous mode [ 92.736388][ T5600] veth0_macvtap: entered promiscuous mode [ 92.765944][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.765963][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.800978][ T5603] veth0_macvtap: entered promiscuous mode [ 92.830807][ T5600] veth1_macvtap: entered promiscuous mode [ 92.867520][ T5603] veth1_macvtap: entered promiscuous mode [ 92.982017][ T5601] veth0_macvtap: entered promiscuous mode [ 93.032017][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.032035][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.060935][ T5601] veth1_macvtap: entered promiscuous mode [ 93.093181][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.124473][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.150907][ T5600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.174082][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.231040][ T5795] netlink: 'syz.3.4': attribute type 10 has an invalid length. [ 93.234063][ T3372] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.265010][ T5795] bond0: (slave syzkaller0): Enslaving as an active interface with an up link [ 93.287473][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.295359][ T3372] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.335425][ T3372] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.385370][ T3372] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.405364][ T3372] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.418762][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.422829][ T3372] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.528839][ T3372] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.559485][ T3372] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.787006][ T3343] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.872993][ T3343] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.906826][ T3343] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.928329][ T3343] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.038065][ T5797] syz.2.3 (5797) used greatest stack depth: 18536 bytes left [ 94.308922][ T37] audit: type=1800 audit(1785158524.426:2): pid=5800 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.6" name="control" dev="configfs" ino=7561 res=0 errno=0 [ 94.898715][ T5809] file system registered [ 95.205245][ T1029] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.205266][ T1029] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.290250][ T36] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 95.314747][ T5815] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 95.395426][ T4966] FAULT_INJECTION: forcing a failure. [ 95.395426][ T4966] name failslab, interval 1, probability 100, space 0, times 1 [ 95.395474][ T4966] CPU: 1 UID: 0 PID: 4966 Comm: udevd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 95.395497][ T4966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 95.395515][ T4966] Call Trace: [ 95.395522][ T4966] [ 95.395530][ T4966] dump_stack_lvl+0xe8/0x150 [ 95.395569][ T4966] should_fail_ex+0x467/0x600 [ 95.395604][ T4966] should_failslab+0xa8/0x100 [ 95.395628][ T4966] kmem_cache_alloc_noprof+0xa4/0x650 [ 95.395648][ T4966] ? alloc_empty_file+0x5b/0x1d0 [ 95.395666][ T4966] ? alloc_empty_file+0x5b/0x1d0 [ 95.395689][ T4966] alloc_empty_file+0x5b/0x1d0 [ 95.395709][ T4966] path_openat+0x8f/0x3850 [ 95.395739][ T4966] ? kasan_save_track+0x3e/0x80 [ 95.395757][ T4966] ? __kasan_slab_alloc+0x6c/0x80 [ 95.395776][ T4966] ? kmem_cache_alloc_noprof+0x355/0x650 [ 95.395793][ T4966] ? do_getname+0x2e/0x250 [ 95.395807][ T4966] ? do_sys_openat2+0xcc/0x200 [ 95.395824][ T4966] ? __x64_sys_openat+0x138/0x170 [ 95.395842][ T4966] ? do_syscall_64+0x174/0x580 [ 95.395866][ T4966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.395904][ T4966] do_file_open+0x23e/0x4a0 [ 95.395926][ T4966] ? lockdep_hardirqs_on+0x7a/0x110 [ 95.395952][ T4966] ? __pfx_do_file_open+0x10/0x10 [ 95.395997][ T4966] ? alloc_fd+0x654/0x6d0 [ 95.396025][ T4966] do_sys_openat2+0x115/0x200 [ 95.396047][ T4966] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.396065][ T4966] ? __x64_sys_epoll_wait+0x1d7/0x230 [ 95.396101][ T4966] __x64_sys_openat+0x138/0x170 [ 95.396123][ T4966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.396139][ T4966] do_syscall_64+0x174/0x580 [ 95.396158][ T4966] ? trace_irq_disable+0x3b/0x140 [ 95.396174][ T4966] ? clear_bhb_loop+0x40/0x90 [ 95.396194][ T4966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.396210][ T4966] RIP: 0033:0x7f544b66f407 [ 95.396232][ T4966] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 95.396246][ T4966] RSP: 002b:00007ffce2beac20 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 95.396264][ T4966] RAX: ffffffffffffffda RBX: 00007f544b581880 RCX: 00007f544b66f407 [ 95.396276][ T4966] RDX: 0000000000080000 RSI: 00007ffce2beada0 RDI: ffffffffffffff9c [ 95.396287][ T4966] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 95.396297][ T4966] R10: 0000000000000000 R11: 0000000000000202 R12: 000055ecfa8fb7f5 [ 95.396307][ T4966] R13: 000055ecfa8fb7f5 R14: 0000000000000001 R15: 0000000000000000 [ 95.396338][ T4966] [ 95.596230][ T1029] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.596281][ T1029] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.785912][ T36] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.793729][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 95.793789][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 95.793881][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 95.793934][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 95.793989][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 95.794043][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 95.794097][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 95.794150][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 95.794202][ T36] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 95.794231][ T36] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 95.794250][ T36] usb 3-1: config 1 interface 0 altsetting 0 has 9 endpoint descriptors, different from the interface descriptor's value: 14 [ 95.916839][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.916859][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.978994][ T36] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 95.979021][ T36] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 95.979039][ T36] usb 3-1: Product: syz [ 95.979052][ T36] usb 3-1: Manufacturer: syz [ 95.979065][ T36] usb 3-1: SerialNumber: syz [ 96.220978][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221156][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221294][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221371][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221479][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221595][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221670][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.221777][ T5808] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 96.252213][ T36] keyspan 3-1:1.0: Keyspan 2 port adapter converter detected [ 96.271403][ T36] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 7 [ 96.294922][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.294976][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.423749][ T36] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 5 [ 96.537043][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.537059][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.744888][ T36] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 96.848156][ T36] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 3 [ 96.848246][ T36] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 4 [ 96.848349][ T36] keyspan 3-1:1.0: found no endpoint descriptor for endpoint 6 [ 96.929971][ T36] usb 3-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 96.960154][ T5818] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 96.964316][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.964333][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.260597][ T36] usb 3-1: USB disconnect, device number 2 [ 97.623036][ T36] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 97.762401][ T36] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 97.828136][ T36] keyspan 3-1:1.0: device disconnected [ 97.989144][ T5832] udc dummy_udc.0: failed to start g1: -19 [ 98.152736][ T5832] UDC core: g1: couldn't find an available UDC or it's busy [ 98.447428][ T198] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 98.481682][ T5612] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 98.680135][ T5612] usb 4-1: Using ep0 maxpacket: 8 [ 98.685698][ T5612] usb 4-1: config 0 has an invalid interface number: 143 but max is 0 [ 98.685723][ T5612] usb 4-1: config 0 has no interface number 0 [ 98.685763][ T5612] usb 4-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 98.685784][ T5612] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.701452][ T198] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.803353][ T198] usb 5-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice= 1.00 [ 98.803386][ T198] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.803407][ T198] usb 5-1: Product: syz [ 98.803423][ T198] usb 5-1: Manufacturer: syz [ 98.803439][ T198] usb 5-1: SerialNumber: syz [ 99.183208][ T5612] usb 4-1: config 0 descriptor?? [ 99.433877][ T5612] viperboard 4-1:0.143: version 0.00 found at bus 004 address 002 [ 99.485946][ T198] hackrf 5-1:1.0: usb_control_msg() failed -32 request 0e [ 99.485972][ T198] hackrf 5-1:1.0: Could not detect board [ 99.486028][ T198] hackrf 5-1:1.0: probe with driver hackrf failed with error -32 [ 99.486335][ T5850] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 99.820793][ T5612] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 99.820839][ T5612] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 100.137709][ T5612] usb 4-1: USB disconnect, device number 2 [ 100.159156][ T5858] netlink: zone id is out of range [ 100.159171][ T5858] netlink: zone id is out of range [ 100.159179][ T5858] netlink: zone id is out of range [ 100.159186][ T5858] netlink: zone id is out of range [ 100.159192][ T5858] netlink: zone id is out of range [ 100.159199][ T5858] netlink: zone id is out of range [ 100.159205][ T5858] netlink: zone id is out of range [ 100.159212][ T5858] netlink: zone id is out of range [ 100.159218][ T5858] netlink: zone id is out of range [ 100.159232][ T5858] netlink: set zone limit has 4 unknown bytes [ 100.264812][ T5842] hackrf 5-1:1.0: Board ID: 00 [ 100.264833][ T5842] hackrf 5-1:1.0: Firmware version: [ 100.655450][ T5842] hackrf 5-1:1.0: Registered as swradio24 [ 100.655477][ T5842] videodev: could not get a free minor [ 100.655488][ T5842] hackrf 5-1:1.0: Failed to register as video device (-23) [ 100.811385][ T5860] input: syz1 as /devices/virtual/input/input5 [ 101.075524][ T5842] hackrf 5-1:1.0: probe with driver hackrf failed with error -23 [ 101.235212][ T198] usb 5-1: USB disconnect, device number 2 [ 102.069435][ T198] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 102.095834][ T5887] ================================================================== [ 102.095850][ T5887] BUG: KASAN: global-out-of-bounds in usb_copy_descriptors+0x1b8/0x320 [ 102.095878][ T5887] Read of size 64 at addr ffffffff99e84780 by task syz.1.27/5887 [ 102.095894][ T5887] [ 102.095904][ T5887] CPU: 1 UID: 0 PID: 5887 Comm: syz.1.27 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.095924][ T5887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 102.095934][ T5887] Call Trace: [ 102.095941][ T5887] [ 102.095949][ T5887] dump_stack_lvl+0xe8/0x150 [ 102.095980][ T5887] print_address_description+0x55/0x1e0 [ 102.096010][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.096028][ T5887] print_report+0x58/0x70 [ 102.096053][ T5887] kasan_report+0x117/0x150 [ 102.096077][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.096100][ T5887] kasan_check_range+0x264/0x2c0 [ 102.096122][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.096141][ T5887] __asan_memcpy+0x29/0x70 [ 102.096171][ T5887] usb_copy_descriptors+0x1b8/0x320 [ 102.096193][ T5887] usb_assign_descriptors+0xcf/0x290 [ 102.096214][ T5887] f_audio_bind+0x1b5e/0x34b0 [ 102.096245][ T5887] usb_add_function+0x290/0x930 [ 102.096265][ T5887] ? check_remote_wakeup_config+0x58/0x1c0 [ 102.096286][ T5887] configfs_composite_bind+0xde0/0x1410 [ 102.096313][ T5887] ? __pfx_configfs_composite_bind+0x10/0x10 [ 102.096334][ T5887] gadget_bind_driver+0x2ca/0x9e0 [ 102.096365][ T5887] ? __pfx_gadget_bind_driver+0x10/0x10 [ 102.096392][ T5887] really_probe+0x254/0xae0 [ 102.096423][ T5887] __driver_probe_device+0x1e8/0x360 [ 102.096457][ T5887] driver_probe_device+0x4f/0x240 [ 102.096485][ T5887] __driver_attach+0x339/0x600 [ 102.096509][ T5887] bus_for_each_dev+0x23e/0x2c0 [ 102.096526][ T5887] ? __pfx___driver_attach+0x10/0x10 [ 102.096550][ T5887] ? __pfx_bus_for_each_dev+0x10/0x10 [ 102.096570][ T5887] ? rt_spin_unlock+0x163/0x200 [ 102.096602][ T5887] bus_add_driver+0x348/0x670 [ 102.096625][ T5887] driver_register+0x23a/0x320 [ 102.096655][ T5887] usb_gadget_register_driver_owner+0xf9/0x270 [ 102.096684][ T5887] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 102.096713][ T5887] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 102.096753][ T5887] configfs_write_iter+0x33a/0x430 [ 102.096779][ T5887] vfs_write+0x61e/0xbb0 [ 102.096810][ T5887] ? __pfx_vfs_write+0x10/0x10 [ 102.096834][ T5887] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.096856][ T5887] ? lockdep_hardirqs_on+0x7a/0x110 [ 102.096879][ T5887] ? mutex_lock_nested+0x152/0x1d0 [ 102.096905][ T5887] ? fdget_pos+0x252/0x320 [ 102.096928][ T5887] ksys_write+0x156/0x270 [ 102.096951][ T5887] ? __pfx_ksys_write+0x10/0x10 [ 102.096979][ T5887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.096998][ T5887] do_syscall_64+0x174/0x580 [ 102.097020][ T5887] ? trace_irq_disable+0x3b/0x140 [ 102.097039][ T5887] ? clear_bhb_loop+0x40/0x90 [ 102.097060][ T5887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.097079][ T5887] RIP: 0033:0x7f51a5e6de99 [ 102.097096][ T5887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.097111][ T5887] RSP: 002b:00007f51a4084028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.097130][ T5887] RAX: ffffffffffffffda RBX: 00007f51a60f6180 RCX: 00007f51a5e6de99 [ 102.097143][ T5887] RDX: 000000000000000d RSI: 0000200000000540 RDI: 0000000000000007 [ 102.097154][ T5887] RBP: 00007f51a5f03eaf R08: 0000000000000000 R09: 0000000000000000 [ 102.097165][ T5887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.097175][ T5887] R13: 00007f51a60f6218 R14: 00007f51a60f6180 R15: 00007ffc8f6d34b8 [ 102.097197][ T5887] [ 102.097204][ T5887] [ 102.097208][ T5887] The buggy address belongs to the variable: [ 102.097214][ T5887] ac_header_desc+0x0/0x20 [ 102.097237][ T5887] [ 102.097242][ T5887] The buggy address belongs to the physical page: [ 102.097262][ T5887] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x19e84 [ 102.097279][ T5887] flags: 0x80000000002000(reserved|node=0|zone=1) [ 102.097308][ T5887] raw: 0080000000002000 ffffea000067a108 ffffea000067a108 0000000000000000 [ 102.097324][ T5887] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 102.097334][ T5887] page dumped because: kasan: bad access detected [ 102.097348][ T5887] page_owner info is not present (never set?) [ 102.097355][ T5887] [ 102.097359][ T5887] Memory state around the buggy address: [ 102.097369][ T5887] ffffffff99e84680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.097381][ T5887] ffffffff99e84700: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 [ 102.097394][ T5887] >ffffffff99e84780: 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 00 f9 f9 [ 102.097403][ T5887] ^ [ 102.097413][ T5887] ffffffff99e84800: 00 00 f9 f9 00 00 f9 f9 00 00 f9 f9 00 00 00 00 [ 102.097426][ T5887] ffffffff99e84880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.097435][ T5887] ================================================================== [ 102.175900][ T5887] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 102.175959][ T5887] CPU: 1 UID: 0 PID: 5887 Comm: syz.1.27 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 102.176013][ T5887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 102.176047][ T5887] Call Trace: [ 102.176064][ T5887] [ 102.176082][ T5887] vpanic+0x56c/0xa60 [ 102.176144][ T5887] ? __pfx_vpanic+0x10/0x10 [ 102.176204][ T5887] panic+0xc5/0xd0 [ 102.176252][ T5887] ? __pfx_panic+0x10/0x10 [ 102.176298][ T5887] ? preempt_schedule_thunk+0x16/0x40 [ 102.176366][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176413][ T5887] ? preempt_schedule_thunk+0x16/0x40 [ 102.176481][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176532][ T5887] check_panic_on_warn+0x89/0xb0 [ 102.176563][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176582][ T5887] end_report+0x73/0x170 [ 102.176606][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176623][ T5887] kasan_report+0x128/0x150 [ 102.176646][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176668][ T5887] kasan_check_range+0x264/0x2c0 [ 102.176698][ T5887] ? usb_copy_descriptors+0x1b8/0x320 [ 102.176739][ T5887] __asan_memcpy+0x29/0x70 [ 102.176768][ T5887] usb_copy_descriptors+0x1b8/0x320 [ 102.176790][ T5887] usb_assign_descriptors+0xcf/0x290 [ 102.176810][ T5887] f_audio_bind+0x1b5e/0x34b0 [ 102.176840][ T5887] usb_add_function+0x290/0x930 [ 102.176859][ T5887] ? check_remote_wakeup_config+0x58/0x1c0 [ 102.176882][ T5887] configfs_composite_bind+0xde0/0x1410 [ 102.176909][ T5887] ? __pfx_configfs_composite_bind+0x10/0x10 [ 102.176935][ T5887] gadget_bind_driver+0x2ca/0x9e0 [ 102.176979][ T5887] ? __pfx_gadget_bind_driver+0x10/0x10 [ 102.177008][ T5887] really_probe+0x254/0xae0 [ 102.177036][ T5887] __driver_probe_device+0x1e8/0x360 [ 102.177063][ T5887] driver_probe_device+0x4f/0x240 [ 102.177090][ T5887] __driver_attach+0x339/0x600 [ 102.177117][ T5887] bus_for_each_dev+0x23e/0x2c0 [ 102.177136][ T5887] ? __pfx___driver_attach+0x10/0x10 [ 102.177161][ T5887] ? __pfx_bus_for_each_dev+0x10/0x10 [ 102.177183][ T5887] ? rt_spin_unlock+0x163/0x200 [ 102.177214][ T5887] bus_add_driver+0x348/0x670 [ 102.177237][ T5887] driver_register+0x23a/0x320 [ 102.177267][ T5887] usb_gadget_register_driver_owner+0xf9/0x270 [ 102.177296][ T5887] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 102.177325][ T5887] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 102.177356][ T5887] configfs_write_iter+0x33a/0x430 [ 102.177380][ T5887] vfs_write+0x61e/0xbb0 [ 102.177408][ T5887] ? __pfx_vfs_write+0x10/0x10 [ 102.177432][ T5887] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 102.177455][ T5887] ? lockdep_hardirqs_on+0x7a/0x110 [ 102.177478][ T5887] ? mutex_lock_nested+0x152/0x1d0 [ 102.177506][ T5887] ? fdget_pos+0x252/0x320 [ 102.177529][ T5887] ksys_write+0x156/0x270 [ 102.177554][ T5887] ? __pfx_ksys_write+0x10/0x10 [ 102.177579][ T5887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.177598][ T5887] do_syscall_64+0x174/0x580 [ 102.177621][ T5887] ? trace_irq_disable+0x3b/0x140 [ 102.177638][ T5887] ? clear_bhb_loop+0x40/0x90 [ 102.177660][ T5887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.177678][ T5887] RIP: 0033:0x7f51a5e6de99 [ 102.177696][ T5887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.177711][ T5887] RSP: 002b:00007f51a4084028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.177738][ T5887] RAX: ffffffffffffffda RBX: 00007f51a60f6180 RCX: 00007f51a5e6de99 [ 102.177753][ T5887] RDX: 000000000000000d RSI: 0000200000000540 RDI: 0000000000000007 [ 102.177765][ T5887] RBP: 00007f51a5f03eaf R08: 0000000000000000 R09: 0000000000000000 [ 102.177777][ T5887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.177788][ T5887] R13: 00007f51a60f6218 R14: 00007f51a60f6180 R15: 00007ffc8f6d34b8 [ 102.177810][ T5887] [ 102.178392][ T5887] Kernel Offset: disabled