last executing test programs: 6.686152914s ago: executing program 1 (id=2): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56561, 0x70bd2b, 0x1, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0x3, 0x8}, {0x7, 0x10}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x5, 0x7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20002000}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 6.128429174s ago: executing program 0 (id=7): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000280), &(0x7f00000002c0)=0x4) write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x2250) syz_usb_connect(0x0, 0x4f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005cdd2e106307151088560000000109023d00010000d00009047e0004ffd234000905b74318860809050725018705ee7b09050a000002810bac090504"], 0x0) 5.248458255s ago: executing program 1 (id=8): memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x8000) socket(0x27, 0x803, 0x1) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000034709d405f0530c6acb60102030109021200fd000000000904"], 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000700)={0x2c, &(0x7f0000000400)={0x40, 0xd, 0x1, "1d"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000a80)={0x34, &(0x7f0000000940)={0x20, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="2070b2271aee7d9405759d914bf68c95"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_open_dev$video(0x0, 0x8, 0x20202) 4.661033677s ago: executing program 3 (id=4): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0xfffff000) r0 = getpgrp(0x0) syz_pidfd_open(r0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='children\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000008c0)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00003ff000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000bbb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r2, &(0x7f0000000a40)={0x2020}, 0xffffffb2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/120, 0x78}], 0x1, 0xfffffffe, 0x101) process_madvise(r1, &(0x7f0000000100)=[{&(0x7f0000000280)="1ee0840f5071aefbb5af3ba9a82913431b8d21d584bb9e", 0x17}], 0x1, 0x65, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902240001000000000904000002bee4f900090503000000000000090504", @ANYRESOCT=0x0], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x5, 0x101000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x2}) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) ioctl$EVIOCSABS20(0xffffffffffffffff, 0x401845e0, 0x0) 4.129308425s ago: executing program 0 (id=9): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xb, &(0x7f0000000540)=ANY=[@ANYRES32=0x0, @ANYRESOCT, @ANYRESOCT, @ANYRES16, @ANYRES32=0x0, @ANYRES8=r0], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), r0) sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000fbfbdf25270000000e0001006e655f64657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) 3.47020465s ago: executing program 0 (id=10): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r0, 0x1, 0x15, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xa4e4, @remote, 0x3}, 0x1c) 3.387972452s ago: executing program 4 (id=5): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x200000005c832, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20940, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xc, @private1, 0x14}, 0xfffffffffffffecb, 0x0, 0x0, 0x0, 0x56}, 0x20000800) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) 2.429645895s ago: executing program 2 (id=3): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x8031, 0xffffffffffffffff, 0xfffff000) r0 = getpgrp(0x0) syz_pidfd_open(r0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000007c0)='children\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000008c0)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00003ff000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000bbb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') read$FUSE(r2, &(0x7f0000000a40)={0x2020}, 0xffffffb2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/120, 0x78}], 0x1, 0xfffffffe, 0x101) process_madvise(r1, &(0x7f0000000100)=[{&(0x7f0000000280)="1ee0840f5071aefbb5af3ba9a82913431b8d21d584bb9e", 0x17}], 0x1, 0x65, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902240001000000000904000002bee4f900090503000000000000090504", @ANYRESOCT=0x0], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x5, 0x101000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x2}) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) ioctl$EVIOCSABS20(r3, 0x401845e0, 0x0) 2.110956668s ago: executing program 0 (id=11): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010800feffffffffffff0a00000008000300", @ANYRES32=r2, @ANYBLOB="0a00060008021100000100002c005080110001004abee33908f8eef16f162471f400000004000500050002"], 0x54}}, 0x0) 2.081070744s ago: executing program 1 (id=12): fsopen(0x0, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000040)='FROZEN\x00', 0x7) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3], 0x44}}, 0x0) 1.697873405s ago: executing program 0 (id=13): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x23, 0x0, 0x0) connect$bt_rfcomm(r1, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x11}, 0xa) shutdown(r0, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x0) 1.576684873s ago: executing program 1 (id=14): bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc0000001900010029bd7000fbdbdf25ac1e0101000000000000000000000000ffffffff00000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000080000000000000000000000000000000000000000000000000000000000200000000000000fdffffffefffffff00000000000000001000000000000000050000000000000000000000002000000000000000000000000000000000000001000202000000004400050000000000000000000000ffff0a010100000004d63c"], 0xfc}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000240)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2, 0x9}}}}}}, 0x0) 1.396042646s ago: executing program 4 (id=15): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x812}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000009c0)={0x10, &(0x7f0000000300)={0x20, 0x13, 0x4, "0d718785"}, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 461.604783ms ago: executing program 1 (id=16): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)={0x24, r0, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x4004040) 460.927623ms ago: executing program 0 (id=17): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$kcm(0x2, 0x3, 0x2) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e21, @empty}, {0x2, 0x1, @remote}, {0x2, 0x4e23, @multicast2}, 0x118, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x5, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 438.554618ms ago: executing program 1 (id=18): set_mempolicy(0x3, &(0x7f0000000040)=0xfff, 0x5) syz_clone(0x200111, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = shmget$private(0x0, 0x1000, 0x78000000, &(0x7f0000ffc000/0x1000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/smt/control\x00', 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000e5000300000000000600000000000000250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) sendto(r1, &(0x7f0000000180)="98cc2badb312071f5588bd2ed1c45d19af837b456b97621703d8b634642af64c63df4f9c858c7e953e62ace07bc4b303e6a8ea98d5149d1c250511f402de4b1b422d6e0fcd73a0f27656e41f4f94f3bace4f", 0x52, 0x4000, 0x0, 0x0) write(r1, &(0x7f0000000140)='off', 0x3) getgroups(0x1, &(0x7f0000000000)=[0xee00]) shmctl$SHM_UNLOCK(r0, 0xc) shmat(r0, &(0x7f0000ffb000/0x4000)=nil, 0x4000) write(0xffffffffffffffff, &(0x7f0000000240)='online', 0x6) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 0s ago: executing program 3 (id=19): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x812}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000009c0)={0x10, &(0x7f0000000300)={0x20, 0x13, 0x4, "0d718785"}, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.188' (ED25519) to the list of known hosts. [ 337.164516][ T5611] cgroup: Unknown subsys name 'net' [ 337.406215][ T5611] cgroup: Unknown subsys name 'cpuset' [ 337.480750][ T5611] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 339.142975][ T5611] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 341.608667][ T5641] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 341.625734][ T5641] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 341.644098][ T5641] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 341.655516][ T5641] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 341.657372][ T5641] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 341.658818][ T5641] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 341.667485][ T5641] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 341.668454][ T5641] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 341.673318][ T5641] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 341.676746][ T5641] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 341.678995][ T5641] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 341.681655][ T5641] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 341.685274][ T5641] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 341.691391][ T5643] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 341.696938][ T5636] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 341.698660][ T5643] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 341.699673][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 341.779794][ T5643] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 341.818561][ T5643] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 341.830388][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 341.832869][ T5636] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 341.833437][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 341.886204][ T5636] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 341.889498][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 341.897151][ T4897] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 343.853135][ T5629] Bluetooth: hci2: command tx timeout [ 343.920598][ T5629] Bluetooth: hci4: command tx timeout [ 343.921131][ T4897] Bluetooth: hci1: command tx timeout [ 344.000291][ T5629] Bluetooth: hci3: command tx timeout [ 344.000479][ T5629] Bluetooth: hci0: command tx timeout [ 344.146257][ T5624] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.146995][ T5624] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.147736][ T5624] bridge_slave_0: entered allmulticast mode [ 344.149337][ T5624] bridge_slave_0: entered promiscuous mode [ 344.205398][ T5624] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.205495][ T5624] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.205951][ T5624] bridge_slave_1: entered allmulticast mode [ 344.207487][ T5624] bridge_slave_1: entered promiscuous mode [ 344.328776][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.328923][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.329023][ T5626] bridge_slave_0: entered allmulticast mode [ 344.331544][ T5626] bridge_slave_0: entered promiscuous mode [ 344.365261][ T5624] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.381232][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.381354][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.381452][ T5626] bridge_slave_1: entered allmulticast mode [ 344.383419][ T5626] bridge_slave_1: entered promiscuous mode [ 344.426053][ T5624] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.426368][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.426476][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.426795][ T5625] bridge_slave_0: entered allmulticast mode [ 344.428200][ T5625] bridge_slave_0: entered promiscuous mode [ 344.497563][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.497641][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.497912][ T5625] bridge_slave_1: entered allmulticast mode [ 344.499790][ T5625] bridge_slave_1: entered promiscuous mode [ 344.527984][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.528105][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.528258][ T5623] bridge_slave_0: entered allmulticast mode [ 344.529876][ T5623] bridge_slave_0: entered promiscuous mode [ 344.557321][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 344.557444][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.557927][ T5622] bridge_slave_0: entered allmulticast mode [ 344.559436][ T5622] bridge_slave_0: entered promiscuous mode [ 344.605001][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.605228][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.605337][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.605503][ T5623] bridge_slave_1: entered allmulticast mode [ 344.607316][ T5623] bridge_slave_1: entered promiscuous mode [ 344.608404][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.608524][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.608616][ T5622] bridge_slave_1: entered allmulticast mode [ 344.610071][ T5622] bridge_slave_1: entered promiscuous mode [ 344.616153][ T5624] team0: Port device team_slave_0 added [ 344.644526][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.689645][ T5624] team0: Port device team_slave_1 added [ 344.804853][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.863894][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.891291][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.895018][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.929693][ T5626] team0: Port device team_slave_0 added [ 344.934453][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.938729][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 344.939869][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 344.939882][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 344.939905][ T5624] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.026358][ T5624] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.026369][ T5624] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.026382][ T5624] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.028210][ T5625] team0: Port device team_slave_0 added [ 345.034760][ T5626] team0: Port device team_slave_1 added [ 345.092975][ T5625] team0: Port device team_slave_1 added [ 345.107707][ T5623] team0: Port device team_slave_0 added [ 345.119543][ T5622] team0: Port device team_slave_0 added [ 345.152177][ T5623] team0: Port device team_slave_1 added [ 345.154285][ T5622] team0: Port device team_slave_1 added [ 345.175995][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 345.176009][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.176032][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.232240][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 345.232252][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.232264][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.233298][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.233310][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.233333][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.297232][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.297248][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.297271][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.314761][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 345.314777][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.314800][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.337839][ T5624] hsr_slave_0: entered promiscuous mode [ 345.339363][ T5624] hsr_slave_1: entered promiscuous mode [ 345.341977][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 345.341991][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.342014][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.361699][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.361714][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.361739][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.368998][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.369013][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 345.369036][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 345.534401][ T5626] hsr_slave_0: entered promiscuous mode [ 345.535692][ T5626] hsr_slave_1: entered promiscuous mode [ 345.537501][ T5626] debugfs: 'hsr0' already exists in 'hsr' [ 345.537617][ T5626] Cannot create hsr debugfs directory [ 345.611716][ T5625] hsr_slave_0: entered promiscuous mode [ 345.612514][ T5625] hsr_slave_1: entered promiscuous mode [ 345.613056][ T5625] debugfs: 'hsr0' already exists in 'hsr' [ 345.613072][ T5625] Cannot create hsr debugfs directory [ 345.673590][ T5622] hsr_slave_0: entered promiscuous mode [ 345.674327][ T5622] hsr_slave_1: entered promiscuous mode [ 345.674826][ T5622] debugfs: 'hsr0' already exists in 'hsr' [ 345.674842][ T5622] Cannot create hsr debugfs directory [ 345.703713][ T5623] hsr_slave_0: entered promiscuous mode [ 345.704553][ T5623] hsr_slave_1: entered promiscuous mode [ 345.705099][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 345.705115][ T5623] Cannot create hsr debugfs directory [ 345.920457][ T4897] Bluetooth: hci2: command tx timeout [ 346.010322][ T4897] Bluetooth: hci4: command tx timeout [ 346.010356][ T4897] Bluetooth: hci1: command tx timeout [ 346.080424][ T4897] Bluetooth: hci0: command tx timeout [ 346.080458][ T4897] Bluetooth: hci3: command tx timeout [ 346.908321][ T5624] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 346.964525][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 346.981431][ T5624] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 347.026299][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 347.030473][ T5624] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 347.065858][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 347.088708][ T5624] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 347.132020][ T5624] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 347.254808][ T5625] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 347.296702][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 347.312427][ T5625] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 347.354618][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 347.357210][ T5625] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 347.378989][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 347.399932][ T5625] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 347.437924][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 347.582700][ T5622] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 347.625673][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 347.633328][ T5622] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 347.667833][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 347.684491][ T5622] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 347.713443][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 347.742932][ T5622] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 347.774252][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 347.910318][ T5626] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 347.933224][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 347.939873][ T5626] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 347.984468][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 347.996031][ T5626] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 348.000480][ T5629] Bluetooth: hci2: command tx timeout [ 348.025384][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 348.047541][ T5626] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 348.080693][ T5629] Bluetooth: hci1: command tx timeout [ 348.080708][ T4897] Bluetooth: hci4: command tx timeout [ 348.085876][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 348.161023][ T4897] Bluetooth: hci0: command tx timeout [ 348.172111][ T4897] Bluetooth: hci3: command tx timeout [ 348.226439][ T5624] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.275789][ T5623] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 348.303646][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 348.307800][ T5623] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 348.361349][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 348.369505][ T5623] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 348.406596][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 348.422995][ T5623] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 348.471632][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 348.524869][ T5624] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.539855][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.594178][ T4349] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.597479][ T4349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.655344][ T4349] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.655467][ T4349] bridge0: port 2(bridge_slave_1) entered forwarding state [ 348.704559][ T5625] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.751519][ T4349] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.751815][ T4349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.784055][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 348.834384][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.834540][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 348.966941][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.029857][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0 [ 349.090622][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 349.090742][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 349.205151][ T196] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.205372][ T196] bridge0: port 2(bridge_slave_1) entered forwarding state [ 349.323497][ T5626] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.403998][ T196] bridge0: port 1(bridge_slave_0) entered blocking state [ 349.404201][ T196] bridge0: port 1(bridge_slave_0) entered forwarding state [ 349.450577][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 349.496325][ T5649] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.496455][ T5649] bridge0: port 2(bridge_slave_1) entered forwarding state [ 349.642719][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 349.723313][ T5649] bridge0: port 1(bridge_slave_0) entered blocking state [ 349.723474][ T5649] bridge0: port 1(bridge_slave_0) entered forwarding state [ 349.797293][ T5649] bridge0: port 2(bridge_slave_1) entered blocking state [ 349.797473][ T5649] bridge0: port 2(bridge_slave_1) entered forwarding state [ 350.084352][ T4897] Bluetooth: hci2: command tx timeout [ 350.160282][ T4897] Bluetooth: hci1: command tx timeout [ 350.160312][ T4897] Bluetooth: hci4: command tx timeout [ 350.240900][ T5629] Bluetooth: hci3: command tx timeout [ 350.240930][ T5629] Bluetooth: hci0: command tx timeout [ 350.381243][ T5624] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.753998][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.796522][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.831571][ T5624] veth0_vlan: entered promiscuous mode [ 350.941391][ T5624] veth1_vlan: entered promiscuous mode [ 351.328659][ T5624] veth0_macvtap: entered promiscuous mode [ 351.388110][ T5625] veth0_vlan: entered promiscuous mode [ 351.407199][ T5624] veth1_macvtap: entered promiscuous mode [ 351.425757][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.496081][ T5625] veth1_vlan: entered promiscuous mode [ 351.523586][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 351.547100][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 351.559649][ T5624] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 351.797381][ T5625] veth0_macvtap: entered promiscuous mode [ 351.803928][ T5623] veth0_vlan: entered promiscuous mode [ 351.879065][ T5622] veth0_vlan: entered promiscuous mode [ 351.919289][ T5625] veth1_macvtap: entered promiscuous mode [ 351.993392][ T5623] veth1_vlan: entered promiscuous mode [ 352.053421][ T5622] veth1_vlan: entered promiscuous mode [ 352.072196][ T5626] veth0_vlan: entered promiscuous mode [ 352.098918][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 352.117979][ T5651] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 352.118003][ T5651] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 352.167499][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 352.171332][ T5626] veth1_vlan: entered promiscuous mode [ 352.272944][ T5651] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 352.272964][ T5651] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 352.282748][ T5623] veth0_macvtap: entered promiscuous mode [ 352.355533][ T5623] veth1_macvtap: entered promiscuous mode [ 352.394457][ T5622] veth0_macvtap: entered promiscuous mode [ 352.526808][ T5622] veth1_macvtap: entered promiscuous mode [ 352.760761][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 352.761268][ T5626] veth0_macvtap: entered promiscuous mode [ 352.837467][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 352.838410][ T5626] veth1_macvtap: entered promiscuous mode [ 352.873009][ T4349] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 352.873029][ T4349] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 352.882765][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 352.918480][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 353.028997][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.093133][ T4349] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 353.093168][ T4349] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 353.135767][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 354.317657][ T5827] syzkaller0: entered promiscuous mode [ 354.317684][ T5827] syzkaller0: entered allmulticast mode [ 354.351092][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.351113][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 354.434019][ T5829] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 354.925446][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 355.073545][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 355.073563][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.150327][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 355.153444][ T10] usb 1-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 355.175226][ T196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 355.175248][ T196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.210975][ T10] usb 1-1: config 0 has an invalid interface number: 126 but max is 0 [ 355.211036][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 355.211067][ T10] usb 1-1: config 0 has no interface number 0 [ 355.211120][ T10] usb 1-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 355.211169][ T10] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 355.211223][ T10] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 355.211248][ T10] usb 1-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 355.211266][ T10] usb 1-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 355.211286][ T10] usb 1-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 355.211359][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 355.391631][ T10] usb 1-1: config 0 descriptor?? [ 355.404870][ T5832] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 355.643382][ T10] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 355.756879][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 355.756899][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.850299][ T5753] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 356.114064][ T5753] usb 2-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 356.134346][ T5753] usb 2-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 356.134372][ T5753] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 356.134392][ T5753] usb 2-1: config 0 has no interface number 0 [ 356.134542][ T5753] usb 2-1: too many endpoints for config 0 interface 109 altsetting 134: 183, using maximum allowed: 30 [ 356.134563][ T5753] usb 2-1: config 0 interface 109 altsetting 134 has 0 endpoint descriptors, different from the interface descriptor's value: 183 [ 356.134577][ T5753] usb 2-1: config 0 interface 109 has no altsetting 0 [ 356.139009][ T5790] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 356.139041][ T5790] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 356.288415][ T5649] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.319084][ T5753] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 356.319109][ T5753] usb 2-1: Product: syz [ 356.319123][ T5753] usb 2-1: Manufacturer: syz [ 356.319135][ T5753] usb 2-1: SerialNumber: syz [ 356.698280][ T5753] usb 2-1: config 0 descriptor?? [ 357.028489][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 357.037758][ C0] raw-gadget.1 gadget.1: ignoring, device is not running [ 357.074188][ T5651] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.074208][ T5651] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.117113][ T5651] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.117495][ T5651] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.117970][ T5651] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.133546][ T5649] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.240089][ T5753] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 357.293939][ T5753] gspca_sunplus: reg_r err -71 [ 357.294150][ T5753] sunplus 2-1:0.109: probe with driver sunplus failed with error -71 [ 357.398092][ T5753] usb 2-1: USB disconnect, device number 2 [ 357.479588][ T67] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.711632][ T67] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.712607][ T67] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.830678][ T5658] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.831220][ T5658] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.831963][ T5658] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.852475][ T67] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.857150][ T5649] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.857331][ T5649] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.857558][ T5649] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.857737][ T5649] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.857901][ T5649] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 357.858323][ T5649] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.033892][ T10] snd-usb-audio 1-1:0.126: probe with driver snd-usb-audio failed with error -12 [ 358.063385][ T5850] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 358.063785][ T10] usb 1-1: USB disconnect, device number 2 [ 358.241714][ T5658] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.241769][ T5658] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.706995][ T5858] netlink: 40 bytes leftover after parsing attributes in process `syz.1.12'. [ 358.714605][ T5856] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11'. [ 358.993428][ T5740] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 359.163043][ T5740] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 359.168399][ T5740] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 359.168428][ T5740] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 359.168468][ T5740] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.273986][ T5740] usb 4-1: config 0 descriptor?? [ 359.746186][ T5740] ath6kl: Failed to submit usb control message: -71 [ 359.746235][ T5740] ath6kl: unable to send the bmi data to the device: -71 [ 359.746248][ T5740] ath6kl: Unable to send get target info: -71 [ 359.859254][ T5740] ath6kl: Failed to init ath6kl core: -71 [ 359.878784][ T1235] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 359.879356][ T31] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 359.921645][ T5740] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 360.084832][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 360.085175][ T1235] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 360.091660][ T1235] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 360.091690][ T1235] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 12336, setting to 64 [ 360.091730][ T1235] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.098598][ T31] usb 5-1: unable to get BOS descriptor or descriptor too short [ 360.098653][ T31] usb 5-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 360.106145][ T31] usb 5-1: config 14 has an invalid interface number: 57 but max is 1 [ 360.106169][ T31] usb 5-1: config 14 has an invalid interface number: 228 but max is 1 [ 360.106187][ T31] usb 5-1: config 14 has no interface number 0 [ 360.106201][ T31] usb 5-1: config 14 has no interface number 1 [ 360.106265][ T31] usb 5-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 360.106286][ T31] usb 5-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 360.106309][ T31] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 360.106333][ T31] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 360.106358][ T31] usb 5-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 360.106382][ T31] usb 5-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 360.106406][ T31] usb 5-1: config 14 interface 57 has no altsetting 0 [ 360.106422][ T31] usb 5-1: config 14 interface 228 has no altsetting 0 [ 360.116881][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.116907][ T31] usb 5-1: Product: syz [ 360.116920][ T31] usb 5-1: Manufacturer: syz [ 360.116933][ T31] usb 5-1: SerialNumber: syz [ 360.212913][ T5740] usb 4-1: USB disconnect, device number 2 [ 360.419267][ T1235] usb 3-1: config 0 descriptor?? [ 360.431432][ T5875] Bluetooth: MGMT ver 1.23 [ 360.988286][ T31] legousbtower 5-1:14.57: interrupt endpoints not found [ 361.037614][ T1235] ath6kl: Failed to submit usb control message: -71 [ 361.037713][ T1235] ath6kl: unable to send the bmi data to the device: -71 [ 361.037729][ T1235] ath6kl: Unable to send get target info: -71 [ 361.048884][ T1235] ath6kl: Failed to init ath6kl core: -71 [ 361.084156][ T1235] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 361.131216][ T5878] smpboot: CPU 1 is now offline [ 361.321091][ T5753] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 361.519215][ T5753] usb 4-1: Using ep0 maxpacket: 32 [ 361.542644][ T5753] usb 4-1: unable to get BOS descriptor or descriptor too short [ 361.542679][ T5753] usb 4-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 361.543875][ T5753] usb 4-1: config 14 has an invalid interface number: 57 but max is 1 [ 361.543889][ T5753] usb 4-1: config 14 has an invalid interface number: 228 but max is 1 [ 361.543900][ T5753] usb 4-1: config 14 has no interface number 0 [ 361.543939][ T5753] usb 4-1: config 14 has no interface number 1 [ 361.543977][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 361.543988][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 361.544000][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 361.544012][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 361.544025][ T5753] usb 4-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 361.544037][ T5753] usb 4-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 361.544050][ T5753] usb 4-1: config 14 interface 57 has no altsetting 0 [ 361.544089][ T5753] usb 4-1: config 14 interface 228 has no altsetting 0 [ 361.549867][ T5753] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 361.549881][ T5753] usb 4-1: Product: syz [ 361.549888][ T5753] usb 4-1: Manufacturer: syz [ 361.549895][ T5753] usb 4-1: SerialNumber: syz [ 361.966168][ C0] [ 361.966177][ C0] ============================================ [ 361.966181][ C0] WARNING: possible recursive locking detected [ 361.966192][ C0] syzkaller #0 Not tainted [ 361.966198][ C0] -------------------------------------------- [ 361.966202][ C0] ktimers/0/16 is trying to acquire lock: [ 361.966209][ C0] ffff8880b873a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 361.966260][ C0] [ 361.966260][ C0] but task is already holding lock: [ 361.966264][ C0] ffff8880b863a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 361.966287][ C0] [ 361.966287][ C0] other info that might help us debug this: [ 361.966290][ C0] Possible unsafe locking scenario: [ 361.966290][ C0] [ 361.966293][ C0] CPU0 [ 361.966296][ C0] ---- [ 361.966299][ C0] lock(&pool->cb_lock); [ 361.966306][ C0] lock(&pool->cb_lock); [ 361.966312][ C0] [ 361.966312][ C0] *** DEADLOCK *** [ 361.966312][ C0] [ 361.966315][ C0] May be due to missing lock nesting notation [ 361.966315][ C0] [ 361.966318][ C0] 6 locks held by ktimers/0/16: [ 361.966324][ C0] #0: ffffffff8e059220 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 361.966352][ C0] #1: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 361.966376][ C0] #2: ffff8880b863a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 361.966409][ C0] #3: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 361.966436][ C0] #4: ffff88813ff19d38 ((wq_completion)events_bh){+...}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 361.966462][ C0] #5: ffffc90000157ba0 ((work_completion)(&dead_work.work)){+...}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 361.966486][ C0] [ 361.966486][ C0] stack backtrace: [ 361.966498][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 361.966514][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 361.966527][ C0] Call Trace: [ 361.966531][ C0] [ 361.966536][ C0] dump_stack_lvl+0xe8/0x150 [ 361.966554][ C0] print_deadlock_bug+0x279/0x290 [ 361.966569][ C0] __lock_acquire+0x24df/0x2ce0 [ 361.966579][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 361.966595][ C0] ? __pfx_hlock_conflict+0x10/0x10 [ 361.966607][ C0] ? check_path+0x21/0x40 [ 361.966619][ C0] ? bh_worker+0x7d/0x880 [ 361.966630][ C0] lock_acquire+0x106/0x350 [ 361.966639][ C0] ? bh_worker+0x7d/0x880 [ 361.966651][ C0] ? lockdep_unlock+0x5d/0xd0 [ 361.966667][ C0] rt_spin_lock+0x83/0x400 [ 361.966678][ C0] ? bh_worker+0x7d/0x880 [ 361.966689][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 361.966701][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 361.966715][ C0] bh_worker+0x7d/0x880 [ 361.966727][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 361.966743][ C0] drain_dead_softirq_workfn+0x95/0x220 [ 361.966756][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 361.966766][ C0] process_scheduled_works+0xa8e/0x14e0 [ 361.966782][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 361.966792][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 361.966808][ C0] bh_worker+0x46a/0x880 [ 361.966821][ C0] tasklet_action+0xc/0x70 [ 361.966833][ C0] handle_softirqs+0x1d9/0x6c0 [ 361.966846][ C0] run_ktimerd+0x69/0x100 [ 361.966859][ C0] smpboot_thread_fn+0x57c/0xa80 [ 361.966874][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 361.966887][ C0] kthread+0x388/0x470 [ 361.966903][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 361.966914][ C0] ? __pfx_kthread+0x10/0x10 [ 361.966928][ C0] ret_from_fork+0x514/0xb70 [ 361.966945][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 361.966959][ C0] ? __switch_to+0xc89/0x1420 [ 361.966973][ C0] ? __pfx_kthread+0x10/0x10 [ 361.966987][ C0] ret_from_fork_asm+0x1a/0x30 [ 361.967004][ C0] [ 361.967036][ C0] BUG: workqueue leaked atomic, lock or RCU: ktimers/0[16] [ 361.967036][ C0] preempt=0x00000000 lock=4->0 RCU=2->2 workfn=drain_dead_softirq_workfn [ 361.967056][ C0] INFO: lockdep is turned off. [ 361.967061][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 361.967072][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 361.967078][ C0] Call Trace: [ 361.967081][ C0] [ 361.967085][ C0] dump_stack_lvl+0xe8/0x150 [ 361.967098][ C0] process_scheduled_works+0x1161/0x14e0 [ 361.967114][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 361.967124][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 361.967141][ C0] bh_worker+0x46a/0x880 [ 361.967154][ C0] tasklet_action+0xc/0x70 [ 361.967165][ C0] handle_softirqs+0x1d9/0x6c0 [ 361.967178][ C0] run_ktimerd+0x69/0x100 [ 361.967214][ C0] smpboot_thread_fn+0x57c/0xa80 [ 361.967227][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 361.967246][ C0] kthread+0x388/0x470 [ 361.967259][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 361.967271][ C0] ? __pfx_kthread+0x10/0x10 [ 361.967285][ C0] ret_from_fork+0x514/0xb70 [ 361.967299][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 361.967313][ C0] ? __switch_to+0xc89/0x1420 [ 361.967325][ C0] ? __pfx_kthread+0x10/0x10 [ 361.967338][ C0] ret_from_fork_asm+0x1a/0x30 [ 361.967356][ C0] [ 361.987709][ T1235] usb 3-1: USB disconnect, device number 2 [ 362.573449][ T31] legousbtower 5-1:14.228: get version request failed: -71 [ 362.573532][ T31] legousbtower 5-1:14.228: probe with driver legousbtower failed with error -71 [ 362.611674][ T31] usb 5-1: USB disconnect, device number 2 [ 362.848671][ T5753] legousbtower 4-1:14.57: interrupt endpoints not found [ 363.248917][ T5753] legousbtower 4-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 363.250547][ T5753] legousbtower 4-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 364.016630][ C0] usb 4-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 364.016662][ T5761] usb 4-1: USB disconnect, device number 3 [ 364.537027][ T5761] legousbtower 4-1:14.228: LEGO USB Tower #-160 now disconnected