last executing test programs: 4.678297811s ago: executing program 2 (id=117): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000001ec0)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0x20, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @broadcast}, {0x4e20, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x1, 0x3, 0x7, 0x100, @void}}}}}, 0x2e) 4.600259109s ago: executing program 3 (id=119): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000000040)={0x20, 0xf, 0x3, "a0e778"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$IPSET_CMD_GET_BYINDEX(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000000f060101"], 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x4000000) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) 3.546241094s ago: executing program 2 (id=124): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000100)={0xd}, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000040)={0xed}, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f00000000c0), 0x1) 3.416723861s ago: executing program 2 (id=125): r0 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5) lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="7f454c460504028d0400dd0000000000020006000400000019000000380000005e020000080400000400200002000500ff0300020000000051e574740400000054000000030000000200000002000000070a00000300000051e574640008"], 0x78) close(r0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 2.991060604s ago: executing program 2 (id=127): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000040)={0x0, 0xea60}, 0x10) listen(r0, 0x3) accept4$bt_l2cap(r0, 0x0, 0x0, 0x0) 2.444812828s ago: executing program 2 (id=129): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000700)=ANY=[@ANYBLOB="40000f000000012721dcfe14c639a500ba17162716"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x5b14, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000880)=ANY=[@ANYBLOB="000f920000"], 0x0, 0x0, 0x0, 0x0}) 2.421359627s ago: executing program 3 (id=130): bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000000)) 1.832503538s ago: executing program 3 (id=132): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0x6) r1 = epoll_create(0x8) socket$nl_generic(0x10, 0x3, 0x10) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) 1.667693191s ago: executing program 0 (id=133): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz0\x00', {0x2, 0x10, 0x2, 0x4}, 0x400048, [0x9, 0x0, 0x0, 0x40000, 0x3, 0x2, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x22, 0x3fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x4, 0x80000257, 0x1, 0x0, 0x0, 0x0, 0x2000, 0xfa, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5c4, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x8000, 0x2, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffffffd, 0xfffffffc, 0x0, 0x200, 0xfffffff9, 0xfffffffc, 0x0, 0x0, 0x7, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffeffffe, 0x9, 0x0, 0x200, 0x0, 0x2, 0xfffffffd, 0x3, 0x5, 0xfffffffd, 0x4000000, 0xfffffffd, 0x3, 0x0, 0x0, 0x7fff, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x2aa6, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x4, 0xfffffffe, 0x0, 0x0, 0x0, 0xb, 0x0, 0x4000000, 0x0, 0x1, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffb, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x4, 0x0, 0x6, 0x1, 0x0, 0xbda6, 0xe, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x20, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x8000007, 0x40, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x6, 0x40, 0x0, 0x0, 0xbd, 0x0, 0xfb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0xfe, 0x5, 0x67d, 0x7, 0x0, 0x0, 0x0, 0x6, 0xcaa, 0xfffffffd, 0x0, 0x4, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) 1.328874436s ago: executing program 0 (id=135): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xffe, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000000c0)=@mmap={0x1, 0x1, 0x4, 0x0, 0xffffffff, {0x77359400}, {0x0, 0x1, 0xf1, 0x5, 0x0, 0x1, "bf631e4b"}}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0xd, {0x0, 0x2710}, {0x0, 0x0, 0x0, 0x3d, 0x0, 0x0, "a730ba01"}, 0x0, 0x1, {0x0}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) 1.175546319s ago: executing program 3 (id=136): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000180), &(0x7f0000000200)=0x14) 1.061272907s ago: executing program 0 (id=138): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000000140)="9b", 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @loopback, 0xffffffff}, 0x1c, 0x0}, 0x4040054) 884.025054ms ago: executing program 1 (id=139): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = memfd_create(&(0x7f0000000a00)='\xcdT\xea\x1fd\x1a6\x13\xeb\xce(}\x91Q\x02\x00E\x88-\x00', 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1, 0x3, 0x0) write$binfmt_elf64(r0, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x88, 0xac, 0x5, 0xff, 0xa, 0x2, 0x6, 0x9, 0x32f, 0x40, 0x331, 0x2, 0x800, 0x38, 0x1, 0x3, 0x7, 0xffff}, [{0x2, 0x6, 0x3, 0x5, 0x6, 0x100000001, 0x9, 0x7fffffff}]}, 0x78) sendfile(r0, r1, 0x0, 0x8000fb00) 806.354889ms ago: executing program 0 (id=140): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)='\x00', 0x1}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) sendmmsg$unix(r1, &(0x7f0000005400)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000200)="d8", 0x1}], 0x1, &(0x7f0000000400)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x40000}}], 0x1, 0x4004080) 685.631371ms ago: executing program 1 (id=141): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001040)={&(0x7f00000000c0)={0x48, r2, 0xb97534d5fe9704cf, 0x0, 0x1, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xffff}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x3f2}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_STA_WME={0xc, 0x81, [@NL80211_STA_WME_MAX_SP={0x5, 0x2, 0xb}]}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x8854) 627.539697ms ago: executing program 3 (id=142): ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(0xffffffffffffffff, 0x40084146, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f00000067c0)={0x1, 0x0, [{0x582, 0x0, 0x247}]}) 553.488452ms ago: executing program 1 (id=143): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) r1 = socket(0x15, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x271c, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) 521.832581ms ago: executing program 0 (id=144): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x4e}]}) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) socket(0x11, 0x3, 0x8) write$bt_hci(r0, &(0x7f0000000000)=ANY=[], 0x6) 365.789871ms ago: executing program 1 (id=145): ioctl$KVM_CAP_DIRTY_LOG_RING(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000400)={0xc0, 0x0, 0x8000}) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x0, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x2, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x8040) 249.472859ms ago: executing program 1 (id=146): getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000000)={0x1f, 0x0}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 248.278742ms ago: executing program 0 (id=147): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x6, 0x80800) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f00000002c0)={0x400002, r2}) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f00000000c0)={0x400005, 0xffffffffffffffff, 0x1}) 142.362747ms ago: executing program 2 (id=148): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 131.638986ms ago: executing program 3 (id=149): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x140) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='./file0/../file0\x00') 0s ago: executing program 1 (id=150): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0x0) accept(r0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000180)={0x0, 0x2}, 0x18, 0x0) landlock_restrict_self(r1, 0xf) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.126' (ED25519) to the list of known hosts. [ 83.524320][ T5596] cgroup: Unknown subsys name 'net' [ 83.766029][ T5596] cgroup: Unknown subsys name 'cpuset' [ 83.820450][ T5596] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.791437][ T5596] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.338450][ T5610] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.366170][ T5610] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.368739][ T5610] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.392968][ T5610] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.406545][ T5610] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.429668][ T4924] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.477917][ T5616] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.496670][ T5616] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.516474][ T5616] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.534842][ T5616] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.538126][ T5616] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.538644][ T5616] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.555023][ T5616] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.561332][ T5616] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.575003][ T5616] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.584551][ T5616] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.585015][ T5616] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.587819][ T5616] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.669165][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.679422][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.554088][ T60] Bluetooth: hci0: command tx timeout [ 90.630000][ T60] Bluetooth: hci2: command tx timeout [ 90.789980][ T60] Bluetooth: hci3: command tx timeout [ 90.789993][ T5616] Bluetooth: hci1: command tx timeout [ 90.936301][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.937406][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.937626][ T5608] bridge_slave_0: entered allmulticast mode [ 90.943691][ T5608] bridge_slave_0: entered promiscuous mode [ 90.976090][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.976347][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.976545][ T5614] bridge_slave_0: entered allmulticast mode [ 90.979057][ T5614] bridge_slave_0: entered promiscuous mode [ 91.024991][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.025318][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.025622][ T5608] bridge_slave_1: entered allmulticast mode [ 91.028425][ T5608] bridge_slave_1: entered promiscuous mode [ 91.067251][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.067508][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.067704][ T5614] bridge_slave_1: entered allmulticast mode [ 91.093399][ T5614] bridge_slave_1: entered promiscuous mode [ 91.095748][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.096080][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.096348][ T5612] bridge_slave_0: entered allmulticast mode [ 91.099137][ T5612] bridge_slave_0: entered promiscuous mode [ 91.192559][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.192815][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.193321][ T5612] bridge_slave_1: entered allmulticast mode [ 91.195819][ T5612] bridge_slave_1: entered promiscuous mode [ 91.236281][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.236632][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.236913][ T5613] bridge_slave_0: entered allmulticast mode [ 91.239688][ T5613] bridge_slave_0: entered promiscuous mode [ 91.310973][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.311413][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.311737][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.312018][ T5613] bridge_slave_1: entered allmulticast mode [ 91.315161][ T5613] bridge_slave_1: entered promiscuous mode [ 91.361752][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.392617][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.433799][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.439354][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.526391][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.562832][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.609332][ T5608] team0: Port device team_slave_0 added [ 91.618983][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.632426][ T5614] team0: Port device team_slave_0 added [ 91.659517][ T5608] team0: Port device team_slave_1 added [ 91.688381][ T5614] team0: Port device team_slave_1 added [ 91.698116][ T5612] team0: Port device team_slave_0 added [ 91.767759][ T5612] team0: Port device team_slave_1 added [ 91.799330][ T5613] team0: Port device team_slave_0 added [ 91.842887][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.842900][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.842920][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.848761][ T5613] team0: Port device team_slave_1 added [ 91.854839][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.854882][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.854957][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.956717][ T1717] cfg80211: failed to load regulatory.db [ 91.968221][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.968233][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.968253][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.030754][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.030766][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.030786][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.037437][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.037449][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.037468][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.177554][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.177567][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.177586][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.204748][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.204792][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.204925][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.284102][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.284115][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.284136][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.631243][ T60] Bluetooth: hci0: command tx timeout [ 92.686477][ T5608] hsr_slave_0: entered promiscuous mode [ 92.688426][ T5608] hsr_slave_1: entered promiscuous mode [ 92.710160][ T60] Bluetooth: hci2: command tx timeout [ 92.735910][ T5614] hsr_slave_0: entered promiscuous mode [ 92.737602][ T5614] hsr_slave_1: entered promiscuous mode [ 92.739318][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 92.739427][ T5614] Cannot create hsr debugfs directory [ 92.820406][ T5612] hsr_slave_0: entered promiscuous mode [ 92.822768][ T5612] hsr_slave_1: entered promiscuous mode [ 92.824167][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 92.824191][ T5612] Cannot create hsr debugfs directory [ 92.872728][ T5616] Bluetooth: hci1: command tx timeout [ 92.872815][ T60] Bluetooth: hci3: command tx timeout [ 92.904301][ T5613] hsr_slave_0: entered promiscuous mode [ 92.906464][ T5613] hsr_slave_1: entered promiscuous mode [ 92.907855][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 92.907879][ T5613] Cannot create hsr debugfs directory [ 93.843079][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.888703][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.919498][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.967620][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.976957][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.010608][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.035315][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.069519][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.247284][ T5614] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 94.284230][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.288402][ T5614] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 94.327061][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.338312][ T5614] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 94.365433][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.401494][ T5614] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 94.426894][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.588202][ T5612] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 94.615088][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.631582][ T5612] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 94.674428][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.692696][ T5612] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 94.710130][ T60] Bluetooth: hci0: command tx timeout [ 94.735465][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.790299][ T60] Bluetooth: hci2: command tx timeout [ 94.794351][ T5612] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 94.834810][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.960796][ T5616] Bluetooth: hci1: command tx timeout [ 94.960896][ T60] Bluetooth: hci3: command tx timeout [ 95.037402][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 95.076669][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.080941][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 95.114629][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.126167][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 95.155113][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.179051][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.187286][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 95.224786][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.337888][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.451957][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.452243][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.541997][ T2167] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.542156][ T2167] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.579382][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.737327][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.799293][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.799449][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.835921][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.874573][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.874701][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.031722][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.093864][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.094150][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.146963][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.211298][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.211430][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.354303][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.426389][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.426640][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.488579][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.499468][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.793638][ T60] Bluetooth: hci0: command tx timeout [ 96.880114][ T60] Bluetooth: hci2: command tx timeout [ 97.030117][ T60] Bluetooth: hci3: command tx timeout [ 97.030146][ T60] Bluetooth: hci1: command tx timeout [ 97.172011][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.685504][ T5608] veth0_vlan: entered promiscuous mode [ 97.705901][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.789482][ T5608] veth1_vlan: entered promiscuous mode [ 97.974943][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.112953][ T5608] veth0_macvtap: entered promiscuous mode [ 98.134311][ T5614] veth0_vlan: entered promiscuous mode [ 98.198877][ T5608] veth1_macvtap: entered promiscuous mode [ 98.263280][ T5614] veth1_vlan: entered promiscuous mode [ 98.308008][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.345871][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.390661][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.408178][ T5612] veth0_vlan: entered promiscuous mode [ 98.488324][ T1125] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.511586][ T1125] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.516218][ T1125] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.546763][ T1125] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.573447][ T5612] veth1_vlan: entered promiscuous mode [ 98.666716][ T5614] veth0_macvtap: entered promiscuous mode [ 98.708537][ T5614] veth1_macvtap: entered promiscuous mode [ 98.992920][ T5613] veth0_vlan: entered promiscuous mode [ 99.025851][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.094142][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.129173][ T5612] veth0_macvtap: entered promiscuous mode [ 99.144841][ T1125] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.144867][ T1125] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.149039][ T5613] veth1_vlan: entered promiscuous mode [ 99.233152][ T1125] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.250881][ T5612] veth1_macvtap: entered promiscuous mode [ 99.274018][ T1125] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.276210][ T1125] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.301919][ T1125] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.370494][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.370514][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.539370][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.699572][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.805331][ T1125] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.850565][ T5613] veth0_macvtap: entered promiscuous mode [ 99.876574][ T1125] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.908772][ T1125] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.940767][ T1125] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.943875][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.943893][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.947395][ T5613] veth1_macvtap: entered promiscuous mode [ 100.231806][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.231828][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.378917][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.827397][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.067507][ T1030] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.081947][ T1030] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.086803][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.086823][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.088784][ T1030] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.140831][ T1030] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.465453][ T1125] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.465472][ T1125] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.313761][ T1125] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.313779][ T1125] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.593935][ T1438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.593960][ T1438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.819361][ T5790] netlink: 'syz.2.3': attribute type 58 has an invalid length. [ 102.893887][ T5790] Zero length message leads to an empty skb [ 104.269919][ T37] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 104.475805][ T5797] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 104.675204][ T5797] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.675240][ T5797] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.675279][ T5797] usb 2-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 104.675304][ T5797] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.773363][ T37] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 104.773432][ T37] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.773487][ T37] usb 3-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 104.821606][ T37] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 104.821633][ T37] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.821651][ T37] usb 3-1: Product: syz [ 104.821664][ T37] usb 3-1: Manufacturer: syz [ 104.821677][ T37] usb 3-1: SerialNumber: syz [ 105.127920][ T5797] usb 2-1: config 0 descriptor?? [ 105.539159][ T5797] usbhid 2-1:0.0: can't add hid device: -71 [ 105.539275][ T5797] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 105.816510][ T5797] usb 2-1: USB disconnect, device number 2 [ 106.314883][ T5823] netlink: 762 bytes leftover after parsing attributes in process `syz.3.23'. [ 106.373590][ T37] cdc_ncm 3-1:1.0: bind() failure [ 106.411969][ T37] cdc_ncm 3-1:1.1: probe with driver cdc_ncm failed with error -71 [ 106.413904][ T37] cdc_mbim 3-1:1.1: probe with driver cdc_mbim failed with error -71 [ 106.415637][ T37] usbtest 3-1:1.1: probe with driver usbtest failed with error -71 [ 106.483635][ T37] usb 3-1: USB disconnect, device number 2 [ 106.766085][ T5797] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 106.814245][ T5820] syz.0.22 (5820) used greatest stack depth: 18184 bytes left [ 106.972170][ T5797] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.972207][ T5797] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.972249][ T5797] usb 2-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 106.972274][ T5797] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.036662][ T5797] usb 2-1: config 0 descriptor?? [ 107.054339][ T5833] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 107.200784][ T5797] usbhid 2-1:0.0: can't add hid device: -71 [ 107.200913][ T5797] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 107.303050][ T5797] usb 2-1: USB disconnect, device number 3 [ 107.852580][ T5848] warning: `syz.2.32' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 107.989999][ T5797] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 108.142233][ T5797] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 108.142269][ T5797] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 108.142296][ T5797] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 108.146756][ T5797] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 108.146787][ T5797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.146808][ T5797] usb 2-1: Product: syz [ 108.146824][ T5797] usb 2-1: Manufacturer: syz [ 108.146839][ T5797] usb 2-1: SerialNumber: syz [ 108.218377][ T5797] usb 2-1: config 0 descriptor?? [ 108.225038][ T5844] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 108.225823][ T5844] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 108.262989][ T5797] usb 2-1: ucan: probing device on interface #0 [ 108.281234][ T5710] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 108.397015][ T5858] netlink: 762 bytes leftover after parsing attributes in process `syz.3.37'. [ 108.472013][ T5710] usb 3-1: Using ep0 maxpacket: 32 [ 108.474248][ T5710] usb 3-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 108.474281][ T5710] usb 3-1: config 0 interface 0 has no altsetting 0 [ 108.474316][ T5710] usb 3-1: New USB device found, idVendor=04f2, idProduct=1123, bcdDevice= 0.00 [ 108.474342][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.543524][ T5710] usb 3-1: config 0 descriptor?? [ 108.645492][ T5797] usb 2-1: ucan: device reported invalid device info [ 108.645515][ T5797] usb 2-1: ucan: probe failed; try to update the device firmware [ 108.889132][ T5797] usb 2-1: USB disconnect, device number 4 [ 109.091362][ T5868] syz.0.42 uses obsolete (PF_INET,SOCK_PACKET) [ 109.135525][ T5710] chicony 0003:04F2:1123.0001: unknown main item tag 0x0 [ 109.135564][ T5710] chicony 0003:04F2:1123.0001: unknown main item tag 0x0 [ 109.135590][ T5710] chicony 0003:04F2:1123.0001: unknown main item tag 0x0 [ 109.135617][ T5710] chicony 0003:04F2:1123.0001: unknown main item tag 0x0 [ 109.135650][ T5710] chicony 0003:04F2:1123.0001: collection stack underflow [ 109.135675][ T5710] chicony 0003:04F2:1123.0001: item 0 0 0 12 parsing failed [ 109.136484][ T5710] chicony 0003:04F2:1123.0001: Chicony hid parse failed: -22 [ 109.136564][ T5710] chicony 0003:04F2:1123.0001: probe with driver chicony failed with error -22 [ 109.178571][ T5865] syzkaller1: entered promiscuous mode [ 109.178654][ T5865] syzkaller1: entered allmulticast mode [ 109.271371][ T5710] usb 3-1: USB disconnect, device number 3 [ 109.970251][ T5878] netlink: 20 bytes leftover after parsing attributes in process `syz.2.45'. [ 109.998679][ T5880] netlink: 4 bytes leftover after parsing attributes in process `syz.3.46'. [ 110.848744][ T5903] capability: warning: `syz.2.56' uses deprecated v2 capabilities in a way that may be insecure [ 112.349948][ T5797] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 112.502233][ T5797] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 112.502268][ T5797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.547601][ T5797] usb 4-1: config 0 descriptor?? [ 112.570761][ T5797] cp210x 4-1:0.0: cp210x converter detected [ 112.689956][ T5710] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 112.853215][ T5710] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 112.853249][ T5710] usb 3-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 112.853276][ T5710] usb 3-1: config 1 interface 0 has no altsetting 0 [ 112.905690][ T5710] usb 3-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 112.905719][ T5710] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.905739][ T5710] usb 3-1: Product: syz [ 112.905753][ T5710] usb 3-1: Manufacturer: syz [ 112.905768][ T5710] usb 3-1: SerialNumber: syz [ 112.955730][ T5951] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 112.956252][ T5951] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 113.014870][ T5797] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 113.426123][ T5797] usb 4-1: cp210x converter now attached to ttyUSB0 [ 113.590110][ T5797] usb 4-1: USB disconnect, device number 2 [ 113.793718][ T5797] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 113.922344][ T5797] cp210x 4-1:0.0: device disconnected [ 114.006315][ T5710] (unnamed net_device) (uninitialized): Assigned a random MAC address: 96:ab:11:0a:2f:4a [ 114.124376][ T5710] rtl8150 3-1:1.0: eth1: rtl8150 is detected [ 114.148796][ T5710] usb 3-1: USB disconnect, device number 4 [ 114.481917][ T5598] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 114.640019][ T5598] usb 1-1: too many endpoints for config 0 interface 0 altsetting 4: 253, using maximum allowed: 30 [ 114.640066][ T5598] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 512, setting to 8 [ 114.640109][ T5598] usb 1-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 114.640137][ T5598] usb 1-1: config 0 interface 0 has no altsetting 0 [ 114.640170][ T5598] usb 1-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 114.640194][ T5598] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.783040][ T5598] usb 1-1: config 0 descriptor?? [ 114.784231][ T5973] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 114.855428][ T5988] faux_driver vkms: [drm] Unknown color mode 26898; guessing buffer size. [ 115.261778][ T5598] input: HID 28bd:0909 Mouse as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:28BD:0909.0002/input/input5 [ 115.431318][ T5992] ======================================================= [ 115.431318][ T5992] WARNING: The mand mount option has been deprecated and [ 115.431318][ T5992] and is ignored by this kernel. Remove the mand [ 115.431318][ T5992] option from the mount to silence this warning. [ 115.431318][ T5992] ======================================================= [ 115.532163][ T5992] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 115.808737][ T5598] uclogic 0003:28BD:0909.0002: input,hidraw0: USB HID v0.20 Mouse [HID 28bd:0909] on usb-dummy_hcd.0-1/input0 [ 115.899015][ T5598] usb 1-1: USB disconnect, device number 2 [ 115.907399][ T5992] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 115.907782][ T5992] overlayfs: failed to look up (tracing) for ino (-66) [ 116.102220][ T5999] syzkaller1: entered promiscuous mode [ 116.102248][ T5999] syzkaller1: entered allmulticast mode [ 116.103434][ T5997] fido_id[5997]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 116.427691][ T6003] netlink: 180 bytes leftover after parsing attributes in process `syz.1.99'. [ 117.045896][ T6015] input: syz0 as /devices/virtual/input/input6 [ 118.310003][ T6042] binder: 6040:6042 ioctl c0306201 200000001a80 returned -14 [ 118.598501][ T6058] syzkaller1: entered promiscuous mode [ 118.598530][ T6058] syzkaller1: entered allmulticast mode [ 118.610118][ T821] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 118.804240][ T821] usb 4-1: Using ep0 maxpacket: 32 [ 118.806420][ T821] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 118.806445][ T821] usb 4-1: config 0 has no interface number 0 [ 118.838069][ T821] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 118.838101][ T821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.838122][ T821] usb 4-1: Product: syz [ 118.838138][ T821] usb 4-1: Manufacturer: syz [ 118.838153][ T821] usb 4-1: SerialNumber: syz [ 118.902076][ T821] usb 4-1: config 0 descriptor?? [ 118.962214][ T821] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 119.012319][ T5775] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 119.164799][ T5775] usb 1-1: Using ep0 maxpacket: 16 [ 119.172759][ T5775] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 119.172814][ T5775] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 119.172844][ T5775] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 119.172868][ T5775] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 119.172893][ T5775] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 119.174542][ T5775] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 119.174571][ T5775] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 119.174592][ T5775] usb 1-1: Manufacturer: syz [ 119.325459][ T5775] usb 1-1: config 0 descriptor?? [ 119.560324][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 119.573924][ T821] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 119.642205][ T6083] process 'syz.2.125' launched './file0' with NULL argv: empty string added [ 119.644285][ T6083] Invalid argument reading file caps for ./file0 [ 119.695783][ T821] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 119.744213][ T821] usb 4-1: USB disconnect, device number 3 [ 119.884582][ T821] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 119.950036][ T5775] rc_core: IR keymap rc-hauppauge not found [ 119.950056][ T5775] Registered IR keymap rc-empty [ 119.951444][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 119.971335][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 119.998853][ T821] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 120.020952][ T5775] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 120.038681][ T821] quatech2 4-1:0.51: device disconnected [ 120.047681][ T5775] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input7 [ 120.076311][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.090173][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.110501][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.129970][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.150004][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.170327][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.190127][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.210263][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.229965][ T1717] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 120.229990][ T1717] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 120.230089][ T5616] Bluetooth: hci0: command 0x0c1a tx timeout [ 120.267233][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.280491][ T5775] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 120.422239][ T5775] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 120.422268][ T5775] mceusb 1-1:0.0: 2 tx ports (0x1 cabled) and 2 rx sensors (0x0 active) [ 120.535112][ T5775] usb 1-1: USB disconnect, device number 3 [ 120.829925][ T5710] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 120.999869][ T5710] usb 3-1: Using ep0 maxpacket: 8 [ 121.011180][ T5710] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 121.011334][ T5710] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 121.011399][ T5710] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 121.011472][ T5710] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 121.011537][ T5710] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.011676][ T5710] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 121.011738][ T5710] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.573431][ T6113] CUSE: unknown device info "fffffffff,wfdno" [ 121.573451][ T6113] CUSE: unknown device info "/dev/cuse" [ 121.573466][ T6113] CUSE: DEVNAME unspecified [ 121.656933][ T6116] vimc link validate: Sensor A:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 0:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 121.781878][ T6099] usbtmc 3-1:16.0: simple control status returned 0 [ 122.032614][ T10] usb 3-1: USB disconnect, device number 5 [ 122.422597][ T6140] Bluetooth: MGMT ver 1.23 [ 122.872081][ T1717] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 122.872106][ T1717] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 122.872465][ C1] ------------[ cut here ]------------ [ 122.872475][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci1 [ 122.872502][ C1] WARNING: kernel/workqueue.c:2298 at __queue_work+0xd67/0x1010, CPU#1: ktimers/1/30 [ 122.872537][ C1] Modules linked in: [ 122.872589][ C1] CPU: 1 UID: 0 PID: 30 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 122.872611][ C1] Tainted: [L]=SOFTLOCKUP [ 122.872616][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 122.872630][ C1] RIP: 0010:__queue_work+0xd87/0x1010 [ 122.872658][ C1] Code: 01 00 00 4c 8d 35 e9 f5 21 0e 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 0e a1 00 49 8b 75 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc [ 122.872671][ C1] RSP: 0018:ffffc90000a4f9b0 EFLAGS: 00010046 [ 122.872686][ C1] RAX: 1ffff1100b345153 RBX: 0000000000000008 RCX: ffff88801dec9ec0 [ 122.872698][ C1] RDX: ffff888035069968 RSI: ffffffff8a262610 RDI: ffffffff8faf77e0 [ 122.872712][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000100 [ 122.872723][ C1] R10: dffffc0000000000 R11: ffffffff818d8870 R12: dffffc0000000000 [ 122.872753][ C1] R13: ffff888059a28a98 R14: ffffffff8faf77e0 R15: ffff888035069968 [ 122.872767][ C1] FS: 0000000000000000(0000) GS:ffff888125dcf000(0000) knlGS:0000000000000000 [ 122.872782][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.872795][ C1] CR2: 0000001b3391dff8 CR3: 000000003c7e0000 CR4: 00000000003526f0 [ 122.872818][ C1] Call Trace: [ 122.872829][ C1] [ 122.872840][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 122.872875][ C1] call_timer_fn+0x192/0x5e0 [ 122.872894][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 122.872919][ C1] ? call_timer_fn+0xd4/0x5e0 [ 122.872936][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 122.872963][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 122.872988][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 122.873018][ C1] __run_timer_base+0x764/0x9f0 [ 122.873070][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 122.873110][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 122.873148][ C1] run_timer_softirq+0xb7/0x170 [ 122.873181][ C1] handle_softirqs+0x1de/0x6d0 [ 122.873217][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 122.873245][ C1] run_ktimerd+0x69/0x100 [ 122.873275][ C1] smpboot_thread_fn+0x541/0xa50 [ 122.873308][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 122.873348][ C1] kthread+0x388/0x470 [ 122.873393][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 122.873423][ C1] ? __pfx_kthread+0x10/0x10 [ 122.873458][ C1] ret_from_fork+0x514/0xb70 [ 122.873490][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 122.873518][ C1] ? __switch_to+0xc79/0x1410 [ 122.873545][ C1] ? __pfx_kthread+0x10/0x10 [ 122.873580][ C1] ret_from_fork_asm+0x1a/0x30 [ 122.873631][ C1] [ 122.873650][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 122.873670][ C1] CPU: 1 UID: 0 PID: 30 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 122.873701][ C1] Tainted: [L]=SOFTLOCKUP [ 122.873709][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 122.873722][ C1] Call Trace: [ 122.873730][ C1] [ 122.873739][ C1] vpanic+0x56c/0xa60 [ 122.873772][ C1] ? __pfx__printk+0x10/0x10 [ 122.873796][ C1] ? __pfx_vpanic+0x10/0x10 [ 122.873826][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 122.873859][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 122.873903][ C1] panic+0xc5/0xd0 [ 122.873935][ C1] ? __pfx_panic+0x10/0x10 [ 122.873979][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 122.874017][ C1] __warn+0x315/0x4c0 [ 122.874049][ C1] ? __queue_work+0xd67/0x1010 [ 122.874079][ C1] ? __queue_work+0xd67/0x1010 [ 122.874108][ C1] __report_bug+0x29a/0x540 [ 122.874143][ C1] ? call_timer_fn+0x192/0x5e0 [ 122.874162][ C1] ? __run_timer_base+0x764/0x9f0 [ 122.874192][ C1] ? run_timer_softirq+0xb7/0x170 [ 122.874230][ C1] ? __queue_work+0xd67/0x1010 [ 122.874259][ C1] ? __pfx___report_bug+0x10/0x10 [ 122.874294][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 122.874322][ C1] ? register_lock_class+0x31/0x2e0 [ 122.874361][ C1] ? __lock_acquire+0x6b5/0x2d10 [ 122.874404][ C1] report_bug_entry+0x19a/0x290 [ 122.874440][ C1] ? __queue_work+0xd87/0x1010 [ 122.874467][ C1] ? __queue_work+0xd8c/0x1010 [ 122.874501][ C1] handle_bug+0xce/0x200 [ 122.874529][ C1] exc_invalid_op+0x1a/0x50 [ 122.874556][ C1] asm_exc_invalid_op+0x1a/0x20 [ 122.874578][ C1] RIP: 0010:__queue_work+0xd87/0x1010 [ 122.874612][ C1] Code: 01 00 00 4c 8d 35 e9 f5 21 0e 4c 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ef e8 b3 0e a1 00 49 8b 75 00 4c 89 f7 4c 89 fa <67> 48 0f b9 3a 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc [ 122.874631][ C1] RSP: 0018:ffffc90000a4f9b0 EFLAGS: 00010046 [ 122.874651][ C1] RAX: 1ffff1100b345153 RBX: 0000000000000008 RCX: ffff88801dec9ec0 [ 122.874668][ C1] RDX: ffff888035069968 RSI: ffffffff8a262610 RDI: ffffffff8faf77e0 [ 122.874685][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000100 [ 122.874699][ C1] R10: dffffc0000000000 R11: ffffffff818d8870 R12: dffffc0000000000 [ 122.874716][ C1] R13: ffff888059a28a98 R14: ffffffff8faf77e0 R15: ffff888035069968 [ 122.874740][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 122.874774][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 122.874806][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 122.874843][ C1] call_timer_fn+0x192/0x5e0 [ 122.874866][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 122.874895][ C1] ? call_timer_fn+0xd4/0x5e0 [ 122.874916][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 122.874950][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 122.874979][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 122.875011][ C1] __run_timer_base+0x764/0x9f0 [ 122.875062][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 122.875102][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 122.875140][ C1] run_timer_softirq+0xb7/0x170 [ 122.875175][ C1] handle_softirqs+0x1de/0x6d0 [ 122.875214][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 122.875243][ C1] run_ktimerd+0x69/0x100 [ 122.875273][ C1] smpboot_thread_fn+0x541/0xa50 [ 122.875306][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 122.875347][ C1] kthread+0x388/0x470 [ 122.875387][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 122.875416][ C1] ? __pfx_kthread+0x10/0x10 [ 122.875452][ C1] ret_from_fork+0x514/0xb70 [ 122.875484][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 122.875513][ C1] ? __switch_to+0xc79/0x1410 [ 122.875540][ C1] ? __pfx_kthread+0x10/0x10 [ 122.875575][ C1] ret_from_fork_asm+0x1a/0x30 [ 122.875626][ C1] [ 122.876209][ C1] Kernel Offset: disabled