last executing test programs: 12.60862999s ago: executing program 3 (id=4): ioctl$VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) r0 = syz_usb_connect$cdc_ncm(0x1, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d130f0100000000000d000a0006471a010000190581"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) syz_usb_connect$midi(0x1, 0x24, &(0x7f0000002e40)=ANY=[], 0x0) 11.880167555s ago: executing program 0 (id=1): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) 10.95007998s ago: executing program 1 (id=2): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_open_procfs$pagemap(0x0, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, 0x0, 0x800) socket$unix(0x1, 0x1, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) accept4$bt_l2cap(r0, 0x0, 0x0, 0x800) 10.800255636s ago: executing program 0 (id=5): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f00000002c0)='tmpfs\x00', 0x0, &(0x7f0000000300)='usrquota') r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x4, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f00000003c0)='\x00', 0x1, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x20, @loopback, 0x1}, 0x1c) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x100) r1 = fsopen(&(0x7f00000003c0)='gfs2\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x28383, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(&(0x7f00000002c0)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='ext4\x00', 0x10, &(0x7f0000000100)='barrier') r3 = creat(0x0, 0x0) fadvise64(r3, 0x40003400000, 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x7, 0x20000000080, 0x0, 0x4, 0x4, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x400, 0xffffffffffffffff, 0x6, 0x4, 0xf, 0x4000000007d5}, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) sendmmsg$sock(r0, &(0x7f0000000700)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000640)="89", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)="c9", 0x1}], 0x1}}], 0x2, 0x4) shutdown(r0, 0x1) lchown(&(0x7f00000000c0)='./file1\x00', 0xee01, 0x0) fchownat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xee00, 0x0, 0x100) 10.799518177s ago: executing program 2 (id=3): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400070000000900020073797a3100000000050005000200000011000300686173683a69702c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)={0x54, 0x9, 0x6, 0x801, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) syz_usb_connect$hid(0x4, 0x0, 0x0, 0x0) 7.448400611s ago: executing program 3 (id=6): pipe2$watch_queue(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1048001, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x2, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r2 = open(&(0x7f0000000000)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r1, 0xc0189379, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r3, 0xc018937d, 0x0) 5.625932917s ago: executing program 1 (id=7): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) ptrace$poke(0x4, r0, &(0x7f0000000380), 0x917) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TCFLSH(r4, 0x400455c8, 0x2) 5.625704698s ago: executing program 2 (id=8): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)={0x0, 0x20, 0x0, 0x81, 0xfffffffb}) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r0, 0x3b87, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x1}) 4.41113505s ago: executing program 3 (id=9): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) syz_emit_vhci(&(0x7f0000000380)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x8}, @hci_rp_read_auth_payload_to={{}, {0x1, 0xc8, 0x81}}}}, 0xb) 4.329982923s ago: executing program 2 (id=10): r0 = gettid() rt_sigtimedwait(&(0x7f0000000080)={[0x3ff]}, 0xfffffffffffffffc, 0x0, 0x8) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) tkill(r0, 0x7) getpid() 4.286773006s ago: executing program 0 (id=11): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000100)={'full', 0x20, 0xf, 0x20, 0x8001}, 0x2f) 4.164156141s ago: executing program 1 (id=12): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) 3.410219034s ago: executing program 0 (id=13): syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0xc854}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) epoll_create(0x5) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) sendmsg$NL80211_CMD_RELOAD_REGDB(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x14, r3, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) 2.206680403s ago: executing program 1 (id=14): r0 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) syz_open_dev$vbi(&(0x7f0000000100), 0x0, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1.969539227s ago: executing program 0 (id=15): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) r2 = syz_open_pts(0xffffffffffffffff, 0x0) r3 = dup3(r2, 0xffffffffffffffff, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000000c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) syz_usb_connect(0x1, 0x2d, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r5 = epoll_create(0x80) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000240)={0x130000000}) madvise(&(0x7f0000a58000/0x2000)=nil, 0x2000, 0x16) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 1.180701379s ago: executing program 1 (id=16): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x4d) socket$inet6_sctp(0xa, 0x1, 0x84) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_type(r1, &(0x7f0000000140), 0x2, 0x0) mkdirat$cgroup(r1, &(0x7f0000000340)='syz0\x00', 0x1ff) write$cgroup_type(r2, &(0x7f0000000180), 0x9) 969.476103ms ago: executing program 3 (id=17): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x2006}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x6, @ipv4={'\x00', '\xff\xff', @empty}, 0x4c}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='vlan0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f00000067c0)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000180)="c86ef4", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000004d40)=[{&(0x7f00000038c0)="e1", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000006580)=[{&(0x7f0000005180)}], 0x1}}], 0x3, 0x4040000) 751.406082ms ago: executing program 1 (id=18): syz_usb_connect(0x2, 0x3f, &(0x7f0000000340)=ANY=[@ANYBLOB="120110012cae9308da040d39dffa0102030109022d0001c94080010904f90403c0da26ff0905f10f40000300bf09050300ff0305"], 0x0) 699.69826ms ago: executing program 3 (id=19): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001000)={{0x14}, [@NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x38, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x80}}, 0x0) 511.56343ms ago: executing program 2 (id=20): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x28b, 0xfff, 0xa}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000000)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000340)={0x3, r1, 0xfffffffa, 0x4, 0xb, 0x1fd, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000001880)={0x3, r1, 0xfff, 0x3ff, 0x9, 0x944}) 0s ago: executing program 3 (id=21): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x8, 0xfe, 0x7fff0006}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000340)={0xe939, r1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000004c0)={0x0, 0x0, r3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) r6 = dup2(r4, r5) close_range(r6, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.41' (ED25519) to the list of known hosts. [ 79.076532][ T5593] cgroup: Unknown subsys name 'net' [ 79.316319][ T5593] cgroup: Unknown subsys name 'cpuset' [ 79.371781][ T5593] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 81.200917][ T5593] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.742119][ T5610] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.763100][ T5618] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.779812][ T5615] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.812997][ T5618] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.814450][ T5615] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.818091][ T5615] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.818784][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.822663][ T5615] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.826233][ T5615] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.831933][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.833018][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.838314][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 83.840770][ T5619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.850032][ T5619] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.859411][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.860107][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.887468][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.939277][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.961904][ T4923] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.963111][ T5619] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.979844][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.980081][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.980315][ T5605] bridge_slave_0: entered allmulticast mode [ 85.989788][ T5605] bridge_slave_0: entered promiscuous mode [ 86.006264][ T5610] Bluetooth: hci0: command tx timeout [ 86.006890][ T5612] Bluetooth: hci3: command tx timeout [ 86.064669][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.064864][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.065035][ T5605] bridge_slave_1: entered allmulticast mode [ 86.067216][ T5605] bridge_slave_1: entered promiscuous mode [ 86.081480][ T5610] Bluetooth: hci1: command tx timeout [ 86.081897][ T5612] Bluetooth: hci2: command tx timeout [ 86.115799][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.116011][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.116175][ T5607] bridge_slave_0: entered allmulticast mode [ 86.118270][ T5607] bridge_slave_0: entered promiscuous mode [ 86.120528][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.120846][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.122827][ T5606] bridge_slave_0: entered allmulticast mode [ 86.171565][ T5606] bridge_slave_0: entered promiscuous mode [ 86.211323][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.211615][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.211844][ T5607] bridge_slave_1: entered allmulticast mode [ 86.215586][ T5607] bridge_slave_1: entered promiscuous mode [ 86.217451][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.217643][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.217799][ T5606] bridge_slave_1: entered allmulticast mode [ 86.219918][ T5606] bridge_slave_1: entered promiscuous mode [ 86.280634][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.280928][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.288408][ T5608] bridge_slave_0: entered allmulticast mode [ 86.298713][ T5608] bridge_slave_0: entered promiscuous mode [ 86.348539][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.348937][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.349262][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.349508][ T5608] bridge_slave_1: entered allmulticast mode [ 86.355884][ T5608] bridge_slave_1: entered promiscuous mode [ 86.425404][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.496551][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.507268][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.557059][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.560818][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.599433][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.640179][ T5605] team0: Port device team_slave_0 added [ 86.650484][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.696819][ T5605] team0: Port device team_slave_1 added [ 86.720694][ T5607] team0: Port device team_slave_0 added [ 86.731813][ T5606] team0: Port device team_slave_0 added [ 86.794771][ T5607] team0: Port device team_slave_1 added [ 86.799632][ T5606] team0: Port device team_slave_1 added [ 86.845545][ T5608] team0: Port device team_slave_0 added [ 86.904724][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.904740][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.904765][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.923774][ T5608] team0: Port device team_slave_1 added [ 86.998614][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.998637][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.998662][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.052592][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.052608][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.052640][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.057303][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.057317][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.057342][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.168219][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.168235][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.168262][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.170927][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.170939][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.171885][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.212972][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.213011][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.213080][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.313661][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.313677][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.313702][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.467362][ T5605] hsr_slave_0: entered promiscuous mode [ 87.470786][ T5605] hsr_slave_1: entered promiscuous mode [ 87.539733][ T5607] hsr_slave_0: entered promiscuous mode [ 87.546964][ T5607] hsr_slave_1: entered promiscuous mode [ 87.548149][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 87.548222][ T5607] Cannot create hsr debugfs directory [ 87.570276][ T5606] hsr_slave_0: entered promiscuous mode [ 87.575333][ T5606] hsr_slave_1: entered promiscuous mode [ 87.579624][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 87.579703][ T5606] Cannot create hsr debugfs directory [ 87.915592][ T5608] hsr_slave_0: entered promiscuous mode [ 87.918374][ T5608] hsr_slave_1: entered promiscuous mode [ 87.919935][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 87.919953][ T5608] Cannot create hsr debugfs directory [ 88.081308][ T5610] Bluetooth: hci0: command tx timeout [ 88.081407][ T5612] Bluetooth: hci3: command tx timeout [ 88.171197][ T5610] Bluetooth: hci1: command tx timeout [ 88.171279][ T5612] Bluetooth: hci2: command tx timeout [ 88.717491][ T5605] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.772994][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.789095][ T5605] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.825433][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.835269][ T5605] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.878347][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.903206][ T5605] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.926505][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.064450][ T5606] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.105981][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.108522][ T5606] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.133057][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.145582][ T5606] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.185855][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.216504][ T5606] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.246213][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.381728][ T5607] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.428328][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.433016][ T5607] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.465166][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.488036][ T5607] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.526986][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.555992][ T5607] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.595272][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.724036][ T5608] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.756033][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.760116][ T5608] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.798241][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.817954][ T5608] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.855640][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.859458][ T5608] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.880342][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.972607][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.078645][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.126028][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.149447][ T1368] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.149814][ T1368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.161504][ T5610] Bluetooth: hci0: command tx timeout [ 90.161618][ T5612] Bluetooth: hci3: command tx timeout [ 90.219902][ T1350] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.220058][ T1350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.243413][ T5610] Bluetooth: hci1: command tx timeout [ 90.243518][ T5612] Bluetooth: hci2: command tx timeout [ 90.303490][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.344717][ T1350] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.344859][ T1350] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.383477][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.414559][ T1350] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.414690][ T1350] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.526343][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.548195][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.588473][ T1368] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.588636][ T1368] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.700245][ T1304] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.700401][ T1304] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.808757][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.902828][ T2291] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.904729][ T2291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.972057][ T2291] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.972725][ T2291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.727182][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.032171][ T32] cfg80211: failed to load regulatory.db [ 92.210877][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.242890][ T5610] Bluetooth: hci0: command tx timeout [ 92.242939][ T5612] Bluetooth: hci3: command tx timeout [ 92.264240][ T5605] veth0_vlan: entered promiscuous mode [ 92.323371][ T5610] Bluetooth: hci1: command tx timeout [ 92.323426][ T5612] Bluetooth: hci2: command tx timeout [ 92.329360][ T5605] veth1_vlan: entered promiscuous mode [ 92.408614][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.574874][ T5605] veth0_macvtap: entered promiscuous mode [ 92.592694][ T5606] veth0_vlan: entered promiscuous mode [ 92.603154][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.622759][ T5605] veth1_macvtap: entered promiscuous mode [ 92.687048][ T5606] veth1_vlan: entered promiscuous mode [ 92.732524][ T5607] veth0_vlan: entered promiscuous mode [ 92.752496][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.789514][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.806434][ T5607] veth1_vlan: entered promiscuous mode [ 92.838340][ T1350] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.875512][ T1350] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.894237][ T1350] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.910783][ T1350] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.993427][ T5606] veth0_macvtap: entered promiscuous mode [ 93.004469][ T5608] veth0_vlan: entered promiscuous mode [ 93.065579][ T5606] veth1_macvtap: entered promiscuous mode [ 93.209920][ T5608] veth1_vlan: entered promiscuous mode [ 93.277993][ T5607] veth0_macvtap: entered promiscuous mode [ 93.311890][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.330563][ T5607] veth1_macvtap: entered promiscuous mode [ 93.374463][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.454119][ T1304] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.473919][ T1304] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.500887][ T1304] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.506846][ T1368] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.506904][ T1368] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.541963][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.580366][ T1304] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.601731][ T5608] veth0_macvtap: entered promiscuous mode [ 93.640262][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.701583][ T5608] veth1_macvtap: entered promiscuous mode [ 93.809320][ T827] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.810208][ T805] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.810225][ T805] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.850323][ T827] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.892101][ T827] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.957117][ T1350] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.125843][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.212943][ T2291] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.212963][ T2291] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.311309][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.374369][ T1304] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.394623][ T1304] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.406451][ T1304] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.423979][ T1304] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.817934][ T1350] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.817952][ T1350] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.936861][ T159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.936883][ T159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.121868][ T5595] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 95.206507][ T1350] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.206526][ T1350] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.292452][ T159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.292473][ T159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.413439][ T5595] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 95.413467][ T5595] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 95.413519][ T5595] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 8 [ 95.413562][ T5595] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 95.413584][ T5595] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.526888][ T805] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.526910][ T805] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.596582][ T5763] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 95.863395][ T5595] hub 4-1:1.0: bad descriptor, ignoring hub [ 95.863434][ T5595] hub 4-1:1.0: probe with driver hub failed with error -5 [ 95.902033][ T5595] cdc_wdm 4-1:1.0: skipping garbage [ 95.902055][ T5595] cdc_wdm 4-1:1.0: skipping garbage [ 95.902065][ T5595] cdc_wdm 4-1:1.0: skipping garbage [ 96.075730][ T5595] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 96.075766][ T5595] cdc_wdm 4-1:1.0: Unknown control protocol [ 97.393193][ T5780] EXT4-fs (nullb0): VFS: Can't find ext4 filesystem [ 98.510994][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 98.710759][ T5595] usb 4-1: reset low-speed USB device number 2 using dummy_hcd [ 101.267921][ T5781] Set syz1 is full, maxelem 65536 reached [ 101.534437][ T5595] usb 4-1: USB disconnect, device number 2 [ 101.871003][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.721021][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.741014][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.751008][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 105.761023][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 106.755173][ T5704] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 106.919800][ T5704] usb 2-1: config 201 has an invalid interface number: 249 but max is 0 [ 106.919826][ T5704] usb 2-1: config 201 has an invalid descriptor of length 0, skipping remainder of the config [ 106.919845][ T5704] usb 2-1: config 201 has no interface number 0 [ 106.919893][ T5704] usb 2-1: config 201 interface 249 altsetting 4 has an endpoint descriptor with address 0xF1, changing to 0x81 [ 106.919920][ T5704] usb 2-1: config 201 interface 249 altsetting 4 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 106.919946][ T5704] usb 2-1: config 201 interface 249 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 106.919971][ T5704] usb 2-1: config 201 interface 249 has no altsetting 0 [ 106.937552][ T5704] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=fa.df [ 106.937581][ T5704] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.937601][ T5704] usb 2-1: Product: syz [ 106.937615][ T5704] usb 2-1: Manufacturer: syz [ 106.937629][ T5704] usb 2-1: SerialNumber: syz [ 107.427955][ T5704] ------------[ cut here ]------------ [ 107.427977][ T5704] workqueue: ath6kl_wq is using neither WQ_PERCPU or WQ_UNBOUND. Setting WQ_PERCPU. [ 107.427993][ T5704] WARNING: kernel/workqueue.c:5856 at __alloc_workqueue+0x1d02/0x2070, CPU#1: kworker/1:5/5704 [ 107.428035][ T5704] Modules linked in: [ 107.428069][ T5704] CPU: 1 UID: 0 PID: 5704 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.428094][ T5704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 107.428108][ T5704] Workqueue: usb_hub_wq hub_event [ 107.428141][ T5704] RIP: 0010:__alloc_workqueue+0x1d07/0x2070 [ 107.428169][ T5704] Code: e9 36 f9 ff ff e8 89 8a 37 00 e9 05 fb ff ff e8 7f 8a 37 00 e9 92 fb ff ff e8 75 8a 37 00 48 8d 3d ee ff 43 0e 48 8b 74 24 20 <67> 48 0f b9 3a 81 cd 00 01 00 00 e9 88 e5 ff ff e8 54 8a 37 00 48 [ 107.428187][ T5704] RSP: 0018:ffffc9000519ebc8 EFLAGS: 00010283 [ 107.428206][ T5704] RAX: ffffffff818e412b RBX: 0000000000000000 RCX: 0000000000100000 [ 107.428220][ T5704] RDX: ffffc90018ddb000 RSI: ffff88803d2c3568 RDI: ffffffff8fd24120 [ 107.428236][ T5704] RBP: 0000000000000000 R08: ffff8880395f3e00 R09: 0000000000000002 [ 107.428251][ T5704] R10: 0000000000000100 R11: 0000000000000102 R12: dffffc0000000000 [ 107.428265][ T5704] R13: ffff88803d2c3400 R14: ffffc9000519ece0 R15: 0000000000000000 [ 107.428280][ T5704] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 107.428297][ T5704] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.428312][ T5704] CR2: 000000110c250213 CR3: 0000000035024000 CR4: 00000000003526f0 [ 107.428330][ T5704] Call Trace: [ 107.428342][ T5704] [ 107.428369][ T5704] alloc_workqueue_noprof+0xe3/0x210 [ 107.428404][ T5704] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 107.428434][ T5704] ? __kmalloc_cache_noprof+0x3d0/0x6d0 [ 107.428459][ T5704] ? ath6kl_usb_probe+0x8e/0x1580 [ 107.428503][ T5704] ath6kl_usb_probe+0xaa/0x1580 [ 107.428543][ T5704] ? usb_unlocked_disable_lpm+0x8c/0xb0 [ 107.428578][ T5704] usb_probe_interface+0x659/0xc70 [ 107.428620][ T5704] ? __pfx_usb_probe_interface+0x10/0x10 [ 107.428649][ T5704] really_probe+0x267/0xaf0 [ 107.428685][ T5704] __driver_probe_device+0x1e2/0x350 [ 107.428718][ T5704] driver_probe_device+0x4f/0x240 [ 107.428751][ T5704] __device_attach_driver+0x270/0x410 [ 107.428786][ T5704] bus_for_each_drv+0x25b/0x2f0 [ 107.428808][ T5704] ? __pfx___device_attach_driver+0x10/0x10 [ 107.428838][ T5704] ? __pfx_bus_for_each_drv+0x10/0x10 [ 107.428860][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.428890][ T5704] __device_attach+0x2c8/0x450 [ 107.428922][ T5704] ? __pfx___device_attach+0x10/0x10 [ 107.428951][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.428989][ T5704] device_initial_probe+0xa1/0xd0 [ 107.429020][ T5704] bus_probe_device+0x12d/0x220 [ 107.429045][ T5704] device_add+0x7ec/0xb90 [ 107.429075][ T5704] usb_set_configuration+0x1a87/0x2110 [ 107.429132][ T5704] usb_generic_driver_probe+0x8d/0x150 [ 107.429161][ T5704] usb_probe_device+0x1c4/0x3b0 [ 107.429192][ T5704] ? __pfx_usb_probe_device+0x10/0x10 [ 107.429218][ T5704] really_probe+0x267/0xaf0 [ 107.429254][ T5704] __driver_probe_device+0x1e2/0x350 [ 107.429285][ T5704] driver_probe_device+0x4f/0x240 [ 107.429318][ T5704] __device_attach_driver+0x270/0x410 [ 107.429351][ T5704] bus_for_each_drv+0x25b/0x2f0 [ 107.429372][ T5704] ? __pfx___device_attach_driver+0x10/0x10 [ 107.429402][ T5704] ? __pfx_bus_for_each_drv+0x10/0x10 [ 107.429423][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.429451][ T5704] __device_attach+0x2c8/0x450 [ 107.429481][ T5704] ? __pfx___device_attach+0x10/0x10 [ 107.429508][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.429536][ T5704] device_initial_probe+0xa1/0xd0 [ 107.429566][ T5704] bus_probe_device+0x12d/0x220 [ 107.429591][ T5704] device_add+0x7ec/0xb90 [ 107.429620][ T5704] usb_new_device+0x9f8/0x16e0 [ 107.429654][ T5704] ? __pfx_usb_new_device+0x10/0x10 [ 107.429686][ T5704] hub_event+0x2a49/0x4f60 [ 107.429762][ T5704] ? __pfx_hub_event+0x10/0x10 [ 107.429798][ T5704] ? process_one_work+0x8be/0x1630 [ 107.429841][ T5704] ? process_one_work+0x8be/0x1630 [ 107.429870][ T5704] process_one_work+0x98b/0x1630 [ 107.429920][ T5704] ? __pfx_process_one_work+0x10/0x10 [ 107.429948][ T5704] ? do_raw_spin_lock+0x12b/0x2f0 [ 107.429995][ T5704] worker_thread+0xb49/0x1140 [ 107.430036][ T5704] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 107.430094][ T5704] kthread+0x388/0x470 [ 107.430119][ T5704] ? __pfx_worker_thread+0x10/0x10 [ 107.430151][ T5704] ? __pfx_kthread+0x10/0x10 [ 107.430177][ T5704] ret_from_fork+0x514/0xb70 [ 107.430208][ T5704] ? __pfx_ret_from_fork+0x10/0x10 [ 107.430235][ T5704] ? __switch_to+0xc79/0x1410 [ 107.430259][ T5704] ? __pfx_kthread+0x10/0x10 [ 107.430285][ T5704] ret_from_fork_asm+0x1a/0x30 [ 107.430332][ T5704] [ 107.430343][ T5704] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 107.430359][ T5704] CPU: 1 UID: 0 PID: 5704 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.430383][ T5704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 107.430397][ T5704] Workqueue: usb_hub_wq hub_event [ 107.430424][ T5704] Call Trace: [ 107.430432][ T5704] [ 107.430440][ T5704] vpanic+0x56c/0xa60 [ 107.430473][ T5704] ? __pfx__printk+0x10/0x10 [ 107.430496][ T5704] ? __pfx_vpanic+0x10/0x10 [ 107.430525][ T5704] ? is_bpf_text_address+0x292/0x2b0 [ 107.430557][ T5704] ? is_bpf_text_address+0x26/0x2b0 [ 107.430598][ T5704] panic+0xc5/0xd0 [ 107.430629][ T5704] ? __pfx_panic+0x10/0x10 [ 107.430670][ T5704] ? ret_from_fork_asm+0x1a/0x30 [ 107.430705][ T5704] __warn+0x315/0x4c0 [ 107.430734][ T5704] ? __alloc_workqueue+0x1d02/0x2070 [ 107.430762][ T5704] ? __alloc_workqueue+0x1d02/0x2070 [ 107.430788][ T5704] __report_bug+0x339/0x540 [ 107.430815][ T5704] ? __device_attach+0x2c8/0x450 [ 107.430842][ T5704] ? device_initial_probe+0xa1/0xd0 [ 107.430868][ T5704] ? bus_probe_device+0x12d/0x220 [ 107.430893][ T5704] ? __alloc_workqueue+0x1d02/0x2070 [ 107.430919][ T5704] ? __pfx___report_bug+0x10/0x10 [ 107.430945][ T5704] ? device_add+0x7ec/0xb90 [ 107.431013][ T5704] report_bug_entry+0x19a/0x290 [ 107.431044][ T5704] ? __alloc_workqueue+0x1d07/0x2070 [ 107.431067][ T5704] ? __alloc_workqueue+0x1d0c/0x2070 [ 107.431091][ T5704] handle_bug+0xce/0x200 [ 107.431121][ T5704] exc_invalid_op+0x1a/0x50 [ 107.431151][ T5704] asm_exc_invalid_op+0x1a/0x20 [ 107.431172][ T5704] RIP: 0010:__alloc_workqueue+0x1d07/0x2070 [ 107.431198][ T5704] Code: e9 36 f9 ff ff e8 89 8a 37 00 e9 05 fb ff ff e8 7f 8a 37 00 e9 92 fb ff ff e8 75 8a 37 00 48 8d 3d ee ff 43 0e 48 8b 74 24 20 <67> 48 0f b9 3a 81 cd 00 01 00 00 e9 88 e5 ff ff e8 54 8a 37 00 48 [ 107.431216][ T5704] RSP: 0018:ffffc9000519ebc8 EFLAGS: 00010283 [ 107.431234][ T5704] RAX: ffffffff818e412b RBX: 0000000000000000 RCX: 0000000000100000 [ 107.431250][ T5704] RDX: ffffc90018ddb000 RSI: ffff88803d2c3568 RDI: ffffffff8fd24120 [ 107.431266][ T5704] RBP: 0000000000000000 R08: ffff8880395f3e00 R09: 0000000000000002 [ 107.431280][ T5704] R10: 0000000000000100 R11: 0000000000000102 R12: dffffc0000000000 [ 107.431294][ T5704] R13: ffff88803d2c3400 R14: ffffc9000519ece0 R15: 0000000000000000 [ 107.431318][ T5704] ? __alloc_workqueue+0x1cfb/0x2070 [ 107.431351][ T5704] ? __alloc_workqueue+0x1cfb/0x2070 [ 107.431392][ T5704] alloc_workqueue_noprof+0xe3/0x210 [ 107.431425][ T5704] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 107.431455][ T5704] ? __kmalloc_cache_noprof+0x3d0/0x6d0 [ 107.431480][ T5704] ? ath6kl_usb_probe+0x8e/0x1580 [ 107.431521][ T5704] ath6kl_usb_probe+0xaa/0x1580 [ 107.431561][ T5704] ? usb_unlocked_disable_lpm+0x8c/0xb0 [ 107.431595][ T5704] usb_probe_interface+0x659/0xc70 [ 107.431637][ T5704] ? __pfx_usb_probe_interface+0x10/0x10 [ 107.431664][ T5704] really_probe+0x267/0xaf0 [ 107.431701][ T5704] __driver_probe_device+0x1e2/0x350 [ 107.431733][ T5704] driver_probe_device+0x4f/0x240 [ 107.431766][ T5704] __device_attach_driver+0x270/0x410 [ 107.431800][ T5704] bus_for_each_drv+0x25b/0x2f0 [ 107.431822][ T5704] ? __pfx___device_attach_driver+0x10/0x10 [ 107.431853][ T5704] ? __pfx_bus_for_each_drv+0x10/0x10 [ 107.431874][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.431904][ T5704] __device_attach+0x2c8/0x450 [ 107.431934][ T5704] ? __pfx___device_attach+0x10/0x10 [ 107.431971][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.432000][ T5704] device_initial_probe+0xa1/0xd0 [ 107.432030][ T5704] bus_probe_device+0x12d/0x220 [ 107.432056][ T5704] device_add+0x7ec/0xb90 [ 107.432085][ T5704] usb_set_configuration+0x1a87/0x2110 [ 107.432141][ T5704] usb_generic_driver_probe+0x8d/0x150 [ 107.432170][ T5704] usb_probe_device+0x1c4/0x3b0 [ 107.432201][ T5704] ? __pfx_usb_probe_device+0x10/0x10 [ 107.432227][ T5704] really_probe+0x267/0xaf0 [ 107.432263][ T5704] __driver_probe_device+0x1e2/0x350 [ 107.432296][ T5704] driver_probe_device+0x4f/0x240 [ 107.432329][ T5704] __device_attach_driver+0x270/0x410 [ 107.432364][ T5704] bus_for_each_drv+0x25b/0x2f0 [ 107.432387][ T5704] ? __pfx___device_attach_driver+0x10/0x10 [ 107.432418][ T5704] ? __pfx_bus_for_each_drv+0x10/0x10 [ 107.432439][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.432468][ T5704] __device_attach+0x2c8/0x450 [ 107.432498][ T5704] ? __pfx___device_attach+0x10/0x10 [ 107.432526][ T5704] ? rt_spin_unlock+0x160/0x200 [ 107.432554][ T5704] device_initial_probe+0xa1/0xd0 [ 107.432584][ T5704] bus_probe_device+0x12d/0x220 [ 107.432609][ T5704] device_add+0x7ec/0xb90 [ 107.432639][ T5704] usb_new_device+0x9f8/0x16e0 [ 107.432673][ T5704] ? __pfx_usb_new_device+0x10/0x10 [ 107.432705][ T5704] hub_event+0x2a49/0x4f60 [ 107.432782][ T5704] ? __pfx_hub_event+0x10/0x10 [ 107.432807][ T5704] ? process_one_work+0x8be/0x1630 [ 107.432850][ T5704] ? process_one_work+0x8be/0x1630 [ 107.432880][ T5704] process_one_work+0x98b/0x1630 [ 107.432934][ T5704] ? __pfx_process_one_work+0x10/0x10 [ 107.432970][ T5704] ? do_raw_spin_lock+0x12b/0x2f0 [ 107.433013][ T5704] worker_thread+0xb49/0x1140 [ 107.433055][ T5704] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 107.433098][ T5704] kthread+0x388/0x470 [ 107.433122][ T5704] ? __pfx_worker_thread+0x10/0x10 [ 107.433153][ T5704] ? __pfx_kthread+0x10/0x10 [ 107.433179][ T5704] ret_from_fork+0x514/0xb70 [ 107.433208][ T5704] ? __pfx_ret_from_fork+0x10/0x10 [ 107.433234][ T5704] ? __switch_to+0xc79/0x1410 [ 107.433258][ T5704] ? __pfx_kthread+0x10/0x10 [ 107.433284][ T5704] ret_from_fork_asm+0x1a/0x30 [ 107.433330][ T5704] [ 107.433930][ T5704] Kernel Offset: disabled