last executing test programs: 7m20.993212508s ago: executing program 4 (id=95): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) listen(r1, 0x5) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xa, 0x4, 0x8, 0xc}, 0x50) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0xa, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) 7m17.506159763s ago: executing program 4 (id=102): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB='+'], 0x6) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3000005, 0x10012, r0, 0xf7ffe000) 7m15.10519608s ago: executing program 4 (id=105): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x3, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7m13.357883835s ago: executing program 4 (id=111): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, 0xffffffffffffffff, 0x852ac000) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x2, 0x0, 0x10001, 0x5}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/sda\x00', 0x2, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000140)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f00000001c0)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/fscaps', 0x2242, 0x2e57e0095982a425) 7m8.935086448s ago: executing program 4 (id=121): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0x3, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7m7.895836014s ago: executing program 4 (id=125): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x80000, 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x802c550a, 0x0) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550d, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0x2, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x6}, @empty, @private=0xa010101, 0xff000000, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380", 0xb}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360fcbe079ca4e62ef0675c1063", 0x17}], 0x2) 6m52.470688366s ago: executing program 32 (id=125): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x80000, 0x0) ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x802c550a, 0x0) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4008550d, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0x2, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x6}, @empty, @private=0xa010101, 0xff000000, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380", 0xb}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360fcbe079ca4e62ef0675c1063", 0x17}], 0x2) 6m47.91116134s ago: executing program 2 (id=154): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000f40)={0x1c, r0, 0x703, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044004}, 0x4040800) 6m47.148415772s ago: executing program 2 (id=157): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r1, r3, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000680)=ANY=[], 0x0) 6m45.390418532s ago: executing program 2 (id=161): ioctl$TCSETA(0xffffffffffffffff, 0x4b6a, &(0x7f00000006c0)={0x2208, 0x5, 0x1, 0x0, 0x15, "0400"}) 6m45.178073128s ago: executing program 2 (id=162): r0 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x69ee, 0xc00, 0x5, 0x50}, &(0x7f0000000100)=0x0, 0x0, &(0x7f0000000180)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, 0x0, r4, &(0x7f0000000000)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x0, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x4d2c11947fe9151f, {0x0, r5}}) syz_ublk_setup_queues(r0, 0x0, &(0x7f0000019080)={0x0, 0x597f, 0x1, 0x2, 0x10d, 0x0, r0}, &(0x7f0000019180)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2067, 0x8000, 0x3, 0x17, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xce5e, 0x10, 0x2, 0x2c4, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xecae, 0x200, 0x3, 0x11a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88d9, 0x800, 0x0, 0x3bd, 0x0, r0}}], 0x4, &(0x7f000001a400)={0x2e, 0x20, 0x0, r0, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x44}, 0x0, r5, '\x00', {0x4, 0x32d, 0x0, &(0x7f0000019400)=@buf_max_buf="b0fb58040bb07b7d1ee31befb1a9c82b8b94b13ccad093b25e4e67271f1ce61c7597474efad88c32752351722ccd68ab62cb6ccf4320f55392cdacce5b34e13739a6bc0459a4f5e2a125ff4a0eacb23b814cc828549ece314357f220a2621d1b0e5b7535decd83a79e837001f52e0774c18ae82664f3429754c1cfb0e9c8967ccf0f7ddc8e8c9a2905e2cc32f8a2709552fee4598461d5d756c0abb562e76b86011c1d376b26c29f9ff9afd1cb42145a436f2e9f714f1abb823fe2bbc983d48a16f46dd9ee3c3b06f043c4c374e843650c2b3921625e17de76d87460dbc1f002b2f9eafb84197ca694a87dfa8122dcef40cd6020ccb781db5730f8a11ac91d1d3341b75cbffb661550bf510f62a10975fc6d5ff708f1f2194a859db765d9560e85bdf12a324f27d7db0c01cb7d7a3363c7166515b0424fa8dba0aaa8653200fc33a9ad7a6b9dc0a200a98a2fbd84ad8888be5537fa414471e7e0b4e000f1ac3ba6a1b13b7f57413347de3ddc0595b9d2ddde0b4b5613005d1e8f8949e3b0fdf9343b3c5641c6ab16d5df9b8db9320446e33aa62fe072a0d6f3d22457a5ee3cea0f7ef65330d02eb093b157a5b9f22ecacb178dc1fb510caefa0987070b8e9a5488f815bdeb8cfbc9a366f2dbfbd1260b842455eae1e3ac4e242aab62c245d19b369b03b5ca2e415d4971da353c747cc1430d165ffcba118c14944f991aa16ce219b4fbc6a5d960713424a4bcf90d6baf96e4685d8de3560c1b60141ff32160460cac60f009c8c3b06b6f3ba6349cd39dc12e5223b684d0a6dad20619a7a1d5c73558f90a222d9458b07bed1f9f6df9a35965c7b44c0c05680f88d06af60e195e83e0c360e776bf635403d0658ac81d38d057de7c0b1309a082af055df9ebb22e69242d0624e34575816f02b5174b5c60c4a10a8076371a3de382aef6c19b693dec9f3f00d4d65441fcf31d33035829bd37d7a64bf2fe02710786d1fa07d60d3c25414c6c8e7ff9ab326b0a7c3613025cde711f79b02e234f8b7217dca4924df51b0201e4777c0cb130f15ca30432da24991af58817a005971ef4263d1ca8fb7edd61448185bf59b086c4651bdb2ffbaf5147546d15bf94e3b016e06d3fce9781a303bd579ac8e9464fdf23890736866d7246cdc34f21a73a88dfd01768249f8596ab29d73c322a654f58cd883b839016949579c6c2a409eb89a81c07e9bc8b2de510c186afb32155286197330b008316cbe3d8cb52d98f09e8f2bb353fe0d6a2f5c28110cc33eae5ad837b82d82d4e7a45cf3ade48738c20162b1867e818478f09721b751e37da1be76eb16c7b6f23f2fc42d73a4219483c22b0d31d24b094cf5ee81325a3343249504563d690c0a9ea1a318ca27f8edc183abcb4ed2d340c37971bc760405c45f82f2600d00fa8d83130c232e1561752008354480291401de9a2906e255846519948769ae02f4a72c7956b2240d3926d54b90dcc71a9768384a8660440f911893849a3f2db3e65da1ca6f9ee9f3a46160e71fa41e6ced8d2bc0875fb98f1907ff1ab63140c8ce4e6e393ad0b26914ebf3ff99ef1e829a865a9cb905c1e9f22153d102d641615546c21114d6d4f6a05bf3cb63d808b546c4790c22bd4e294168afa792498efd2137e97d048e538959cd9c5b8b39d2223adf484d33fda5c0bdccc3c9b034bb7d5e2bca0f4d026688223a0e9a3b8d8a87a95cda7d2bfa3beb0017c9c3ff3165de642e864273d651e39add4b4f955a25cc242ef130f4837b186c5045e883c72cc388994d1d8a29b3e975a9a297add1dc26b78e6c4d16fc206b8aa594ef3a0884c5abbfd54c148dc60245ab8591f1970a2b73d879808e1d7b1bfcd3da0c0c48a0284acd262f5c7e0b56e1c6014ab6180966d8c5af61ea7dd651b46f747ffcd9e4619a9fd6bd7fdfe1339f7279de6d1a031b58763c344d82f91e5ebfe45045fbacc172457b7f01ffd71de3405c653f09aa3e4add50f24cfa40817544c0e1bdac688c1dbd9b9d690ee23033b5013d94a3c001371991543fa1f226ac001291e853bd8a6b3c3891a4c059c0014c855e4b80a3474600fa1b0b657d61ca379c84b3bece4a8feab998baa8bf5983f0b658efa28553dbce4dd26a94d31522492823874d87a8911bd35e349267f2412e51a89a0a45ae480199d43f417b976717581972c4998318f6ae207a8aa051f00e67cfec6beadfdee8b5c3dd46e7f9556a4089e82f000636027a1ca958357409be5785c75b2b83790e36a7dbd272011b4158f3aab318f3f46bd8bb85089347d6e477b9c48d0308637939ffc462356598a90701380b2d07c274ff82f671803235340b853d0d063429ba8ff1df560f682676d4f6a46ccd909bfc97b09136edf4e2e62bd095dc095619498e22fd228e0b3832dfc76ee57c8e5fa542cc24e20b17029fffbc70f6d65800b5d8f19776ba5be1651d98349ce1f88e08220ef1e05c1dcdbe02f05ccc64151ef8f6dc55f8d1f0c223a858926eafb68bc54b5260ce1e3cd2be94a35d597fc287d969074bda6325cf14e811dd4587a3ca0200e6d6a5d99dd165b193a70d4c42dff373da2aa665a079b9c266f1423a4efe652b399a2f3a72d690b9e5e41deb343537437ea01460a1c44fa6db4ce41ea41cb62bb0c18fbbf7babdd906d586e9d08250a8efa7b5641ded6bc3a1c24952aeb848b55e7d9a748b112e3af8a8423690d03c057d90618d7d061f3007cded3550f15fd9ec7feaacf13e37b18b0eadd3a6664b5e723e7788a264675628ba7a3da3f5e0070e02de662d7db2113ce171f0c4f48bd9904f2e0069c6f6f045a82dc8589d8c34dae16e849dac4dda5c91decb2cd5ef0a7ef93261d1628eafc09cc54881d2aa966feb482905b5d3514cfc627fd6c02d197b0452f4ba3cf5507d071ae3db0ec06b1dd7a5aa646254633392808cddb4b41d1c4c441793d56dea75426547dc2d999c2e82da0ff9a12002b21986a6161d4c4795ce7d445cbbfeb431337bc67c40188578011816b1c015e830e5929256b5b68a5b023d27131f12d75bcb6f09f2d73081137a4807641c453bb01dbd1921977e0c92a55583c9f561a82317a8586c935a58aed5d5d5873b6d94f752e960ae6f37f7a5bee1ebc832873b6c4e1791c8023ef6d38ac1bf6f96dc111ab5bd72a11d2fdfcb6048440ec674b349480e79b349f40ed001cf50459dd27c2d42be51f2031d8e1420e0c6bb0471347eb96f7f67296daf9ba5e73744b78e5f359ca62b51cb50dd838279436148859ac02268e0cf8c12e94e6d1f69f75a2ca1d173ed62f490d7b1f28491f19bd98feca7c084891ad5d6c31efca861d541d85e4731a68a56c51465e21754dac22d4988a520b93d31eb58aea863dcaa171b50a2119aa33e4e45b92fd152643dd5c6a837c5866d465c58c69d6100dbdaf888d0a68e5917b1e9f64b0aabc9eff8711deebc2d0257fc0796c2a7a6c1dfd86a5aaf478c40f2ec9d93d6c8f8b34677a9c6d238e1eb619d7d648af8b9357ae996861b8e10e327f81428ab2eae88feef9cdb6a8de354086c3ae9d27e5d65d4c3652d017d5b9b7e9f49ff4f61af319f3c6654cdda4a1a880f5341ed09fdfeddd204f2c60c332c8d05d5a277efde033e999bac0db719afda5a1141c25ee061f896c11359c28c32233de54b65b3286c6d7930fe5a6259ff3c35f070c5b2a361092fadd9a3dc8e769bb15ef9e045cc416e79c453f1a8fb0c7a385d015b74513a406a90a58e96750790900d5ef4c3a2fb5896d71c6bddb92c7e8e4d1eb0c6f776fcd8903a39ebda56133afb1075d2d9b5187fb0567345f8f3a0e3df7392698d75c9d999a120a0c5a3b87e1953de587614063c94691ee08b08077f2ca6195eca00d9f847cfbf131e847dc84323eed5faf66c8df8a95d67598ffd2acf44a9cea8f690530be2071a9b906d39f3a8f66513a2f99ec8c6d5348503e3db329447ee4785171677c3f9c53d237b366e8b4992b8efea96148c2e324a5abe550814995b6aafc29e2067cd186cc7227b6731119dcf38b5f75d35c6a30a8aabe677d95a35b4f7cca317037a77b518413e491e0ee9e39437c4342f1e2295edf5f2dacc997bfba388a32152b32745a127dbf3adeeef06ca7da1a326404ec8ede8601c20483320b2655ff103be3d41a69f631f24d0b34b897898b22026d1ac5edf2e10d1d384df8216edc198b4ba879f7df7b8f3e98480d2509bf6e329d5d18ed0fa5961f276bc42ce2d57e50b207b3e3655c4d5c5faa13e4ebfcefff774998bcada1119c14fe6d6d15516c95febc06131d7111a5f458888ef1170ea9e242cf39c74c0b6509d36f38b53f9681e617587e0816f095d40a18e0cc0ed4a0cebb0aec0f89ae97402c823c9711c201a4f156242d28db34337e4598f5f698af5a06c65335d6549af6ef3a3fc1b246ea3223e7929f5d5b74b097754343307d4edb4924d27a4802627fcd8b1763cb70a2b415f22f3cb9542ac678f2a4d145f2f09ccd71ffb391dc60ccf40ff514eb4fce8cc70ec1bddab71d370af9e2ba64e4b76182c8dec9fe3e4d7741454b91672660ca55838003e27f1279fd63dfbeb41b331bfc6f1d7cb0914783abec14ce1318579aedd721eee595e25957214e99539c3b2c45ce9bc836475accd61ae16dee9f8dbc1dabcc6c5ea96ecab050f4681bb8a1f48df6155015ab373dccb525288b2a19b63d7e561a5c8af1ec6b13d301fbd1848a9697d071d27885827517b764480ac5d2b603e67142c89cf7ef924b1b22a799763cf128d12172781ec2e74ac9b4160a59140d9af27065baec311ed42b4e1f993382622445c9a2da5828e8e6aac0701aa1ae80d73963fc9b8d0dcb3478ab8e53c65ac0d87fbe03eae071741b87d8c2c376684099b527a3f63dbf7f6f6be848b9fe3572cd293a705a798687c4132b9b8c33b207dbc25bde2cebb084c18ed35808892934e2adafab17d13435ee12d3df4ea8750fedddb78e7f37ef53c62e00771c4329cc5d22b0e91815657e764eaa8f801046afc5cdba83528e856da36c90f00da7820a9eae7a7be1bcc2d1bfd081a703496e84d690e05343804bf1bee596bec776ce2b8dfcb07bb15db097f6a87f4c848c3d7afd2cbf2fd730965903b45347820f6b73b08882dedd9b655da89c88b7a5557d4f0f9ae2c767d1a651d862d85ef94d284dd4e6fed56f8e5b69d414c2cf05b08c016a3b355e76e57109b5f57e603ed6ab9a8f61e8fb3cc8104963463bac32451d7fee005bf23668250a6a121f871dca3dbc756f09c29ae677ff4121b1d27adde6c7122a85ae20f1eec9caf4917977d557848223c5bd5efa77c8e78dfe760d1d7c58719c02d9728fc3d8073404c47b1c1974c37fba185b7447e567b27ecf04e452ea8a38dacd20230f4838da3261f003d92578c30c08fb94d4d0ff0a92f0bb622b020e802d8cf4df20a28f73ecb5c200b98b01862127d7ef6c5fc0d2fdee58b54df019729193d5097eff314945bb78ca5bd942337419fcae4a77c7f153e1049fba37e00f31f1a88deb59c5c35529ac334c92a024451a043386cc79648cf11436cb7f683070f0c1dba12e6acfe5475a9c485c733db4bbe1ebfd296dfdff4433f5d9920cd12984f22c5b5b6586edd4236e3646501073d310f94f70d31e292ae031d7d7aee5d5c4aecb054b2b8f414b06fd3f0b0cdbcd5f0749dad5748b65ac1b25562fbde520614b6cc6ab40931c513d67de54d72f9fecbae304df5fdff6c83ae45cb32aea22b0551bf4b7504ffa38ce39571f14c4a83546a7aad35b6376bf94a20bb4e7d3a238f4ac18"}}, &(0x7f000001a480)) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, 0x0) pread64(r8, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x1c) 6m40.920089162s ago: executing program 2 (id=168): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_usb_connect_ath9k(0x3, 0x0, 0x0, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) migrate_pages(0x0, 0x5, 0x0, &(0x7f0000000080)=0x272) 6m39.541225868s ago: executing program 2 (id=171): unshare(0x6a060000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 6m24.458941074s ago: executing program 33 (id=171): unshare(0x6a060000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @remote}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) 7.044793419s ago: executing program 1 (id=938): unshare(0x22020600) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) 6.772209032s ago: executing program 3 (id=940): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7, 0x10}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="180800"/15, @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.725398847s ago: executing program 1 (id=941): bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) statx(0xffffffffffffffff, 0x0, 0x1000, 0x8, 0x0) recvfrom(0xffffffffffffffff, &(0x7f0000000580)=""/211, 0xd3, 0x10000, &(0x7f0000000680)=@sco, 0x80) bpf$MAP_CREATE(0x600000000000000, &(0x7f0000000580)=@base={0xf, 0x4, 0x4, 0x20002, 0x0, 0x1, 0xfffffffd, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x48) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x440, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000001100)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) r3 = open(&(0x7f0000000440)='./file0\x00', 0x149800, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0x560c89bb) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r4, 0x1, &(0x7f0000000200)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x4}]) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x20) splice(r1, 0x0, r5, 0x0, 0x8000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@gettaction={0x28, 0x32, 0x89910f7975f42df, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}]}, 0x28}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x9}]}}]}, 0x38}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet(0x2, 0x2, 0x2) 4.984658896s ago: executing program 3 (id=943): bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040), 0x10) listen(0xffffffffffffffff, 0x0) r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r2, &(0x7f00000004c0)='\n', 0x1) 4.79713494s ago: executing program 1 (id=944): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newqdisc={0x68, 0x24, 0xe0b, 0x78bd25, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x1ff, 0x4, 0x0, 0x6, 0xfffffffd}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0xfffffffb, 0x5, 0x73328a9a, 0x4}}]}]}}}]}, 0x68}}, 0x0) sendto$packet(r0, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c286dd", 0xe, 0x830, &(0x7f0000000440)={0x11, 0x0, r2, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, 0x14) 4.506057853s ago: executing program 0 (id=945): r0 = socket(0x10, 0x3, 0x0) socket$l2tp(0x2, 0x2, 0x73) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x14e24, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{0x0}], 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%/,c\xbe\xfbL:', 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x74}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) 4.372088194s ago: executing program 1 (id=946): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @empty, 0x4}, 0x1c) 4.22611498s ago: executing program 0 (id=947): syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bridge_slave_0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = fsmount(0xffffffffffffffff, 0x1, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) pread64(r1, &(0x7f00000000c0)=""/30, 0x1e, 0x800000000004) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c000200080001"], 0x3c}}, 0x40000) sendmsg$nl_route(r2, 0x0, 0x40000c0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @private2}]}}}]}, 0x48}}, 0x2400c000) 4.178196849s ago: executing program 3 (id=948): io_uring_setup(0x1598, &(0x7f00000000c0)={0x0, 0x1a2b, 0x8, 0x3, 0x1fe}) socket$netlink(0x10, 0x3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x1}]}) socket$inet_mptcp(0x2, 0x1, 0x106) socket(0x10, 0x803, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x281) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x602200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 3.59551795s ago: executing program 1 (id=949): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, r2) sendmsg$IEEE802154_ASSOCIATE_REQ(0xffffffffffffffff, 0x0, 0x4008804) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102400, 0x19000) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000240)={'\x00', 0x40, 0xa, 0x3, 0x40000000, 0x10}) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) syz_clone3(&(0x7f0000000340)={0x42907480, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1.98318549s ago: executing program 0 (id=950): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101a40, 0x15) read$FUSE(r0, 0x0, 0x0) 1.918642078s ago: executing program 3 (id=951): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7, 0x10}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="180800"/15, @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.565216907s ago: executing program 1 (id=952): add_key$keyring(&(0x7f0000000300), &(0x7f0000000780)={'syz', 0x3}, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2) readv(r0, &(0x7f0000000980)=[{&(0x7f0000000000)=""/58, 0x3a}], 0x1) 1.070214555s ago: executing program 0 (id=953): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 1.048858135s ago: executing program 3 (id=954): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newqdisc={0x68, 0x24, 0xe0b, 0x78bd25, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x38, 0x2, {{0x1ff, 0x4, 0x0, 0x6, 0xfffffffd}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0xfffffffb, 0x5, 0x73328a9a, 0x4}}]}]}}}]}, 0x68}}, 0x0) sendto$packet(r0, &(0x7f00000002c0)="44c33b69ebc9e05e9bdec0c286dd", 0xe, 0x830, &(0x7f0000000440)={0x11, 0x0, r2, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}}, 0x14) 322.233034ms ago: executing program 0 (id=955): r0 = socket(0x10, 0x3, 0x0) socket$l2tp(0x2, 0x2, 0x73) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x14e24, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='%/,c\xbe\xfbL:', 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x74}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000700)={0x0, 0x0, 0x0}, &(0x7f0000000740)=0xc) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) 230.552303ms ago: executing program 3 (id=956): bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000040), 0x10) listen(0xffffffffffffffff, 0x0) r0 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r0, &(0x7f0000000080), 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r2, &(0x7f00000004c0)='\n', 0x1) 0s ago: executing program 0 (id=957): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000002080), 0x8240, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x5, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) kernel console output (not intermixed with test programs): 5] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.185236][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.185317][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.185406][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.207915][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.208145][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.208222][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.219598][ T5608] Bluetooth: hci0: command tx timeout [ 102.225721][ T5608] Bluetooth: hci3: command tx timeout [ 102.288352][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.288456][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.288522][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.309133][ T5608] Bluetooth: hci1: command tx timeout [ 102.379010][ T5608] Bluetooth: hci4: command tx timeout [ 102.379046][ T5603] Bluetooth: hci2: command tx timeout [ 102.764427][ T5593] hsr_slave_0: entered promiscuous mode [ 102.771672][ T5593] hsr_slave_1: entered promiscuous mode [ 102.847846][ T5591] hsr_slave_0: entered promiscuous mode [ 102.853532][ T5591] hsr_slave_1: entered promiscuous mode [ 102.856595][ T5591] debugfs: 'hsr0' already exists in 'hsr' [ 102.856952][ T5591] Cannot create hsr debugfs directory [ 102.881679][ T5592] hsr_slave_0: entered promiscuous mode [ 102.885021][ T5592] hsr_slave_1: entered promiscuous mode [ 102.887351][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 102.887376][ T5592] Cannot create hsr debugfs directory [ 102.971593][ T5595] hsr_slave_0: entered promiscuous mode [ 102.975175][ T5595] hsr_slave_1: entered promiscuous mode [ 102.978222][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 102.978296][ T5595] Cannot create hsr debugfs directory [ 103.007888][ T5594] hsr_slave_0: entered promiscuous mode [ 103.012165][ T5594] hsr_slave_1: entered promiscuous mode [ 103.015460][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 103.015525][ T5594] Cannot create hsr debugfs directory [ 104.041740][ T5593] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.091979][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.106417][ T5593] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.155699][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.164429][ T5593] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.193692][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.221406][ T5593] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.263233][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.299077][ T5603] Bluetooth: hci0: command tx timeout [ 104.308586][ T5603] Bluetooth: hci3: command tx timeout [ 104.389857][ T5603] Bluetooth: hci1: command tx timeout [ 104.414298][ T5595] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.454421][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.459616][ T5608] Bluetooth: hci2: command tx timeout [ 104.459798][ T5603] Bluetooth: hci4: command tx timeout [ 104.476267][ T5595] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.512908][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.523708][ T5595] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.576425][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.606384][ T5595] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.636387][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.799400][ T5592] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 104.843781][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.866821][ T5592] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 104.904676][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.916215][ T5592] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 104.954297][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.983970][ T5592] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 105.017050][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.205030][ T5591] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.235352][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.247652][ T5591] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.294492][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.307562][ T5591] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.344101][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.376709][ T5591] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.403284][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.545618][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.640141][ T5594] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.673604][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.689877][ T5594] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.723854][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.771536][ T5594] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.802497][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.823091][ T5594] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.853093][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 105.868955][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.889388][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.955210][ T3393] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.956467][ T3393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.050394][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.058697][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.103369][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.165371][ T3344] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.166201][ T3344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.212627][ T3344] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.223776][ T3344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.252616][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.348400][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.379038][ T5608] Bluetooth: hci0: command tx timeout [ 106.382057][ T5603] Bluetooth: hci3: command tx timeout [ 106.418214][ T3344] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.427886][ T3344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.460831][ T5603] Bluetooth: hci1: command tx timeout [ 106.481121][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.518788][ T3344] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.523076][ T3344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.540546][ T5603] Bluetooth: hci4: command tx timeout [ 106.540618][ T5608] Bluetooth: hci2: command tx timeout [ 106.715743][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.782584][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.812202][ T3344] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.812633][ T3344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.876949][ T3393] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.877463][ T3393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.057332][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.153179][ T1388] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.166186][ T1388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.283304][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.283790][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.677713][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.070120][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.078010][ T5593] veth0_vlan: entered promiscuous mode [ 108.190999][ T5593] veth1_vlan: entered promiscuous mode [ 108.435139][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.525783][ T5593] veth0_macvtap: entered promiscuous mode [ 108.545969][ T5595] veth0_vlan: entered promiscuous mode [ 108.578488][ T5593] veth1_macvtap: entered promiscuous mode [ 108.634344][ T5595] veth1_vlan: entered promiscuous mode [ 108.738567][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.810892][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.844893][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.211054][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.228660][ T5595] veth0_macvtap: entered promiscuous mode [ 109.360326][ T5595] veth1_macvtap: entered promiscuous mode [ 109.578086][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.597501][ T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.598111][ T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.647344][ T5591] veth0_vlan: entered promiscuous mode [ 109.679172][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.773763][ T1388] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.777111][ T1388] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.817736][ T5591] veth1_vlan: entered promiscuous mode [ 109.858421][ T5594] veth0_vlan: entered promiscuous mode [ 109.871498][ T5592] veth0_vlan: entered promiscuous mode [ 110.052458][ T5594] veth1_vlan: entered promiscuous mode [ 110.077580][ T5592] veth1_vlan: entered promiscuous mode [ 110.416367][ T5591] veth0_macvtap: entered promiscuous mode [ 110.438280][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.440083][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.565447][ T5591] veth1_macvtap: entered promiscuous mode [ 110.686256][ T5594] veth0_macvtap: entered promiscuous mode [ 110.720839][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.720908][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.746604][ T5592] veth0_macvtap: entered promiscuous mode [ 110.816803][ T5594] veth1_macvtap: entered promiscuous mode [ 110.858554][ T5592] veth1_macvtap: entered promiscuous mode [ 110.942880][ T5785] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 110.992651][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.062938][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.084015][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.117642][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.129848][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.168559][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.220802][ T31] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 112.522833][ T31] usb 2-1: New USB device found, idVendor=18b4, idProduct=1689, bcdDevice= 1.00 [ 112.646257][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 112.672859][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.681120][ T31] usb 2-1: Product: syz [ 112.681142][ T31] usb 2-1: Manufacturer: syz [ 112.681158][ T31] usb 2-1: SerialNumber: syz [ 112.988072][ T31] usbhid 2-1:1.0: couldn't find an input interrupt endpoint [ 113.010771][ T1388] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.010851][ T1388] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.199236][ T31] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 113.364489][ T3377] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.364572][ T3377] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.403765][ T31] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 113.416607][ T31] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 113.418684][ T31] usb 2-1: media controller created [ 113.553827][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 113.720477][ T3377] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.807744][ T31] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 113.969963][ T3344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.970050][ T3344] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.092564][ T5798] genirq: Flags mismatch irq 31. 00200000 (pcmmio) vs. 00200000 (virtio1-input.0) [ 114.135731][ T31] usb 2-1: USB disconnect, device number 2 [ 114.368128][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.368204][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.600213][ T3393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.610588][ T3393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.085469][ T3344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.086622][ T3344] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.315389][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.319521][ T1428] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.532309][ T82] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.533354][ T82] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.612727][ T1428] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.651280][ T1428] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.656387][ T1428] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.695771][ T1428] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.796845][ T5810] tipc: Started in network mode [ 115.796943][ T5810] tipc: Node identity 4, cluster identity 4711 [ 115.796957][ T5810] tipc: Node number set to 4 [ 115.927170][ T82] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.152537][ T82] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.735904][ T82] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.790588][ T1012] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.833818][ T1012] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.109926][ T56] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.199915][ T1428] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.200024][ T1428] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.200137][ T1428] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.200239][ T1428] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.200345][ T1428] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 117.417085][ T5820] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14'. [ 118.140917][ T31] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 118.341831][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 118.352318][ T31] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 118.364878][ T31] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 118.364907][ T31] usb 2-1: config 0 has no interface number 0 [ 118.364956][ T31] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 118.364981][ T31] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 118.365009][ T31] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 118.365037][ T31] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 118.365082][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.544981][ T31] usb 2-1: config 0 descriptor?? [ 118.786550][ T31] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 119.321900][ T37] usb 2-1: USB disconnect, device number 3 [ 119.530204][ T37] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 119.984504][ T5848] capability: warning: `syz.3.23' uses deprecated v2 capabilities in a way that may be insecure [ 125.929869][ T5893] syz.1.37 uses obsolete (PF_INET,SOCK_PACKET) [ 125.960334][ T5893] netlink: 8 bytes leftover after parsing attributes in process `syz.1.37'. [ 126.512930][ T5899] process 'syz.3.39' launched './file0' with NULL argv: empty string added [ 127.820524][ T5690] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 128.020255][ T5690] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 128.035090][ T5690] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.039051][ T5690] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.039083][ T5690] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 128.039140][ T5690] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 129.219100][ T5917] netlink: zone id is out of range [ 129.228721][ T5917] netlink: zone id is out of range [ 129.228738][ T5917] netlink: zone id is out of range [ 129.228747][ T5917] netlink: zone id is out of range [ 129.228756][ T5917] netlink: zone id is out of range [ 129.228765][ T5917] netlink: zone id is out of range [ 129.260925][ T5917] netlink: zone id is out of range [ 129.266624][ T5917] netlink: zone id is out of range [ 129.266639][ T5917] netlink: zone id is out of range [ 129.266649][ T5917] netlink: zone id is out of range [ 129.316502][ T5690] usb 5-1: config 0 descriptor?? [ 129.470721][ T5915] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 129.520491][ T5915] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 129.700745][ T5915] vhci_hcd vhci_hcd.0: Device attached [ 130.054794][ T5690] plantronics 0003:047F:FFFF.0001: reserved main item tag 0xd [ 130.065807][ T5690] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 130.065852][ T5690] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 130.065880][ T5690] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 130.065906][ T5690] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 130.065932][ T5690] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0 [ 130.101193][ T5912] usb 38-1: SetAddress Request (2) to port 0 [ 130.101467][ T5912] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 130.255824][ T5920] vhci_hcd: connection closed [ 130.293404][ T5921] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 130.309810][ T3393] vhci_hcd vhci_hcd.2: stop threads [ 130.330650][ T3393] vhci_hcd vhci_hcd.2: release socket [ 130.411007][ T3393] vhci_hcd vhci_hcd.2: disconnect device [ 130.629182][ T5690] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 130.782626][ T5690] usb 5-1: USB disconnect, device number 2 [ 131.176795][ T5934] fido_id[5934]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 133.026048][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.027627][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.652458][ T5947] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.46'. [ 134.347869][ T5966] net_ratelimit: 367 callbacks suppressed [ 134.360380][ T5966] netlink: zone id is out of range [ 134.367488][ T5966] netlink: zone id is out of range [ 134.367504][ T5966] netlink: zone id is out of range [ 134.367513][ T5966] netlink: zone id is out of range [ 134.367521][ T5966] netlink: zone id is out of range [ 134.367530][ T5966] netlink: zone id is out of range [ 134.367544][ T5966] netlink: zone id is out of range [ 134.367587][ T5966] netlink: zone id is out of range [ 134.367597][ T5966] netlink: zone id is out of range [ 134.367632][ T5966] netlink: zone id is out of range [ 135.657894][ T5912] usb 38-1: device descriptor read/8, error -110 [ 136.148872][ T5912] usb usb38-port1: attempt power cycle [ 137.837880][ T5912] usb usb38-port1: unable to enumerate USB device [ 139.361303][ T5990] uprobe: syz.2.65:5990 failed to unregister, leaking uprobe [ 139.609045][ T6003] tipc: Started in network mode [ 139.609203][ T6003] tipc: Node identity 4, cluster identity 4711 [ 139.609242][ T6003] tipc: Node number set to 4 [ 140.797336][ T6008] net_ratelimit: 367 callbacks suppressed [ 140.802450][ T6008] netlink: zone id is out of range [ 140.802466][ T6008] netlink: zone id is out of range [ 140.802475][ T6008] netlink: zone id is out of range [ 140.802485][ T6008] netlink: zone id is out of range [ 140.802493][ T6008] netlink: zone id is out of range [ 140.802502][ T6008] netlink: zone id is out of range [ 140.802514][ T6008] netlink: zone id is out of range [ 140.802522][ T6008] netlink: zone id is out of range [ 140.802531][ T6008] netlink: zone id is out of range [ 140.802539][ T6008] netlink: zone id is out of range [ 141.300747][ T6021] syzkaller0: entered promiscuous mode [ 141.300825][ T6021] syzkaller0: entered allmulticast mode [ 143.137493][ T6045] kAFS: unable to lookup cell '/,c¾ûL' [ 143.150490][ T6045] Zero length message leads to an empty skb [ 144.182494][ T6023] bond0: Error: CAN devices cannot be enslaved [ 144.329313][ T31] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 144.480208][ T31] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 144.499575][ T31] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 144.511168][ T31] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 144.511222][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 144.622630][ T6048] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 144.884669][ T31] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 146.648974][ T5710] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 146.660249][ C0] raw-gadget.0 gadget.2: ignoring, device is not running [ 146.831641][ T5710] usb 3-1: device descriptor read/64, error -32 [ 147.154928][ T6085] tipc: Started in network mode [ 147.154972][ T6085] tipc: Node identity 4, cluster identity 4711 [ 147.155016][ T6085] tipc: Node number set to 4 [ 148.065342][ T5710] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 148.243757][ T31] usb 2-1: USB disconnect, device number 4 [ 148.250359][ T5710] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 148.281686][ T5710] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 148.282000][ T5710] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 148.289645][ T5710] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 148.289728][ T5710] usb 3-1: Manufacturer: syz [ 148.377509][ T6087] netlink: 8 bytes leftover after parsing attributes in process `syz.4.95'. [ 148.927985][ T6093] overlayfs: missing 'workdir' [ 148.962712][ T5710] usb 3-1: config 0 descriptor?? [ 149.373095][ T5710] usb 3-1: can't set config #0, error -71 [ 149.616023][ T5710] usb 3-1: USB disconnect, device number 3 [ 154.133827][ T6126] binder: BINDER_SET_CONTEXT_MGR already set [ 154.147162][ T6126] binder: 6125:6126 ioctl 4018620d 200000004a80 returned -16 [ 154.775006][ T6146] kAFS: unable to lookup cell '/,c¾ûL' [ 159.967089][ T6183] kAFS: unable to lookup cell '/,c¾ûL' [ 161.370290][ T6193] net_ratelimit: 744 callbacks suppressed [ 161.379623][ T6193] TC_ACT_REPEAT abuse ? [ 161.679937][ T6189] syzkaller0: entered promiscuous mode [ 161.713612][ T6189] syzkaller0: entered allmulticast mode [ 165.845347][ T6228] kAFS: unable to lookup cell '/,c¾ûL' [ 175.499214][ T6207] tipc: Started in network mode [ 175.499248][ T6207] tipc: Node identity 4, cluster identity 4711 [ 175.499263][ T6207] tipc: Node number set to 4 [ 175.528150][ T5608] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 175.565255][ T5608] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 175.587110][ T5608] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 175.602583][ T5608] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 175.611454][ T5608] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 175.650389][ T6250] netlink: 'syz.0.142': attribute type 1 has an invalid length. [ 175.674549][ T6250] netlink: 756 bytes leftover after parsing attributes in process `syz.0.142'. [ 177.739019][ T5603] Bluetooth: hci5: command tx timeout [ 178.341250][ T6291] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 178.494144][ T1017] IPVS: starting estimator thread 0... [ 178.589259][ T6293] IPVS: using max 8 ests per chain, 19200 per kthread [ 179.840838][ T5603] Bluetooth: hci5: command tx timeout [ 180.280747][ T6298] tipc: Started in network mode [ 180.280782][ T6298] tipc: Node identity 4, cluster identity 4711 [ 180.280797][ T6298] tipc: Node number set to 4 [ 181.852553][ T6318] netlink: 'syz.1.155': attribute type 1 has an invalid length. [ 181.852653][ T6318] netlink: 756 bytes leftover after parsing attributes in process `syz.1.155'. [ 181.910307][ T5603] Bluetooth: hci5: command tx timeout [ 183.984478][ T5603] Bluetooth: hci5: command tx timeout [ 186.781198][ T6335] syz.2.162 (6335) used greatest stack depth: 18912 bytes left [ 187.008069][ T38] audit: type=1326 audit(1787936707.969:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.008191][ T38] audit: type=1326 audit(1787936707.969:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.106421][ T38] audit: type=1326 audit(1787936708.069:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.106545][ T38] audit: type=1326 audit(1787936708.069:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.113954][ T38] audit: type=1326 audit(1787936708.069:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=444 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.114094][ T38] audit: type=1326 audit(1787936708.069:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.114204][ T38] audit: type=1326 audit(1787936708.069:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.115833][ T38] audit: type=1326 audit(1787936708.079:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=256 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.669691][ T38] audit: type=1326 audit(1787936708.639:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 187.669803][ T38] audit: type=1326 audit(1787936708.639:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6369 comm="syz.2.168" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbc9614e159 code=0x7ffc0000 [ 188.425410][ T6252] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.426502][ T6252] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.427255][ T6252] bridge_slave_0: entered allmulticast mode [ 188.465776][ T6252] bridge_slave_0: entered promiscuous mode [ 188.499110][ T6252] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.506562][ T6252] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.516307][ T6252] bridge_slave_1: entered allmulticast mode [ 188.527056][ T6252] bridge_slave_1: entered promiscuous mode [ 188.826480][ T6252] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.966705][ T6252] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.460475][ T6252] team0: Port device team_slave_0 added [ 189.515584][ T6252] team0: Port device team_slave_1 added [ 189.585736][ T6252] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 189.593162][ T6252] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 189.621342][ T6252] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 189.646157][ T6252] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 189.653246][ T6252] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 189.653279][ T6252] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 196.938859][ C0] sched: DL replenish lagged too much [ 200.842589][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 200.863372][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 203.668246][ T5608] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 203.721560][ T5608] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 203.731639][ T5608] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 203.748285][ T5608] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 203.750448][ T5608] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 203.883583][ T3377] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.424989][ T5608] Bluetooth: hci1: command tx timeout [ 206.885198][ T6252] hsr_slave_0: entered promiscuous mode [ 206.915932][ T6252] hsr_slave_1: entered promiscuous mode [ 206.928460][ T6252] debugfs: 'hsr0' already exists in 'hsr' [ 206.929609][ T6252] Cannot create hsr debugfs directory [ 208.479921][ T5608] Bluetooth: hci1: command tx timeout [ 208.563582][ T3377] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 208.862471][ T6482] Need at least one configuration in g1. [ 208.862950][ T6482] udc dummy_udc.0: failed to start g1: -22 [ 208.862977][ T6482] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 208.871447][ T6482] UDC core: g1: couldn't find an available UDC or it's busy [ 210.799474][ T5608] Bluetooth: hci1: command tx timeout [ 211.511667][ T5710] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 212.142369][ T5710] usb 1-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 212.153382][ T5710] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.226839][ T5710] i2c-tiny-usb 1-1:1.0: version 1.00 found at bus 001 address 002 [ 212.605345][ T3377] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.645863][ T5710] (null): failure reading functionality [ 213.653634][ T5608] Bluetooth: hci1: command tx timeout [ 213.681696][ T5710] i2c i2c-1: failure reading functionality [ 213.686793][ T5710] i2c i2c-1: connected i2c-tiny-usb device [ 213.723368][ T5710] usb 1-1: USB disconnect, device number 2 [ 217.360263][ T3377] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 218.541099][ T6540] Need at least one configuration in g1. [ 218.541268][ T6540] udc dummy_udc.0: failed to start g1: -22 [ 218.541294][ T6540] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 218.542927][ T6540] UDC core: g1: couldn't find an available UDC or it's busy [ 222.465167][ T5608] Bluetooth: hci0: command 0x0406 tx timeout [ 222.465209][ T5608] Bluetooth: hci4: command 0x0406 tx timeout [ 222.465485][ T5608] Bluetooth: hci3: command 0x0406 tx timeout [ 226.873843][ T6575] Need at least one configuration in g1. [ 226.880038][ T6575] udc dummy_udc.0: failed to start g1: -22 [ 226.880173][ T6575] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 226.917586][ T6575] UDC core: g1: couldn't find an available UDC or it's busy [ 231.974871][ T3377] bridge_slave_1: left allmulticast mode [ 231.974970][ T3377] bridge_slave_1: left promiscuous mode [ 232.087454][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.625398][ T3377] bridge_slave_0: left allmulticast mode [ 232.632141][ T3377] bridge_slave_0: left promiscuous mode [ 232.632412][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 235.297055][ T6624] netlink: 24 bytes leftover after parsing attributes in process `syz.1.233'. [ 236.077079][ T37] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 236.347194][ T37] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 236.369048][ T37] usb 1-1: Dual-Role OTG device on HNP port [ 236.386529][ T37] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 236.734955][ T37] gspca_main: spca501-2.14.0 probing 0000:0000 [ 236.780298][ T37] gspca_spca501: reg write: error -32 [ 236.783521][ T37] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 236.783640][ T37] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 236.807390][ T37] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 237.296595][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 237.652111][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 237.809259][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 237.853568][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 237.956901][ T3377] bond0 (unregistering): Released all slaves [ 238.041213][ T5603] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 238.115816][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 238.190452][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 241.501275][ T5602] Bluetooth: hci2: command tx timeout [ 243.234783][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.248012][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.248168][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.248332][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.248480][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.248682][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249000][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249184][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249368][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249564][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249748][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.249932][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.250151][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.250336][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.250514][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.250702][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.250879][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.251056][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.251239][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.251420][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.251611][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.251825][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.252017][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.252202][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.252385][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.252667][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.253857][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.254052][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.254255][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.254447][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.254657][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.254862][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255054][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255246][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255430][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255619][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255800][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.255992][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.256172][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.256354][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.256542][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.256730][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.256907][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.258049][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.258237][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.258429][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.258619][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.258938][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.259129][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.259309][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.259491][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.259678][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.259857][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.260034][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.260216][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.260397][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.260586][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.260824][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.261015][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.261207][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.261388][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.261576][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.261765][ C1] vxcan1: j1939_simple_recv: Received already invalidated message [ 243.578898][ T5602] Bluetooth: hci2: command tx timeout [ 244.536343][ T6659] netlink: 24 bytes leftover after parsing attributes in process `syz.3.242'. [ 245.662435][ T5602] Bluetooth: hci2: command tx timeout [ 245.713094][ T1388] batman_adv: batadv0: adding TT local entry 33:33:00:00:00:01 to non-existent VLAN -1 [ 245.807676][ T3377] tipc: Left network mode [ 247.739104][ T5602] Bluetooth: hci2: command tx timeout [ 253.660872][ T6711] netlink: 20 bytes leftover after parsing attributes in process `syz.1.250'. [ 253.756763][ T6732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.254'. [ 254.712548][ T5250] 8021q: adding VLAN 0 to HW filter on device eth1 [ 254.791557][ T6439] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.794055][ T6439] bridge0: port 1(bridge_slave_0) entered disabled state [ 254.794241][ T6439] bridge_slave_0: entered allmulticast mode [ 254.869773][ T6439] bridge_slave_0: entered promiscuous mode [ 254.908288][ T6439] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.908649][ T6439] bridge0: port 2(bridge_slave_1) entered disabled state [ 254.910276][ T6439] bridge_slave_1: entered allmulticast mode [ 254.950258][ T6439] bridge_slave_1: entered promiscuous mode [ 257.404772][ T6439] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 257.561864][ T6439] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 258.650585][ T3377] hsr_slave_0: left promiscuous mode [ 258.759105][ T3377] hsr_slave_1: left promiscuous mode [ 258.777754][ T3377] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 258.777953][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 258.817066][ T3377] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 258.821684][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 258.938322][ T3377] veth1_macvtap: left promiscuous mode [ 258.947176][ T3377] veth0_macvtap: left promiscuous mode [ 258.947415][ T3377] veth1_vlan: left promiscuous mode [ 258.947757][ T3377] veth0_vlan: left promiscuous mode [ 261.070691][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.086503][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 263.334024][ T6813] netlink: 'syz.0.275': attribute type 1 has an invalid length. [ 263.334184][ T6813] netlink: 756 bytes leftover after parsing attributes in process `syz.0.275'. [ 264.733638][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 264.803622][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 265.104653][ T6439] team0: Port device team_slave_0 added [ 265.125826][ T6813] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 265.529229][ T6824] netlink: 'syz.3.279': attribute type 1 has an invalid length. [ 265.754083][ T5603] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 265.781738][ T5603] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 265.810891][ T5603] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 265.822385][ T5603] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 265.851485][ T5603] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 267.308807][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 268.081042][ T5602] Bluetooth: hci5: command tx timeout [ 269.928791][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 270.771654][ T6637] bridge0: port 1(bridge_slave_0) entered blocking state [ 270.802566][ T5602] Bluetooth: hci5: command tx timeout [ 270.841448][ T6637] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.841681][ T6637] bridge_slave_0: entered allmulticast mode [ 270.856180][ T6637] bridge_slave_0: entered promiscuous mode [ 270.932591][ T6637] bridge0: port 2(bridge_slave_1) entered blocking state [ 270.932881][ T6637] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.933418][ T6637] bridge_slave_1: entered allmulticast mode [ 271.024960][ T6637] bridge_slave_1: entered promiscuous mode [ 271.172647][ T6883] netlink: 'syz.1.289': attribute type 1 has an invalid length. [ 271.529328][ T6637] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 272.006108][ T5250] 8021q: adding VLAN 0 to HW filter on device eth2 [ 272.091281][ T6637] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 272.859545][ T5602] Bluetooth: hci5: command tx timeout [ 273.360084][ T6637] team0: Port device team_slave_0 added [ 273.456868][ T6637] team0: Port device team_slave_1 added [ 274.698605][ T6637] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.698703][ T6637] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 274.700456][ T6637] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.943896][ T5602] Bluetooth: hci5: command tx timeout [ 274.966032][ T6637] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.974186][ T6637] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 274.974237][ T6637] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 277.760438][ T6637] hsr_slave_0: entered promiscuous mode [ 277.789659][ T6637] hsr_slave_1: entered promiscuous mode [ 277.797976][ T6637] debugfs: 'hsr0' already exists in 'hsr' [ 277.798005][ T6637] Cannot create hsr debugfs directory [ 277.862771][ T5250] 8021q: adding VLAN 0 to HW filter on device eth3 [ 280.728766][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 284.650935][ T5250] 8021q: adding VLAN 0 to HW filter on device eth4 [ 296.128149][ T3377] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.902525][ T6823] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.914140][ T6823] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.930313][ T6823] bridge_slave_0: entered allmulticast mode [ 297.947753][ T6823] bridge_slave_0: entered promiscuous mode [ 298.448176][ T5603] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 298.512623][ T5603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 298.559947][ T5603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 298.576916][ T5603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 298.603568][ T5603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 300.207442][ T3377] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.648073][ T5603] Bluetooth: hci1: command tx timeout [ 303.665516][ T6823] bridge0: port 2(bridge_slave_1) entered blocking state [ 303.671500][ T6823] bridge0: port 2(bridge_slave_1) entered disabled state [ 303.671993][ T6823] bridge_slave_1: entered allmulticast mode [ 303.717502][ T6823] bridge_slave_1: entered promiscuous mode [ 304.837248][ T3377] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 304.971197][ T37] usb 1-1: USB disconnect, device number 3 [ 305.086380][ T6823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 305.225250][ T6823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 305.691481][ T5603] Bluetooth: hci1: command tx timeout [ 306.112010][ T7098] bridge0: port 2(bridge_slave_1) entered disabled state [ 306.228670][ T7098] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.783243][ T3377] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.251535][ T6823] team0: Port device team_slave_0 added [ 307.362027][ T6823] team0: Port device team_slave_1 added [ 307.823218][ T5603] Bluetooth: hci1: command tx timeout [ 307.980939][ T6823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.981020][ T6823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 307.981055][ T6823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 308.008666][ T6823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 308.063280][ T6823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 308.063319][ T6823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 308.619074][ T6823] hsr_slave_0: entered promiscuous mode [ 308.626629][ T6823] hsr_slave_1: entered promiscuous mode [ 308.641893][ T6823] debugfs: 'hsr0' already exists in 'hsr' [ 308.647846][ T6823] Cannot create hsr debugfs directory [ 309.899843][ T5603] Bluetooth: hci1: command tx timeout [ 313.242437][ T3377] bridge_slave_1: left allmulticast mode [ 313.242527][ T3377] bridge_slave_1: left promiscuous mode [ 313.242796][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 313.478605][ T3377] bridge_slave_0: left allmulticast mode [ 313.492400][ T3377] bridge_slave_0: left promiscuous mode [ 313.557358][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.080695][ T3377] bridge_slave_1: left allmulticast mode [ 314.080787][ T3377] bridge_slave_1: left promiscuous mode [ 314.081463][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 314.251404][ T3377] bridge_slave_0: left allmulticast mode [ 314.251511][ T3377] bridge_slave_0: left promiscuous mode [ 314.252192][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 314.614294][ T3377] bridge_slave_1: left allmulticast mode [ 314.614409][ T3377] bridge_slave_1: left promiscuous mode [ 314.631172][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 315.371288][ T3377] bridge_slave_0: left allmulticast mode [ 315.371386][ T3377] bridge_slave_0: left promiscuous mode [ 315.372044][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.698641][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 320.809496][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 320.898272][ T3377] bond0 (unregistering): Released all slaves [ 322.465957][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.466225][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 322.671717][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 322.840333][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 322.929695][ T3377] bond0 (unregistering): Released all slaves [ 326.533421][ T7269] netlink: 28 bytes leftover after parsing attributes in process `syz.1.387'. [ 326.565274][ T5602] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 326.705456][ T5602] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 326.717970][ T5602] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 326.731237][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 326.738156][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 327.859588][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 327.953598][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 327.996918][ T3377] bond0 (unregistering): Released all slaves [ 328.939034][ T5603] Bluetooth: hci2: command tx timeout [ 329.023142][ T3377] tipc: Left network mode [ 330.962758][ T7044] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.970067][ T7044] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.970300][ T7044] bridge_slave_0: entered allmulticast mode [ 330.973142][ T7044] bridge_slave_0: entered promiscuous mode [ 331.005153][ T7044] bridge0: port 2(bridge_slave_1) entered blocking state [ 331.012797][ T7044] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.013010][ T7044] bridge_slave_1: entered allmulticast mode [ 331.015769][ T7044] bridge_slave_1: entered promiscuous mode [ 331.022238][ T5603] Bluetooth: hci2: command tx timeout [ 331.271974][ T7323] netlink: 756 bytes leftover after parsing attributes in process `syz.3.403'. [ 331.526961][ T7044] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 331.615102][ T7044] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 333.098894][ T5603] Bluetooth: hci2: command tx timeout [ 333.641912][ T7044] team0: Port device team_slave_0 added [ 335.179043][ T5603] Bluetooth: hci2: command tx timeout [ 336.721316][ T7355] netlink: 756 bytes leftover after parsing attributes in process `syz.3.412'. [ 337.420904][ T7044] team0: Port device team_slave_1 added [ 338.541445][ T5250] 8021q: adding VLAN 0 to HW filter on device eth7 [ 338.549398][ T7044] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 338.557962][ T7044] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.557996][ T7044] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 338.639466][ T7044] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 338.639532][ T7044] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 338.639562][ T7044] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 339.141812][ T3377] hsr_slave_0: left promiscuous mode [ 339.349017][ T3377] hsr_slave_1: left promiscuous mode [ 339.351904][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.453637][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.752182][ T3377] hsr_slave_0: left promiscuous mode [ 339.776324][ T7401] netlink: 756 bytes leftover after parsing attributes in process `syz.1.421'. [ 339.789120][ T3377] hsr_slave_1: left promiscuous mode [ 339.794578][ T3377] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.794609][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.830814][ T3377] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.832317][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 340.267508][ T3377] veth1_macvtap: left promiscuous mode [ 340.267577][ T3377] veth0_macvtap: left promiscuous mode [ 340.267786][ T3377] veth1_vlan: left promiscuous mode [ 340.267925][ T3377] veth0_vlan: left promiscuous mode [ 341.199545][ T7411] netlink: 28 bytes leftover after parsing attributes in process `syz.3.424'. [ 344.169595][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 344.705420][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 344.763920][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 345.501516][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 345.565833][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 345.990951][ T7044] hsr_slave_0: entered promiscuous mode [ 345.994933][ T7044] hsr_slave_1: entered promiscuous mode [ 349.649804][ T7478] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 350.566989][ T5250] 8021q: adding VLAN 0 to HW filter on device eth8 [ 350.595723][ T7266] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.605122][ T7266] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.605343][ T7266] bridge_slave_0: entered allmulticast mode [ 350.637552][ T7266] bridge_slave_0: entered promiscuous mode [ 350.731955][ T7266] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.732273][ T7266] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.732878][ T7266] bridge_slave_1: entered allmulticast mode [ 350.739196][ T7266] bridge_slave_1: entered promiscuous mode [ 352.537031][ T7266] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 352.561865][ T7266] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 352.676691][ T7266] team0: Port device team_slave_0 added [ 352.691278][ T7266] team0: Port device team_slave_1 added [ 352.742153][ T7044] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 353.005380][ T7044] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 353.305338][ T7044] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 353.454776][ T7044] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 353.470190][ T7266] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 353.478440][ T7266] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.478477][ T7266] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 353.575358][ T7531] tipc: New replicast peer: 172.20.20.187 [ 353.650915][ T7531] tipc: Enabled bearer , priority 10 [ 353.661572][ T7044] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 353.737823][ T7044] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 353.756353][ T7266] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 353.756418][ T7266] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 353.756450][ T7266] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.878607][ T7044] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 354.013680][ T7044] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 354.584782][ T7266] hsr_slave_0: entered promiscuous mode [ 354.606178][ T7266] hsr_slave_1: entered promiscuous mode [ 354.619268][ T7266] debugfs: 'hsr0' already exists in 'hsr' [ 354.619355][ T7266] Cannot create hsr debugfs directory [ 358.084485][ T5602] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 358.183920][ T5602] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 358.252394][ T5602] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 358.262239][ T5602] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 358.285732][ T5602] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 360.379063][ T5603] Bluetooth: hci5: command tx timeout [ 362.458863][ T5603] Bluetooth: hci5: command tx timeout [ 364.027533][ T7587] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.035050][ T7587] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.035278][ T7587] bridge_slave_0: entered allmulticast mode [ 364.075978][ T7587] bridge_slave_0: entered promiscuous mode [ 364.089584][ T7587] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.096978][ T7587] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.097168][ T7587] bridge_slave_1: entered allmulticast mode [ 364.119957][ T7587] bridge_slave_1: entered promiscuous mode [ 364.507717][ T7587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 364.538827][ T5603] Bluetooth: hci5: command tx timeout [ 364.739149][ T7689] FAULT_INJECTION: forcing a failure. [ 364.739149][ T7689] name failslab, interval 1, probability 0, space 0, times 1 [ 364.773503][ T7689] CPU: 0 UID: 0 PID: 7689 Comm: syz.3.472 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 364.773527][ T7689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 364.773543][ T7689] Call Trace: [ 364.773550][ T7689] [ 364.773557][ T7689] dump_stack_lvl+0xe8/0x150 [ 364.773587][ T7689] should_fail_ex+0x46b/0x600 [ 364.773618][ T7689] should_failslab+0xa8/0x100 [ 364.773644][ T7689] __kmalloc_cache_noprof+0xa1/0x680 [ 364.773665][ T7689] ? proc_self_get_link+0xe5/0x180 [ 364.773715][ T7689] ? proc_self_get_link+0xe5/0x180 [ 364.773742][ T7689] ? __task_pid_nr_ns+0x399/0x470 [ 364.773769][ T7689] proc_self_get_link+0xe5/0x180 [ 364.773796][ T7689] ? __pfx_proc_self_get_link+0x10/0x10 [ 364.773823][ T7689] pick_link+0x72f/0xfe0 [ 364.773855][ T7689] step_into_slowpath+0x58a/0x820 [ 364.773882][ T7689] ? __pfx_step_into_slowpath+0x10/0x10 [ 364.773918][ T7689] link_path_walk+0xd5e/0x1910 [ 364.773948][ T7689] path_openat+0x1ce/0x1d60 [ 364.773984][ T7689] do_file_open+0x23e/0x4a0 [ 364.774007][ T7689] ? __pfx_do_file_open+0x10/0x10 [ 364.774043][ T7689] ? alloc_fd+0x654/0x6d0 [ 364.774100][ T7689] do_sys_openat2+0x115/0x200 [ 364.774135][ T7689] ? __se_sys_futex+0x3a8/0x450 [ 364.774160][ T7689] ? __pfx_do_sys_openat2+0x10/0x10 [ 364.774188][ T7689] ? rcu_is_watching+0x16/0xb0 [ 364.774216][ T7689] __x64_sys_openat+0x138/0x170 [ 364.774244][ T7689] do_syscall_64+0x166/0x520 [ 364.774260][ T7689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.774277][ T7689] ? clear_bhb_loop+0x70/0xc0 [ 364.774297][ T7689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.774319][ T7689] RIP: 0033:0x7f80c45fe98e [ 364.774337][ T7689] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 364.774351][ T7689] RSP: 002b:00007f80c2895f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 364.774372][ T7689] RAX: ffffffffffffffda RBX: 00007f80c28966c0 RCX: 00007f80c45fe98e [ 364.774384][ T7689] RDX: 0000000000000000 RSI: 00007f80c46d475f RDI: ffffffffffffff9c [ 364.774395][ T7689] RBP: 00007f80c46d5024 R08: 0000000000000000 R09: 0000000000000000 [ 364.774405][ T7689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 364.774414][ T7689] R13: 00007f80c48c6038 R14: 00007f80c48c5fa0 R15: 00007ffea6c35738 [ 364.774439][ T7689] [ 365.397481][ T7587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.399784][ T5250] 8021q: adding VLAN 0 to HW filter on device eth5 [ 365.848030][ T7587] team0: Port device team_slave_0 added [ 365.869629][ T7587] team0: Port device team_slave_1 added [ 366.346262][ T7587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 366.353570][ T7587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.353607][ T7587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 366.424346][ T7587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 366.440955][ T7587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.441048][ T7587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.619324][ T5603] Bluetooth: hci5: command tx timeout [ 366.653437][ T3377] bridge_slave_1: left allmulticast mode [ 366.656711][ T3377] bridge_slave_1: left promiscuous mode [ 366.657008][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.794587][ T3377] bridge_slave_0: left allmulticast mode [ 366.803827][ T3377] bridge_slave_0: left promiscuous mode [ 366.804120][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.071189][ T3377] bridge_slave_1: left allmulticast mode [ 367.072413][ T3377] bridge_slave_1: left promiscuous mode [ 367.072672][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 367.209696][ T3377] bridge_slave_0: left allmulticast mode [ 367.217025][ T3377] bridge_slave_0: left promiscuous mode [ 367.217319][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.302798][ T7722] 9pnet_virtio: no channels available for device syz [ 369.431288][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 369.553724][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 369.671588][ T3377] bond0 (unregistering): Released all slaves [ 370.231724][ T7760] fuse: Bad value for 'fd' [ 370.652682][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 370.799487][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 371.509818][ T3377] bond0 (unregistering): Released all slaves [ 373.718781][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 374.653139][ T3377] hsr_slave_0: left promiscuous mode [ 374.716101][ T3377] hsr_slave_1: left promiscuous mode [ 374.727019][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 374.751131][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 374.949972][ T3377] hsr_slave_0: left promiscuous mode [ 374.988815][ T3377] hsr_slave_1: left promiscuous mode [ 374.995074][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 375.013772][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 376.432924][ T5723] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 376.552635][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 376.582458][ T5723] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 376.593349][ T5723] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 376.593425][ T5723] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 376.593457][ T5723] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 376.593507][ T5723] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.785330][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 378.709635][ T5723] cxacru 4-1:1.0: send of cm 0x90 failed (-71) [ 378.752451][ T5723] cxacru 4-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 378.773683][ T5723] cxacru 4-1:1.0: probe with driver cxacru failed with error -22 [ 378.866731][ T5723] usb 4-1: USB disconnect, device number 2 [ 380.780047][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 381.021416][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 382.338757][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 383.103999][ T7587] hsr_slave_0: entered promiscuous mode [ 383.128976][ T7587] hsr_slave_1: entered promiscuous mode [ 383.141290][ T7587] debugfs: 'hsr0' already exists in 'hsr' [ 383.141384][ T7587] Cannot create hsr debugfs directory [ 383.913210][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 383.921062][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 387.037766][ T7909] netlink: 'syz.0.537': attribute type 1 has an invalid length. [ 387.067949][ T7909] netlink: 756 bytes leftover after parsing attributes in process `syz.0.537'. [ 387.429867][ T5603] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 387.509881][ T5603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 387.538954][ T5603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 387.544085][ T5603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 387.570501][ T5603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 387.590569][ T7909] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 388.622118][ T5250] 8021q: adding VLAN 0 to HW filter on device eth6 [ 389.749055][ T5602] Bluetooth: hci1: command tx timeout [ 391.836124][ T5602] Bluetooth: hci1: command tx timeout [ 392.357697][ T7982] netlink: 'syz.3.553': attribute type 1 has an invalid length. [ 392.366138][ T7982] netlink: 756 bytes leftover after parsing attributes in process `syz.3.553'. [ 393.434270][ T3377] bridge_slave_1: left allmulticast mode [ 393.440182][ T3377] bridge_slave_1: left promiscuous mode [ 393.440396][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.674381][ T3377] bridge_slave_0: left allmulticast mode [ 393.681377][ T3377] bridge_slave_0: left promiscuous mode [ 393.710874][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.908852][ T5602] Bluetooth: hci1: command tx timeout [ 394.568921][ T3377] bridge_slave_1: left allmulticast mode [ 394.574802][ T3377] bridge_slave_1: left promiscuous mode [ 394.575088][ T3377] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.730057][ T3377] bridge_slave_0: left allmulticast mode [ 394.735933][ T3377] bridge_slave_0: left promiscuous mode [ 394.736163][ T3377] bridge0: port 1(bridge_slave_0) entered disabled state [ 395.980032][ T5602] Bluetooth: hci1: command tx timeout [ 396.271037][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 396.357974][ T8014] netlink: 'syz.3.562': attribute type 1 has an invalid length. [ 396.390669][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 396.471863][ T3377] bond0 (unregistering): Released all slaves [ 396.959883][ T3377] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 397.039682][ T3377] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 397.103485][ T3377] bond0 (unregistering): Released all slaves [ 397.274650][ T8014] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 398.890972][ T8031] netlink: 'syz.0.564': attribute type 1 has an invalid length. [ 398.891459][ T8031] netlink: 'syz.0.564': attribute type 2 has an invalid length. [ 399.113775][ T3377] hsr_slave_0: left promiscuous mode [ 399.149268][ T3377] hsr_slave_1: left promiscuous mode [ 399.155499][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 399.693964][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 400.062184][ T3377] hsr_slave_0: left promiscuous mode [ 400.140553][ T3377] hsr_slave_1: left promiscuous mode [ 400.163698][ T8045] netlink: 'syz.1.567': attribute type 1 has an invalid length. [ 400.171594][ T8045] netlink: 756 bytes leftover after parsing attributes in process `syz.1.567'. [ 400.181574][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 400.237134][ T3377] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.076822][ T8045] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 401.312824][ T8057] netlink: 'syz.3.573': attribute type 1 has an invalid length. [ 401.690102][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 401.760828][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 402.644489][ T3377] team0 (unregistering): Port device team_slave_1 removed [ 402.699766][ T3377] team0 (unregistering): Port device team_slave_0 removed [ 403.210271][ T8057] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 404.608895][ T7587] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 404.660640][ T5794] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 404.759668][ T7587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 404.887086][ T7587] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 404.893342][ T5794] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 404.896212][ T5794] usb 1-1: config 0 has no interfaces? [ 405.014077][ T5794] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.022413][ T5794] usb 1-1: Product: syz [ 405.022440][ T5794] usb 1-1: Manufacturer: syz [ 405.022459][ T5794] usb 1-1: SerialNumber: syz [ 405.068449][ T7587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 405.081989][ T5794] usb 1-1: config 0 descriptor?? [ 405.085389][ T7912] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.086234][ T7912] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.147591][ T7912] bridge_slave_0: entered allmulticast mode [ 405.167955][ T7912] bridge_slave_0: entered promiscuous mode [ 405.311745][ T7587] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 405.412220][ T9] usb 1-1: USB disconnect, device number 4 [ 405.449914][ T7587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 405.598747][ T7912] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.606096][ T7912] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.606318][ T7912] bridge_slave_1: entered allmulticast mode [ 405.656567][ T7912] bridge_slave_1: entered promiscuous mode [ 406.059841][ T7587] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 406.130941][ T7587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 406.335597][ T8104] netlink: 'syz.1.582': attribute type 1 has an invalid length. [ 406.338560][ T8104] netlink: 756 bytes leftover after parsing attributes in process `syz.1.582'. [ 406.468823][ T8103] netlink: 'syz.0.583': attribute type 1 has an invalid length. [ 406.478270][ T8103] netlink: 'syz.0.583': attribute type 2 has an invalid length. [ 406.496498][ T7912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 406.534552][ T7912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 406.609253][ T8103] 9pnet_virtio: no channels available for device syz [ 406.835441][ T8104] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 407.037122][ T7912] team0: Port device team_slave_0 added [ 407.051508][ T7912] team0: Port device team_slave_1 added [ 408.188988][ T7912] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 408.189089][ T7912] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 408.189121][ T7912] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 408.257194][ T7912] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 408.257215][ T7912] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 408.257246][ T7912] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 408.528759][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 408.538758][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 408.548758][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 408.558754][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 408.568739][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 408.944647][ T8123] 9p: Bad value for 'rfdno' [ 409.561744][ T7912] hsr_slave_0: entered promiscuous mode [ 409.618072][ T7912] hsr_slave_1: entered promiscuous mode [ 409.786594][ T8128] /dev/sg0: Can't lookup blockdev [ 410.237108][ T7587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 411.486169][ T7587] 8021q: adding VLAN 0 to HW filter on device team0 [ 411.588969][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 411.721160][ T2384] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.721547][ T2384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.797676][ T9] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 411.812063][ T9] usb 1-1: config 0 has no interfaces? [ 411.834953][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.841413][ T9] usb 1-1: Product: syz [ 411.841433][ T9] usb 1-1: Manufacturer: syz [ 411.841448][ T9] usb 1-1: SerialNumber: syz [ 411.895073][ T9] usb 1-1: config 0 descriptor?? [ 411.969653][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.969891][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.183091][ T9] usb 1-1: USB disconnect, device number 5 [ 417.386505][ T7912] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 417.389387][ T8160] netlink: 'syz.0.597': attribute type 1 has an invalid length. [ 417.389410][ T8160] netlink: 756 bytes leftover after parsing attributes in process `syz.0.597'. [ 417.458145][ T7912] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 417.481872][ T7912] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 417.848071][ T7912] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 417.869565][ T7912] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 417.979466][ T8158] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 418.024047][ T7912] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 418.055492][ T7912] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 419.087087][ T7912] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 421.395340][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 421.437351][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 421.462676][ T5603] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 421.579089][ T5794] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 421.613014][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 421.622475][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 421.731306][ T5794] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 421.746928][ T5794] usb 4-1: config 0 has no interfaces? [ 421.793097][ T5794] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.801642][ T5794] usb 4-1: Product: syz [ 421.801664][ T5794] usb 4-1: Manufacturer: syz [ 421.801681][ T5794] usb 4-1: SerialNumber: syz [ 421.875127][ T5794] usb 4-1: config 0 descriptor?? [ 423.839590][ T5602] Bluetooth: hci2: command tx timeout [ 425.899605][ T5602] Bluetooth: hci2: command tx timeout [ 426.829779][ T5794] usb 4-1: USB disconnect, device number 3 [ 428.012163][ T5602] Bluetooth: hci2: command tx timeout [ 430.114629][ T5602] Bluetooth: hci2: command tx timeout [ 430.935888][ T8212] netlink: 'syz.3.608': attribute type 1 has an invalid length. [ 430.944950][ T8212] netlink: 'syz.3.608': attribute type 2 has an invalid length. [ 431.142879][ T7912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.270860][ T7912] 8021q: adding VLAN 0 to HW filter on device team0 [ 433.870806][ T1017] bridge0: port 1(bridge_slave_0) entered blocking state [ 433.871259][ T1017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.943870][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.959264][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 433.990684][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 436.100467][ T9] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 436.114247][ T9] usb 4-1: config 0 has no interfaces? [ 436.127416][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.136009][ T9] usb 4-1: Product: syz [ 436.136031][ T9] usb 4-1: Manufacturer: syz [ 436.136047][ T9] usb 4-1: SerialNumber: syz [ 436.182678][ T9] usb 4-1: config 0 descriptor?? [ 436.419134][ T5745] usb 4-1: USB disconnect, device number 4 [ 438.804573][ T8258] netlink: 12 bytes leftover after parsing attributes in process `syz.1.617'. [ 438.832031][ T8259] jffs2: notice: (8259) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 439.263507][ T8264] netlink: 'syz.0.619': attribute type 1 has an invalid length. [ 439.265266][ T8264] netlink: 'syz.0.619': attribute type 2 has an invalid length. [ 442.938910][ T5601] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 443.114621][ T5601] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 443.125582][ T5601] usb 2-1: config 0 has no interfaces? [ 443.147261][ T5601] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.155793][ T5601] usb 2-1: Product: syz [ 443.155821][ T5601] usb 2-1: Manufacturer: syz [ 443.155835][ T5601] usb 2-1: SerialNumber: syz [ 443.200721][ T5601] usb 2-1: config 0 descriptor?? [ 443.224422][ T8315] /dev/sg0: Can't lookup blockdev [ 443.448613][ T5794] usb 2-1: USB disconnect, device number 5 [ 443.452803][ T8169] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.457065][ T8169] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.463382][ T8169] bridge_slave_0: entered allmulticast mode [ 443.556756][ T8169] bridge_slave_0: entered promiscuous mode [ 443.839882][ T1379] bridge_slave_1: left allmulticast mode [ 443.840141][ T1379] bridge_slave_1: left promiscuous mode [ 443.840432][ T1379] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.997333][ T1379] bridge_slave_0: left allmulticast mode [ 444.000550][ T1379] bridge_slave_0: left promiscuous mode [ 444.004253][ T1379] bridge0: port 1(bridge_slave_0) entered disabled state [ 445.363783][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.382336][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 447.110099][ T1379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.206565][ T1379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.206679][ T8370] fuse: Bad value for 'fd' [ 447.264105][ T1379] bond0 (unregistering): Released all slaves [ 447.332128][ T8169] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.332351][ T8169] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.332559][ T8169] bridge_slave_1: entered allmulticast mode [ 447.365356][ T8169] bridge_slave_1: entered promiscuous mode [ 447.461863][ T5794] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 447.695254][ T5794] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 447.995818][ T5794] usb 2-1: config 0 has no interfaces? [ 448.071764][ T5794] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.072106][ T5794] usb 2-1: Product: syz [ 448.072432][ T5794] usb 2-1: Manufacturer: syz [ 448.072450][ T5794] usb 2-1: SerialNumber: syz [ 450.101213][ T8169] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 450.794690][ T5794] usb 2-1: config 0 descriptor?? [ 450.801987][ C0] raw-gadget.0 gadget.1: ignoring, device is not running [ 450.808445][ T5794] usb 2-1: can't set config #0, error -32 [ 450.942233][ T8169] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.027411][ T5603] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 451.049464][ T5794] usb 2-1: USB disconnect, device number 6 [ 451.066573][ T5603] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 451.087028][ T5603] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 451.096995][ T5603] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 451.114369][ T5603] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 451.422180][ T1379] hsr_slave_0: left promiscuous mode [ 451.459145][ T1379] hsr_slave_1: left promiscuous mode [ 451.473155][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 451.527631][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.283476][ T38] audit: type=1800 audit(1787936973.059:12): pid=8390 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.647" name="syztnl1" dev="sda1" ino=2059 res=0 errno=0 [ 454.315550][ T5602] Bluetooth: hci5: command tx timeout [ 454.815318][ T8401] /dev/sg0: Can't lookup blockdev [ 455.405774][ T8405] fuse: Bad value for 'fd' [ 455.467193][ T1379] team0 (unregistering): Port device team_slave_1 removed [ 455.551833][ T1379] team0 (unregistering): Port device team_slave_0 removed [ 455.999186][ T10] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 456.181123][ T10] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 456.193541][ T10] usb 1-1: config 0 has no interfaces? [ 456.198279][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.198308][ T10] usb 1-1: Product: syz [ 456.198324][ T10] usb 1-1: Manufacturer: syz [ 456.198339][ T10] usb 1-1: SerialNumber: syz [ 456.288350][ T10] usb 1-1: config 0 descriptor?? [ 456.358085][ T8169] team0: Port device team_slave_0 added [ 456.378832][ T5602] Bluetooth: hci5: command tx timeout [ 456.395178][ T8169] team0: Port device team_slave_1 added [ 456.560349][ T10] usb 1-1: USB disconnect, device number 6 [ 456.760818][ T8169] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 456.761021][ T8169] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 456.761049][ T8169] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 457.090283][ T8169] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 457.099309][ T8169] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.099346][ T8169] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 457.879024][ T8429] 9p: Bad value for 'rfdno' [ 458.459046][ T5602] Bluetooth: hci5: command tx timeout [ 459.635130][ T8169] hsr_slave_0: entered promiscuous mode [ 459.652848][ T8169] hsr_slave_1: entered promiscuous mode [ 459.665966][ T8169] debugfs: 'hsr0' already exists in 'hsr' [ 459.666515][ T8169] Cannot create hsr debugfs directory [ 459.955848][ T8440] /dev/sg0: Can't lookup blockdev [ 460.302500][ T8446] fuse: Bad value for 'fd' [ 460.539042][ T5602] Bluetooth: hci5: command tx timeout [ 461.260626][ T998] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 461.440027][ T998] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 461.450109][ T998] usb 4-1: config 0 has no interfaces? [ 461.463126][ T998] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.463473][ T998] usb 4-1: Product: syz [ 461.463523][ T998] usb 4-1: Manufacturer: syz [ 461.463564][ T998] usb 4-1: SerialNumber: syz [ 461.532565][ T998] usb 4-1: config 0 descriptor?? [ 462.005963][ T9] usb 4-1: USB disconnect, device number 5 [ 463.851137][ T5250] 8021q: adding VLAN 0 to HW filter on device eth11 [ 464.586466][ T8482] 9p: Bad value for 'rfdno' [ 466.735390][ T8516] /dev/sg0: Can't lookup blockdev [ 467.939391][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 468.174268][ T9] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 468.260048][ T9] usb 1-1: config 0 has no interfaces? [ 468.437941][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.444141][ T9] usb 1-1: Product: syz [ 468.444163][ T9] usb 1-1: Manufacturer: syz [ 468.444230][ T9] usb 1-1: SerialNumber: syz [ 468.587351][ T9] usb 1-1: config 0 descriptor?? [ 469.312901][ T5601] usb 1-1: USB disconnect, device number 7 [ 470.238297][ T8551] 9p: Bad value for 'rfdno' [ 471.006243][ T8377] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.016640][ T8377] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.018257][ T8377] bridge_slave_0: entered allmulticast mode [ 471.039219][ T8377] bridge_slave_0: entered promiscuous mode [ 471.086439][ T8574] FAULT_INJECTION: forcing a failure. [ 471.086439][ T8574] name failslab, interval 1, probability 0, space 0, times 0 [ 471.099619][ T8574] CPU: 0 UID: 0 PID: 8574 Comm: syz.0.686 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 471.099647][ T8574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 471.099660][ T8574] Call Trace: [ 471.099670][ T8574] [ 471.099680][ T8574] dump_stack_lvl+0xe8/0x150 [ 471.099720][ T8574] should_fail_ex+0x46b/0x600 [ 471.099762][ T8574] should_failslab+0xa8/0x100 [ 471.099799][ T8574] __kmalloc_noprof+0xfb/0x790 [ 471.099829][ T8574] ? sk_prot_alloc+0x57/0x210 [ 471.099854][ T8574] ? security_sk_alloc+0x52/0x360 [ 471.099885][ T8574] ? security_sk_alloc+0x52/0x360 [ 471.099924][ T8574] security_sk_alloc+0x52/0x360 [ 471.099959][ T8574] sk_prot_alloc+0x101/0x210 [ 471.099990][ T8574] sk_alloc+0x3a/0x390 [ 471.100020][ T8574] inet6_create+0x81a/0x1280 [ 471.100040][ T8574] ? inet6_create+0x80/0x1280 [ 471.100061][ T8574] __sock_create+0x4b3/0x9d0 [ 471.100091][ T8574] __sys_socket+0xd6/0x1b0 [ 471.100117][ T8574] __x64_sys_socket+0x7a/0x90 [ 471.100138][ T8574] do_syscall_64+0x166/0x520 [ 471.100160][ T8574] ? trace_irq_disable+0x3b/0x140 [ 471.100188][ T8574] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.100211][ T8574] ? clear_bhb_loop+0x70/0xc0 [ 471.100241][ T8574] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.100264][ T8574] RIP: 0033:0x7fb0fb50e159 [ 471.100287][ T8574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.100306][ T8574] RSP: 002b:00007fb0f9766028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 471.100331][ T8574] RAX: ffffffffffffffda RBX: 00007fb0fb795fa0 RCX: 00007fb0fb50e159 [ 471.100348][ T8574] RDX: 0000000000000084 RSI: 0000000000000005 RDI: 000000000000000a [ 471.100362][ T8574] RBP: 00007fb0fb5a5024 R08: 0000000000000000 R09: 0000000000000000 [ 471.100383][ T8574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 471.100396][ T8574] R13: 00007fb0fb796038 R14: 00007fb0fb795fa0 R15: 00007fff45b8b128 [ 471.100443][ T8574] [ 471.184732][ T8377] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.185091][ T8377] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.335764][ T8377] bridge_slave_1: entered allmulticast mode [ 471.370629][ T8579] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 471.418544][ T8570] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 471.454667][ T8377] bridge_slave_1: entered promiscuous mode [ 472.033563][ T8377] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 472.075024][ T8377] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 472.538501][ T8377] team0: Port device team_slave_0 added [ 472.627793][ T8598] 9pnet_virtio: no channels available for device syz [ 473.064729][ T8377] team0: Port device team_slave_1 added [ 473.120740][ T8595] netlink: 'syz.1.692': attribute type 1 has an invalid length. [ 473.122031][ T8595] netlink: 'syz.1.692': attribute type 2 has an invalid length. [ 473.597368][ T8614] netlink: 24 bytes leftover after parsing attributes in process `syz.0.694'. [ 473.968137][ T8377] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 473.978370][ T8377] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.978413][ T8377] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 474.065291][ T8377] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 474.065559][ T8377] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.065589][ T8377] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 474.159150][ T8627] netlink: 'syz.1.695': attribute type 1 has an invalid length. [ 474.159316][ T8627] netlink: 756 bytes leftover after parsing attributes in process `syz.1.695'. [ 474.301813][ T8626] FAULT_INJECTION: forcing a failure. [ 474.301813][ T8626] name failslab, interval 1, probability 0, space 0, times 0 [ 474.302034][ T8626] CPU: 0 UID: 0 PID: 8626 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 474.302067][ T8626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 474.302082][ T8626] Call Trace: [ 474.302091][ T8626] [ 474.302101][ T8626] dump_stack_lvl+0xe8/0x150 [ 474.302141][ T8626] should_fail_ex+0x46b/0x600 [ 474.302185][ T8626] should_failslab+0xa8/0x100 [ 474.302221][ T8626] __kmalloc_cache_noprof+0xa1/0x680 [ 474.302253][ T8626] ? sctp_auth_shkey_create+0x7a/0x1b0 [ 474.302289][ T8626] ? sctp_auth_shkey_create+0x7a/0x1b0 [ 474.302324][ T8626] sctp_auth_shkey_create+0x7a/0x1b0 [ 474.302356][ T8626] sctp_endpoint_new+0x457/0xa70 [ 474.302397][ T8626] ? __pfx_sctp_endpoint_new+0x10/0x10 [ 474.302447][ T8626] sctp_init_sock+0x94e/0x1380 [ 474.302486][ T8626] sctp_v6_init_sock+0x16/0x70 [ 474.302521][ T8626] inet6_create+0xf0b/0x1280 [ 474.302547][ T8626] ? inet6_create+0x80/0x1280 [ 474.302575][ T8626] __sock_create+0x4b3/0x9d0 [ 474.302608][ T8626] __sys_socket+0xd6/0x1b0 [ 474.302635][ T8626] __x64_sys_socket+0x7a/0x90 [ 474.302659][ T8626] do_syscall_64+0x166/0x520 [ 474.302681][ T8626] ? trace_irq_disable+0x3b/0x140 [ 474.302709][ T8626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.302733][ T8626] ? clear_bhb_loop+0x70/0xc0 [ 474.302763][ T8626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.302786][ T8626] RIP: 0033:0x7fb0fb50e159 [ 474.302808][ T8626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 474.302827][ T8626] RSP: 002b:00007fb0f9766028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 474.302853][ T8626] RAX: ffffffffffffffda RBX: 00007fb0fb795fa0 RCX: 00007fb0fb50e159 [ 474.302871][ T8626] RDX: 0000000000000084 RSI: 0000000000000005 RDI: 000000000000000a [ 474.302885][ T8626] RBP: 00007fb0fb5a5024 R08: 0000000000000000 R09: 0000000000000000 [ 474.302900][ T8626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 474.302914][ T8626] R13: 00007fb0fb796038 R14: 00007fb0fb795fa0 R15: 00007fff45b8b128 [ 474.302951][ T8626] [ 474.656947][ T1379] bridge_slave_1: left allmulticast mode [ 474.657135][ T1379] bridge_slave_1: left promiscuous mode [ 474.658045][ T1379] bridge0: port 2(bridge_slave_1) entered disabled state [ 475.158021][ T8621] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 475.301204][ T1379] bridge_slave_0: left allmulticast mode [ 475.307435][ T1379] bridge_slave_0: left promiscuous mode [ 475.307707][ T1379] bridge0: port 1(bridge_slave_0) entered disabled state [ 475.617088][ T8642] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 475.667857][ T8637] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 476.910682][ T8663] 9pnet_virtio: no channels available for device syz [ 477.079932][ T1379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 477.104886][ T8669] netlink: 12 bytes leftover after parsing attributes in process `syz.1.702'. [ 477.162767][ T1379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 477.227879][ T1379] bond0 (unregistering): Released all slaves [ 477.483622][ T8660] netlink: 'syz.3.701': attribute type 1 has an invalid length. [ 477.493551][ T8660] netlink: 'syz.3.701': attribute type 2 has an invalid length. [ 477.996407][ T1379] hsr_slave_0: left promiscuous mode [ 478.049313][ T1379] hsr_slave_1: left promiscuous mode [ 478.057414][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 478.090012][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 478.319269][ T8687] FAULT_INJECTION: forcing a failure. [ 478.319269][ T8687] name failslab, interval 1, probability 0, space 0, times 0 [ 478.319517][ T8687] CPU: 1 UID: 0 PID: 8687 Comm: syz.3.705 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 478.319545][ T8687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 478.319558][ T8687] Call Trace: [ 478.319567][ T8687] [ 478.319576][ T8687] dump_stack_lvl+0xe8/0x150 [ 478.319737][ T8687] should_fail_ex+0x46b/0x600 [ 478.319847][ T8687] should_failslab+0xa8/0x100 [ 478.319949][ T8687] __kmalloc_cache_noprof+0xa1/0x680 [ 478.320017][ T8687] ? lock_acquire+0x115/0x350 [ 478.320084][ T8687] ? sctp_endpoint_new+0xe1/0xa70 [ 478.320178][ T8687] ? sctp_endpoint_new+0xe1/0xa70 [ 478.320285][ T8687] sctp_endpoint_new+0xe1/0xa70 [ 478.320388][ T8687] ? __pfx_sctp_endpoint_new+0x10/0x10 [ 478.320522][ T8687] sctp_init_sock+0x94e/0x1380 [ 478.320622][ T8687] sctp_v6_init_sock+0x16/0x70 [ 478.320708][ T8687] inet6_create+0xf0b/0x1280 [ 478.320772][ T8687] ? inet6_create+0x80/0x1280 [ 478.320846][ T8687] __sock_create+0x4b3/0x9d0 [ 478.320906][ T8687] __sys_socket+0xd6/0x1b0 [ 478.320978][ T8687] __x64_sys_socket+0x7a/0x90 [ 478.321043][ T8687] do_syscall_64+0x166/0x520 [ 478.321093][ T8687] ? trace_irq_disable+0x3b/0x140 [ 478.321121][ T8687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.321179][ T8687] ? clear_bhb_loop+0x70/0xc0 [ 478.321266][ T8687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.321329][ T8687] RIP: 0033:0x7f80c463e159 [ 478.321390][ T8687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.321435][ T8687] RSP: 002b:00007f80c2896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 478.321537][ T8687] RAX: ffffffffffffffda RBX: 00007f80c48c5fa0 RCX: 00007f80c463e159 [ 478.321586][ T8687] RDX: 0000000000000084 RSI: 0000000000000005 RDI: 000000000000000a [ 478.321620][ T8687] RBP: 00007f80c46d5024 R08: 0000000000000000 R09: 0000000000000000 [ 478.321663][ T8687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 478.321696][ T8687] R13: 00007f80c48c6038 R14: 00007f80c48c5fa0 R15: 00007ffea6c35738 [ 478.321789][ T8687] [ 478.678334][ T5603] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 478.726472][ T5603] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 478.734615][ T5603] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 478.737754][ T5603] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 478.754819][ T5603] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 478.874048][ T8693] netlink: 76 bytes leftover after parsing attributes in process `syz.3.706'. [ 480.966916][ T5602] Bluetooth: hci1: command tx timeout [ 483.137484][ T5602] Bluetooth: hci1: command tx timeout [ 483.990302][ T1379] team0 (unregistering): Port device team_slave_1 removed [ 484.049890][ T1379] team0 (unregistering): Port device team_slave_0 removed [ 484.266759][ T8377] hsr_slave_0: entered promiscuous mode [ 484.272839][ T8377] hsr_slave_1: entered promiscuous mode [ 485.193043][ T8728] netlink: 28 bytes leftover after parsing attributes in process `syz.1.714'. [ 485.269030][ T5602] Bluetooth: hci1: command tx timeout [ 485.312483][ T8722] netlink: 'syz.0.713': attribute type 1 has an invalid length. [ 485.312508][ T8722] netlink: 'syz.0.713': attribute type 2 has an invalid length. [ 485.427649][ T8725] 9pnet_virtio: no channels available for device syz [ 487.343614][ T5602] Bluetooth: hci1: command tx timeout [ 488.550625][ T5250] 8021q: adding VLAN 0 to HW filter on device eth9 [ 493.068109][ T8786] 9pnet_virtio: no channels available for device syz [ 493.653053][ T8783] netlink: 'syz.1.724': attribute type 1 has an invalid length. [ 493.665980][ T8783] netlink: 'syz.1.724': attribute type 2 has an invalid length. [ 494.271637][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 494.485449][ T9] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 494.513321][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 494.516619][ T9] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 494.516648][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 494.516697][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.203964][ T8808] kAFS: unable to lookup cell '/,c¾ûL' [ 496.820867][ T9] cxacru 2-1:1.0: send of cm 0x90 failed (-104) [ 497.145161][ T9] cxacru 2-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 497.256677][ T9] cxacru 2-1:1.0: probe with driver cxacru failed with error -22 [ 497.352045][ T9] usb 2-1: USB disconnect, device number 7 [ 499.976053][ T38] audit: type=1326 audit(1787937020.899:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8824 comm="syz.1.731" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc8c38ce159 code=0x0 [ 500.711127][ T8689] bridge0: port 1(bridge_slave_0) entered blocking state [ 500.713256][ T8689] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.713470][ T8689] bridge_slave_0: entered allmulticast mode [ 500.718107][ T8689] bridge_slave_0: entered promiscuous mode [ 500.770731][ T8842] netlink: 'syz.0.734': attribute type 1 has an invalid length. [ 500.780833][ T8842] netlink: 'syz.0.734': attribute type 2 has an invalid length. [ 500.784389][ T8689] bridge0: port 2(bridge_slave_1) entered blocking state [ 500.784637][ T8689] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.784813][ T8689] bridge_slave_1: entered allmulticast mode [ 500.823169][ T8689] bridge_slave_1: entered promiscuous mode [ 500.847112][ T8842] 9pnet_virtio: no channels available for device syz [ 502.117901][ T8689] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 502.159771][ T8689] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 502.337653][ T8377] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 502.440053][ T8377] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 502.452762][ T8864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.738'. [ 502.747639][ T8864] netlink: 76 bytes leftover after parsing attributes in process `syz.3.738'. [ 502.747712][ T8377] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 502.847422][ T8377] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 503.079723][ T8689] team0: Port device team_slave_0 added [ 503.094988][ T8377] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 503.184196][ T8377] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 503.495830][ T8689] team0: Port device team_slave_1 added [ 503.511005][ T8377] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 503.879354][ T8377] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 504.677803][ T8689] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 504.679387][ T8689] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 504.679488][ T8689] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 505.018325][ T8689] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 505.019133][ T8689] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 505.019166][ T8689] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 505.520890][ T1379] bridge_slave_1: left allmulticast mode [ 505.521190][ T1379] bridge_slave_1: left promiscuous mode [ 505.521930][ T1379] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.662230][ T1379] bridge_slave_0: left allmulticast mode [ 505.662574][ T1379] bridge_slave_0: left promiscuous mode [ 505.663377][ T1379] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.241722][ T1379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 506.360023][ T1379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 506.440687][ T1379] bond0 (unregistering): Released all slaves [ 506.641357][ T8689] hsr_slave_0: entered promiscuous mode [ 506.642767][ T8689] hsr_slave_1: entered promiscuous mode [ 506.643708][ T8689] debugfs: 'hsr0' already exists in 'hsr' [ 506.643732][ T8689] Cannot create hsr debugfs directory [ 506.792635][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.792866][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 507.120849][ T8888] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 507.134203][ T8888] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 507.572469][ T1379] hsr_slave_0: left promiscuous mode [ 507.608998][ T1379] hsr_slave_1: left promiscuous mode [ 507.616652][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 507.664375][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 507.676538][ T8888] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 507.677200][ T8888] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 507.722157][ T8888] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 507.731691][ T8888] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 507.801949][ T8888] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 507.897703][ T8888] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 507.904160][ T8888] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 507.985162][ T8888] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 508.230517][ T1379] team0 (unregistering): Port device team_slave_1 removed [ 508.259903][ T8910] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 508.378174][ T1379] team0 (unregistering): Port device team_slave_0 removed [ 509.899940][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 509.920751][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 509.924906][ T5603] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 510.779346][ T5603] Bluetooth: hci3: command 0x0406 tx timeout [ 510.788430][ T5603] Bluetooth: hci5: command 0x0c1a tx timeout [ 510.788571][ T5603] Bluetooth: hci4: command 0x0406 tx timeout [ 510.788604][ T5603] Bluetooth: hci1: command 0x0c1a tx timeout [ 510.823071][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 510.857211][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 512.165587][ T8949] fuse: Bad value for 'fd' [ 512.388582][ T8953] CacheFiles: Failed to register: -95 [ 512.861128][ T5603] Bluetooth: hci1: command 0x0c1a tx timeout [ 512.872741][ T5603] Bluetooth: hci4: command 0x0406 tx timeout [ 512.872780][ T5603] Bluetooth: hci3: command 0x0406 tx timeout [ 513.112758][ T5602] Bluetooth: hci2: command tx timeout [ 513.849070][ T37] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 514.085248][ T37] usb 1-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 514.122565][ T37] usb 1-1: config 0 has no interfaces? [ 514.143448][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.143653][ T37] usb 1-1: Product: syz [ 514.143672][ T37] usb 1-1: Manufacturer: syz [ 514.143687][ T37] usb 1-1: SerialNumber: syz [ 514.209789][ T37] usb 1-1: config 0 descriptor?? [ 514.243706][ T8986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.770'. [ 514.571787][ T37] usb 1-1: USB disconnect, device number 8 [ 514.593568][ T5250] 8021q: adding VLAN 0 to HW filter on device eth9 [ 514.938969][ T5602] Bluetooth: hci1: command 0x0c1a tx timeout [ 515.189133][ T5602] Bluetooth: hci2: command tx timeout [ 515.333619][ T9000] netlink: 28 bytes leftover after parsing attributes in process `syz.1.775'. [ 517.260316][ T5602] Bluetooth: hci2: command tx timeout [ 517.316659][ T9015] netlink: 8 bytes leftover after parsing attributes in process `syz.3.780'. [ 518.314816][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 518.479935][ T9] usb 4-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 518.494013][ T9] usb 4-1: config 0 has no interfaces? [ 518.512680][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.520932][ T9] usb 4-1: Product: syz [ 518.520955][ T9] usb 4-1: Manufacturer: syz [ 518.520973][ T9] usb 4-1: SerialNumber: syz [ 518.589751][ T9] usb 4-1: config 0 descriptor?? [ 518.872276][ T9] usb 4-1: USB disconnect, device number 6 [ 519.365701][ T5602] Bluetooth: hci2: command tx timeout [ 519.984838][ T8917] bridge0: port 1(bridge_slave_0) entered blocking state [ 519.996920][ T8917] bridge0: port 1(bridge_slave_0) entered disabled state [ 519.997155][ T8917] bridge_slave_0: entered allmulticast mode [ 520.033641][ T8917] bridge_slave_0: entered promiscuous mode [ 520.049639][ T8917] bridge0: port 2(bridge_slave_1) entered blocking state [ 520.060735][ T8917] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.068142][ T8917] bridge_slave_1: entered allmulticast mode [ 520.080927][ T8917] bridge_slave_1: entered promiscuous mode [ 520.088548][ T8689] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 520.112066][ T9063] netlink: 28 bytes leftover after parsing attributes in process `syz.3.790'. [ 520.600848][ T8689] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 520.707920][ T8689] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 520.753224][ T8689] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 521.129142][ T8689] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 521.169221][ T8689] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 521.186124][ T8917] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 521.211221][ T8689] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 521.438467][ T8689] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 521.475429][ T8917] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 521.539228][ T9077] netlink: 28 bytes leftover after parsing attributes in process `syz.1.792'. [ 521.556804][ T9074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.793'. [ 521.666944][ T8917] team0: Port device team_slave_0 added [ 521.687204][ T8917] team0: Port device team_slave_1 added [ 521.799363][ T9083] fuse: Bad value for 'fd' [ 521.904145][ T9085] fuse: Bad value for 'fd' [ 522.006004][ T8917] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 522.006432][ T8917] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.006537][ T8917] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 522.064931][ T8917] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 522.072055][ T8917] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 522.072091][ T8917] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 522.443833][ T8917] hsr_slave_0: entered promiscuous mode [ 522.459769][ T8917] hsr_slave_1: entered promiscuous mode [ 522.468773][ T8917] debugfs: 'hsr0' already exists in 'hsr' [ 522.474646][ T8917] Cannot create hsr debugfs directory [ 524.032698][ T1379] bridge_slave_1: left allmulticast mode [ 524.032928][ T1379] bridge_slave_1: left promiscuous mode [ 524.035872][ T1379] bridge0: port 2(bridge_slave_1) entered disabled state [ 524.802265][ T1379] bridge_slave_0: left allmulticast mode [ 524.802313][ T1379] bridge_slave_0: left promiscuous mode [ 524.802598][ T1379] bridge0: port 1(bridge_slave_0) entered disabled state [ 524.913373][ T9111] netlink: 28 bytes leftover after parsing attributes in process `syz.0.801'. [ 525.229680][ T1379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 525.291933][ T1379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 525.362302][ T1379] bond0 (unregistering): Released all slaves [ 525.565440][ T9118] netlink: 28 bytes leftover after parsing attributes in process `syz.3.802'. [ 525.978843][ T1379] hsr_slave_0: left promiscuous mode [ 526.010048][ T9128] fuse: Bad value for 'fd' [ 526.020401][ T1379] hsr_slave_1: left promiscuous mode [ 526.029194][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 526.071410][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 527.340546][ T1379] team0 (unregistering): Port device team_slave_1 removed [ 527.567890][ T1379] team0 (unregistering): Port device team_slave_0 removed [ 528.690762][ T5250] 8021q: adding VLAN 0 to HW filter on device eth10 [ 528.989831][ T9164] netlink: 28 bytes leftover after parsing attributes in process `syz.3.811'. [ 529.134176][ T8689] 8021q: adding VLAN 0 to HW filter on device bond0 [ 529.246124][ T8689] 8021q: adding VLAN 0 to HW filter on device team0 [ 529.402472][ T3377] bridge0: port 1(bridge_slave_0) entered blocking state [ 529.409867][ T3377] bridge0: port 1(bridge_slave_0) entered forwarding state [ 529.445372][ T1384] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.445584][ T1384] bridge0: port 2(bridge_slave_1) entered forwarding state [ 529.916328][ T9179] netlink: 28 bytes leftover after parsing attributes in process `syz.3.814'. [ 531.056703][ T9201] /dev/sg0: Can't lookup blockdev [ 531.984484][ T9210] netlink: 28 bytes leftover after parsing attributes in process `syz.0.821'. [ 535.031296][ T9258] netlink: 28 bytes leftover after parsing attributes in process `syz.3.827'. [ 535.147870][ T9261] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 535.687476][ T8689] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.164581][ T9281] netlink: 28 bytes leftover after parsing attributes in process `syz.3.831'. [ 538.859791][ T9308] netlink: 'syz.1.834': attribute type 1 has an invalid length. [ 538.859906][ T9308] netlink: 756 bytes leftover after parsing attributes in process `syz.1.834'. [ 539.233178][ T9308] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 539.804641][ T5602] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 539.920465][ T5602] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 539.935698][ T5602] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 539.948187][ T5602] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 539.949864][ T5602] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 540.561571][ T8917] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 540.750335][ T8917] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 540.822816][ T8917] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 540.873960][ T8917] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 540.882601][ T8917] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 540.934254][ T8917] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 540.944258][ T8917] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 541.136537][ T8917] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 541.297751][ T9337] netlink: 28 bytes leftover after parsing attributes in process `syz.0.839'. [ 542.078983][ T5602] Bluetooth: hci1: command tx timeout [ 542.224760][ T9347] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 543.286935][ T9358] netlink: 28 bytes leftover after parsing attributes in process `syz.3.843'. [ 543.526673][ T9352] tipc: Enabling of bearer rejected, already enabled [ 544.393305][ T5602] Bluetooth: hci1: command tx timeout [ 545.365541][ T9376] netlink: 8 bytes leftover after parsing attributes in process `syz.3.849'. [ 545.369654][ T9377] netlink: 'syz.0.850': attribute type 1 has an invalid length. [ 547.141842][ T5602] Bluetooth: hci1: command tx timeout [ 547.341404][ T9392] tipc: Enabling of bearer rejected, already enabled [ 547.416687][ T8917] 8021q: adding VLAN 0 to HW filter on device bond0 [ 548.464516][ T9415] netlink: 'syz.3.862': attribute type 1 has an invalid length. [ 548.661248][ T8917] 8021q: adding VLAN 0 to HW filter on device team0 [ 548.762325][ T3344] bridge0: port 1(bridge_slave_0) entered blocking state [ 548.764184][ T3344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 548.933631][ T3344] bridge0: port 2(bridge_slave_1) entered blocking state [ 548.941082][ T3344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 549.006842][ T9427] netlink: 8 bytes leftover after parsing attributes in process `syz.3.865'. [ 550.016110][ T5602] Bluetooth: hci1: command tx timeout [ 551.113725][ T9318] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.123430][ T9318] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.129052][ T9318] bridge_slave_0: entered allmulticast mode [ 551.406365][ T9318] bridge_slave_0: entered promiscuous mode [ 552.358929][ T9318] bridge0: port 2(bridge_slave_1) entered blocking state [ 552.366413][ T9318] bridge0: port 2(bridge_slave_1) entered disabled state [ 552.366990][ T9318] bridge_slave_1: entered allmulticast mode [ 552.396770][ T9318] bridge_slave_1: entered promiscuous mode [ 552.492937][ T9457] netlink: 'syz.0.873': attribute type 1 has an invalid length. [ 552.793221][ T9318] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 552.922721][ T9318] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 554.139508][ T9474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.877'. [ 554.207570][ T9470] tipc: Enabling of bearer rejected, already enabled [ 554.427800][ T1379] bridge_slave_1: left allmulticast mode [ 554.441671][ T1379] bridge_slave_1: left promiscuous mode [ 554.461809][ T1379] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.924370][ T9488] netlink: 8 bytes leftover after parsing attributes in process `syz.0.880'. [ 554.931126][ T1379] bridge_slave_0: left allmulticast mode [ 554.931222][ T1379] bridge_slave_0: left promiscuous mode [ 554.932036][ T1379] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.032234][ T9490] netlink: zone id is out of range [ 555.032369][ T9490] netlink: zone id is out of range [ 555.032380][ T9490] netlink: zone id is out of range [ 555.032421][ T9490] netlink: zone id is out of range [ 555.032462][ T9490] netlink: zone id is out of range [ 555.032484][ T9490] netlink: zone id is out of range [ 555.032532][ T9490] netlink: zone id is out of range [ 555.032548][ T9490] netlink: zone id is out of range [ 555.032577][ T9490] netlink: zone id is out of range [ 555.032606][ T9490] netlink: zone id is out of range [ 555.310936][ T9493] netlink: 'syz.1.883': attribute type 1 has an invalid length. [ 555.649568][ T1379] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 555.729422][ T1379] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 555.751227][ T1379] bond0 (unregistering): Released all slaves [ 555.772630][ T9318] team0: Port device team_slave_0 added [ 555.891247][ T9318] team0: Port device team_slave_1 added [ 555.956491][ T9318] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 555.956556][ T9318] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 555.956588][ T9318] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 555.966437][ T9318] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 555.966494][ T9318] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 555.966526][ T9318] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 556.717848][ T1379] hsr_slave_0: left promiscuous mode [ 557.731626][ T1379] hsr_slave_1: left promiscuous mode [ 557.732960][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 557.894079][ T1379] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 557.917923][ T9518] netlink: 12 bytes leftover after parsing attributes in process `syz.3.889'. [ 558.919555][ T1379] team0 (unregistering): Port device team_slave_1 removed [ 558.959504][ T1379] team0 (unregistering): Port device team_slave_0 removed [ 559.204585][ T9516] tipc: Enabling of bearer rejected, already enabled [ 559.405018][ T9534] netlink: 'syz.1.893': attribute type 1 has an invalid length. [ 559.426451][ T9318] hsr_slave_0: entered promiscuous mode [ 559.435972][ T9318] hsr_slave_1: entered promiscuous mode [ 561.924614][ T9566] /dev/sg0: Can't lookup blockdev [ 562.119816][ T9571] tipc: New replicast peer: 172.20.20.187 [ 562.142845][ T9571] tipc: Enabled bearer , priority 10 [ 562.615738][ T9582] netlink: 12 bytes leftover after parsing attributes in process `syz.3.903'. [ 562.690912][ T9584] netlink: 'syz.0.904': attribute type 1 has an invalid length. [ 563.074066][ T5250] 8021q: adding VLAN 0 to HW filter on device eth9 [ 565.670873][ T8917] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 566.360663][ T9624] /dev/sg0: Can't lookup blockdev [ 566.801994][ T9628] netlink: 'syz.3.915': attribute type 1 has an invalid length. [ 567.381857][ T9639] netlink: 12 bytes leftover after parsing attributes in process `syz.3.916'. [ 568.220987][ T1327] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.223605][ T1327] ieee802154 phy1 wpan1: encryption failed: -22 [ 570.224673][ T5603] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 570.301739][ T5603] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 570.345916][ T5603] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 570.422892][ T5603] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 570.526245][ T5603] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 571.710926][ T9692] warning: `syz.3.924' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 572.257562][ T9318] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 573.869916][ T5602] Bluetooth: hci2: command tx timeout [ 573.980952][ T9318] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 575.899152][ T5602] Bluetooth: hci2: command tx timeout [ 578.001917][ T5602] Bluetooth: hci2: command tx timeout [ 578.181853][ T9318] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 578.377388][ T9318] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 578.389666][ T9318] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 578.449708][ T9318] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 578.545686][ T9318] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 578.684975][ T9736] netlink: 12 bytes leftover after parsing attributes in process `syz.0.931'. [ 578.694698][ T9318] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 579.070143][ T9687] udc usbip-vudc.0: failed to start g1: -4 [ 579.076412][ T9687] configfs-gadget.g1 gadget.32: probe with driver configfs-gadget.g1 failed with error -4 [ 579.125261][ T9687] UDC core: g1: couldn't find an available UDC or it's busy [ 580.450362][ T5602] Bluetooth: hci2: command tx timeout [ 580.481090][ T9758] kAFS: unable to lookup cell '/,c¾ûL' [ 583.234541][ T9805] netlink: 12 bytes leftover after parsing attributes in process `syz.1.944'. [ 583.324762][ T9808] kAFS: unable to lookup cell '/,c¾ûL' [ 583.610937][ T9814] netlink: 'syz.0.947': attribute type 1 has an invalid length. [ 583.679597][ T38] audit: type=1326 audit(1787937104.639:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9813 comm="syz.3.948" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f80c463e159 code=0x0 [ 583.704546][ T9814] bond2: entered promiscuous mode [ 583.704947][ T9814] 8021q: adding VLAN 0 to HW filter on device bond2 [ 586.754154][ T9838] netlink: 12 bytes leftover after parsing attributes in process `syz.3.954'. [ 587.467793][ T9318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 587.632324][ T9849] kAFS: unable to lookup cell '/,c¾ûL' [ 587.906231][ T9847] ================================================================== [ 587.906251][ T9847] BUG: KASAN: slab-use-after-free in pn_bind+0x106/0xb20 [ 587.906291][ T9847] Write of size 8 at addr ffff88803fc70900 by task syz.3.956/9847 [ 587.906311][ ** replaying previous printk message ** [ 587.906311][ T9847] [ 587.906325][ T9847] CPU: 0 UID: 0 PID: 9847 Comm: syz.3.956 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 587.906351][ T9847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 587.906366][ T9847] Call Trace: [ 587.906376][ T9847] [ 587.906385][ T9847] dump_stack_lvl+0xe8/0x150 [ 587.906421][ T9847] print_address_description+0x55/0x1e0 [ 587.906458][ T9847] ? pn_bind+0x106/0xb20 [ 587.906490][ T9847] print_report+0x58/0x70 [ 587.906519][ T9847] kasan_report+0x117/0x150 [ 587.906555][ T9847] ? pn_bind+0x106/0xb20 [ 587.906593][ T9847] pn_bind+0x106/0xb20 [ 587.906630][ T9847] usb_add_function+0x290/0x930 [ 587.906656][ T9847] ? check_remote_wakeup_config+0x58/0x1c0 [ 587.906687][ T9847] configfs_composite_bind+0xde0/0x1410 [ 587.906722][ T9847] ? __pfx_configfs_composite_bind+0x10/0x10 [ 587.906751][ T9847] gadget_bind_driver+0x2ca/0x9e0 [ 587.906779][ T9847] ? __pfx_gadget_bind_driver+0x10/0x10 [ 587.906808][ T9847] really_probe+0x254/0xae0 [ 587.906841][ T9847] __driver_probe_device+0x1e8/0x360 [ 587.906870][ T9847] driver_probe_device+0x4f/0x240 [ 587.906902][ T9847] __driver_attach+0x339/0x600 [ 587.906931][ T9847] bus_for_each_dev+0x23e/0x2c0 [ 587.906965][ T9847] ? __pfx___driver_attach+0x10/0x10 [ 587.906993][ T9847] ? __pfx_bus_for_each_dev+0x10/0x10 [ 587.907031][ T9847] ? rt_spin_unlock+0x165/0x200 [ 587.907063][ T9847] bus_add_driver+0x348/0x670 [ 587.907102][ T9847] driver_register+0x23a/0x320 [ 587.907134][ T9847] usb_gadget_register_driver_owner+0xf9/0x270 [ 587.907172][ T9847] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 587.907196][ T9847] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 587.907252][ T9847] configfs_write_iter+0x33a/0x430 [ 587.907282][ T9847] vfs_write+0x61e/0xbb0 [ 587.907311][ T9847] ? __pfx_vfs_write+0x10/0x10 [ 587.907337][ T9847] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 587.907376][ T9847] ? mutex_lock_nested+0x152/0x1d0 [ 587.907404][ T9847] ? fdget_pos+0x252/0x320 [ 587.907430][ T9847] ksys_write+0x156/0x270 [ 587.907455][ T9847] ? __pfx_ksys_write+0x10/0x10 [ 587.907484][ T9847] do_syscall_64+0x166/0x520 [ 587.907505][ T9847] ? trace_irq_disable+0x3b/0x140 [ 587.907532][ T9847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.907554][ T9847] ? clear_bhb_loop+0x70/0xc0 [ 587.907579][ T9847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.907602][ T9847] RIP: 0033:0x7f80c463e159 [ 587.907621][ T9847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 587.907642][ T9847] RSP: 002b:00007f80c2896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 587.907668][ T9847] RAX: ffffffffffffffda RBX: 00007f80c48c5fa0 RCX: 00007f80c463e159 [ 587.907686][ T9847] RDX: 000000000000000c RSI: 0000200000000480 RDI: 0000000000000005 [ 587.907701][ T9847] RBP: 00007f80c46d5024 R08: 0000000000000000 R09: 0000000000000000 [ 587.907717][ T9847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 587.907732][ T9847] R13: 00007f80c48c6038 R14: 00007f80c48c5fa0 R15: 00007ffea6c35738 [ 587.907758][ T9847] [ 587.907767][ T9847] [ 587.907790][ T9847] Allocated by task 9526: [ 587.907802][ T9847] kasan_save_track+0x3e/0x80 [ 587.907830][ T9847] __kasan_kmalloc+0x93/0xb0 [ 587.907857][ T9847] __kvmalloc_node_noprof+0x5b4/0x890 [ 587.907887][ T9847] alloc_netdev_mqs+0xa9/0x12c0 [ 587.907916][ T9847] phonet_alloc_inst+0xa4/0x190 [ 587.907947][ T9847] usb_get_function_instance+0xe3/0x2f0 [ 587.907976][ T9847] function_make+0x127/0x360 [ 587.907994][ T9847] configfs_mkdir+0x4f6/0x9e0 [ 587.908020][ T9847] vfs_mkdir+0x408/0x620 [ 587.908044][ T9847] filename_mkdirat+0x289/0x520 [ 587.908069][ T9847] __se_sys_mkdirat+0x35/0x150 [ 587.908094][ T9847] do_syscall_64+0x166/0x520 [ 587.908113][ T9847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.908134][ T9847] [ 587.908139][ T9847] Freed by task 9687: [ 587.908149][ T9847] kasan_save_track+0x3e/0x80 [ 587.908174][ T9847] kasan_save_free_info+0x40/0x50 [ 587.908194][ T9847] __kasan_slab_free+0x5c/0x80 [ 587.908221][ T9847] kfree+0x1c5/0x6d0 [ 587.908241][ T9847] pn_bind+0x131/0xb20 [ 587.908272][ T9847] usb_add_function+0x290/0x930 [ 587.908295][ T9847] configfs_composite_bind+0xde0/0x1410 [ 587.908319][ T9847] gadget_bind_driver+0x2ca/0x9e0 [ 587.908338][ T9847] really_probe+0x254/0xae0 [ 587.908362][ T9847] __driver_probe_device+0x1e8/0x360 [ 587.908385][ T9847] driver_probe_device+0x4f/0x240 [ 587.908409][ T9847] __driver_attach+0x339/0x600 [ 587.908432][ T9847] bus_for_each_dev+0x23e/0x2c0 [ 587.908462][ T9847] bus_add_driver+0x348/0x670 [ 587.908493][ T9847] driver_register+0x23a/0x320 [ 587.908520][ T9847] usb_gadget_register_driver_owner+0xf9/0x270 [ 587.908552][ T9847] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 587.908572][ T9847] configfs_write_iter+0x33a/0x430 [ 587.908595][ T9847] vfs_write+0x61e/0xbb0 [ 587.908615][ T9847] ksys_write+0x156/0x270 [ 587.908635][ T9847] do_syscall_64+0x166/0x520 [ 587.908654][ T9847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.908674][ T9847] [ 587.908680][ T9847] The buggy address belongs to the object at ffff88803fc70000 [ 587.908680][ T9847] which belongs to the cache kmalloc-cg-8k of size 8192 [ 587.908700][ T9847] The buggy address is located 2304 bytes inside of [ 587.908700][ T9847] freed 8192-byte region [ffff88803fc70000, ffff88803fc72000) [ 587.908724][ T9847] [ 587.908730][ T9847] The buggy address belongs to the physical page: [ 587.908757][ T9847] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fc70 [ 587.908779][ T9847] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 587.908804][ T9847] memcg:ffff888034874e61 [ 587.908814][ T9847] flags: 0x80000000000040(head|node=0|zone=1) [ 587.908841][ T9847] page_type: f5(slab) [ 587.908863][ T9847] raw: 0080000000000040 ffff88813ff05640 dead000000000100 dead000000000122 [ 587.908884][ T9847] raw: 0000000000000000 0000000200020002 00000000f5000000 ffff888034874e61 [ 587.908905][ T9847] head: 0080000000000040 ffff88813ff05640 dead000000000100 dead000000000122 [ 587.908925][ T9847] head: 0000000000000000 0000000200020002 00000000f5000000 ffff888034874e61 [ 587.908946][ T9847] head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 587.908964][ T9847] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 587.908976][ T9847] page dumped because: kasan: bad access detected [ 587.908991][ T9847] page_owner tracks the page as allocated [ 587.909000][ T9847] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5594, tgid 5594 (syz-executor), ts 103646938945 [ 587.909037][ T9847] post_alloc_hook+0x1f9/0x250 [ 587.909062][ T9847] get_page_from_freelist+0x2591/0x2600 [ 587.909090][ T9847] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 587.909120][ T9847] allocate_slab+0x7d/0x620 [ 587.909137][ T9847] refill_objects+0x2d8/0x350 [ 587.909157][ T9847] __pcs_replace_empty_main+0x339/0x690 [ 587.909188][ T9847] __kvmalloc_node_noprof+0x6f4/0x890 [ 587.909217][ T9847] alloc_netdev_mqs+0xa9/0x12c0 [ 587.909246][ T9847] rtnl_create_link+0x321/0xd70 [ 587.909276][ T9847] rtnl_newlink_create+0x258/0x7b0 [ 587.909301][ T9847] rtnl_newlink+0x166d/0x1c30 [ 587.909322][ T9847] rtnetlink_rcv_msg+0x802/0xc00 [ 587.909343][ T9847] netlink_rcv_skb+0x226/0x4a0 [ 587.909370][ T9847] netlink_unicast+0x7f5/0x990 [ 587.909393][ T9847] netlink_sendmsg+0x813/0xb40 [ 587.909420][ T9847] sock_sendmsg_nosec+0x13a/0x180 [ 587.909452][ T9847] page last free pid 5382 tgid 5382 ts 66872933714 stack trace: [ 587.909469][ T9847] __free_frozen_pages+0xf8e/0x1070 [ 587.909493][ T9847] __slab_free+0x250/0x2a0 [ 587.909517][ T9847] qlist_free_all+0x99/0x100 [ 587.909539][ T9847] kasan_quarantine_reduce+0x148/0x160 [ 587.909564][ T9847] __kasan_slab_alloc+0x22/0x80 [ 587.909592][ T9847] __kmalloc_noprof+0x3b9/0x790 [ 587.909618][ T9847] tomoyo_realpath_from_path+0xef/0x640 [ 587.909642][ T9847] tomoyo_path_perm+0x283/0x560 [ 587.909673][ T9847] security_inode_getattr+0x12b/0x310 [ 587.909703][ T9847] __x64_sys_newfstat+0x133/0x270 [ 587.909734][ T9847] do_syscall_64+0x166/0x520 [ 587.909755][ T9847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.909776][ T9847] [ 587.909789][ T9847] Memory state around the buggy address: [ 587.909801][ T9847] ffff88803fc70800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 587.909816][ T9847] ffff88803fc70880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 587.909832][ T9847] >ffff88803fc70900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 587.909844][ T9847] ^ [ 587.909856][ T9847] ffff88803fc70980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 587.909871][ T9847] ffff88803fc70a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 587.909884][ T9847] ================================================================== [ 587.937900][ T9847] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 588.804452][ T9847] CPU: 0 UID: 0 PID: 9847 Comm: syz.3.956 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 588.814224][ T9847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 588.824413][ T9847] Call Trace: [ 588.827754][ T9847] [ 588.830728][ T9847] vpanic+0x56d/0xa60 [ 588.834758][ T9847] ? rcu_is_watching+0x16/0xb0 [ 588.839589][ T9847] ? __pfx_vpanic+0x10/0x10 [ 588.844141][ T9847] panic+0xc5/0xd0 [ 588.848099][ T9847] ? __pfx_panic+0x10/0x10 [ 588.852569][ T9847] ? preempt_schedule_thunk+0x16/0x40 [ 588.857979][ T9847] ? pn_bind+0x106/0xb20 [ 588.862261][ T9847] ? preempt_schedule_thunk+0x16/0x40 [ 588.867665][ T9847] ? pn_bind+0x106/0xb20 [ 588.871955][ T9847] check_panic_on_warn+0x89/0xb0 [ 588.876924][ T9847] ? pn_bind+0x106/0xb20 [ 588.881209][ T9847] end_report+0x73/0x170 [ 588.885489][ T9847] ? pn_bind+0x106/0xb20 [ 588.889782][ T9847] kasan_report+0x128/0x150 [ 588.894345][ T9847] ? pn_bind+0x106/0xb20 [ 588.898634][ T9847] pn_bind+0x106/0xb20 [ 588.902764][ T9847] usb_add_function+0x290/0x930 [ 588.907707][ T9847] ? check_remote_wakeup_config+0x58/0x1c0 [ 588.913570][ T9847] configfs_composite_bind+0xde0/0x1410 [ 588.919170][ T9847] ? __pfx_configfs_composite_bind+0x10/0x10 [ 588.925406][ T9847] gadget_bind_driver+0x2ca/0x9e0 [ 588.930475][ T9847] ? __pfx_gadget_bind_driver+0x10/0x10 [ 588.936048][ T9847] really_probe+0x254/0xae0 [ 588.940590][ T9847] __driver_probe_device+0x1e8/0x360 [ 588.945969][ T9847] driver_probe_device+0x4f/0x240 [ 588.951038][ T9847] __driver_attach+0x339/0x600 [ 588.955841][ T9847] bus_for_each_dev+0x23e/0x2c0 [ 588.960741][ T9847] ? __pfx___driver_attach+0x10/0x10 [ 588.966103][ T9847] ? __pfx_bus_for_each_dev+0x10/0x10 [ 588.971520][ T9847] ? rt_spin_unlock+0x165/0x200 [ 588.976407][ T9847] bus_add_driver+0x348/0x670 [ 588.981140][ T9847] driver_register+0x23a/0x320 [ 588.985965][ T9847] usb_gadget_register_driver_owner+0xf9/0x270 [ 588.992254][ T9847] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 588.997929][ T9847] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 589.004114][ T9847] configfs_write_iter+0x33a/0x430 [ 589.009299][ T9847] vfs_write+0x61e/0xbb0 [ 589.013581][ T9847] ? __pfx_vfs_write+0x10/0x10 [ 589.018374][ T9847] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 589.024226][ T9847] ? mutex_lock_nested+0x152/0x1d0 [ 589.029377][ T9847] ? fdget_pos+0x252/0x320 [ 589.033829][ T9847] ksys_write+0x156/0x270 [ 589.038270][ T9847] ? __pfx_ksys_write+0x10/0x10 [ 589.043159][ T9847] do_syscall_64+0x166/0x520 [ 589.047880][ T9847] ? trace_irq_disable+0x3b/0x140 [ 589.052952][ T9847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.059051][ T9847] ? clear_bhb_loop+0x70/0xc0 [ 589.063760][ T9847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.069685][ T9847] RIP: 0033:0x7f80c463e159 [ 589.074186][ T9847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.094015][ T9847] RSP: 002b:00007f80c2896028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 589.102475][ T9847] RAX: ffffffffffffffda RBX: 00007f80c48c5fa0 RCX: 00007f80c463e159 [ 589.110479][ T9847] RDX: 000000000000000c RSI: 0000200000000480 RDI: 0000000000000005 [ 589.118567][ T9847] RBP: 00007f80c46d5024 R08: 0000000000000000 R09: 0000000000000000 [ 589.126571][ T9847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 589.134572][ T9847] R13: 00007f80c48c6038 R14: 00007f80c48c5fa0 R15: 00007ffea6c35738 [ 589.142593][ T9847] [ 589.146248][ T9847] Kernel Offset: disabled [ 589.150597][ T9847] Rebooting in 86400 seconds..