last executing test programs: 42.820955046s ago: executing program 5 (id=6): socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c09425, &(0x7f0000000380)={"b8e50a31a002b94fcd8fc4db3056309d", 0x0, 0x0, {0x7, 0x100}, {0x0, 0x5}, 0x51, [0x7, 0x3, 0xe, 0x2, 0x9, 0x1, 0xd8e, 0x7fc0000, 0x5, 0x0, 0x6, 0x3, 0x5, 0x49, 0xfffffffffffffffe, 0xc]}) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0xffffffffffffff7c, &(0x7f00000002c0)=0x2) r1 = openat$ttynull(0xffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$binder(0x0, 0x0, &(0x7f00000000c0), 0x1000810, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r4, &(0x7f0000001240)=""/102400, 0x200000, 0x0) 39.6835529s ago: executing program 5 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x1300) 38.576470863s ago: executing program 5 (id=29): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185647, &(0x7f0000000100)={0xf000000, 0x1, 0x4, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f90d, 0x2, '\x00', @string=0x0}}) 38.280172503s ago: executing program 5 (id=33): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00000001c0)={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x6, @broadcast}, 0x6e, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}, 'team_slave_1\x00'}) 38.145973128s ago: executing program 5 (id=36): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1ff) rmdir(&(0x7f00000000c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00') 38.119819058s ago: executing program 5 (id=37): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) recvfrom$packet(r1, &(0x7f0000000100)=""/223, 0xdf, 0x8001, 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x8800) 22.917113577s ago: executing program 32 (id=37): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) recvfrom$packet(r1, &(0x7f0000000100)=""/223, 0xdf, 0x8001, 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x8800) 17.637768447s ago: executing program 2 (id=127): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) socket$l2tp6(0xa, 0x2, 0x73) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000180)={0x14, 0x0, 0x0}, &(0x7f0000000340)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="200b98000000c96a6401cba6760d815fc0bc7719039576f54c397a725b0bad1019a008d3bfaf784d70d159fdd8bf0b69bf7adc21dbd01e25f976d2d72b9ff5af28071c7e9b3fd15cb04bc1f565a92e9bb5225a8850c0209c00666486cce5de49a22ed54e944581d84d8a36b11a07d18b06a733e0e74bedd5dc96e20d568063e3a03d2022bc51789235883a09bd5073072cba5301b7611831e7a59f", @ANYRES64=r0], 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 12.87967894s ago: executing program 1 (id=135): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) 12.510184433s ago: executing program 1 (id=138): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000772904202404019957c2010203010902240001000010000904430002317d5500090502020002020000090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000340)=ANY=[@ANYBLOB="0014af"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f0000000a80)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000d40)={0x84, &(0x7f0000000740)={0x20, 0x15, 0x3, "8b27be"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000180)={0x40, 0xd, 0x4, "fef890a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f00000001c0)={0x0, 0xd, 0x4, "6c57ef8b"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001540)={0x34, &(0x7f0000001380)={0x20, 0x8, 0x4, "494e6ad8"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f00000002c0)={0x20, 0x14, 0x4, "79ee2ecd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 12.327035839s ago: executing program 0 (id=140): r0 = syz_open_procfs(0x0, &(0x7f0000002340)='fdinfo\x00') getdents(r0, &(0x7f0000000240)=""/28, 0x1c) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000200)) 12.130497542s ago: executing program 0 (id=141): mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0xa, 0x4e20, 0x4, @private1, 0x2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@rthdr_2292={{0x24, 0x29, 0x5, {0x0, 0x2, 0x2, 0x1, 0x0, [@dev={0xfe, 0x80, '\x00', 0x34}]}}}, @hoplimit_2292={{0x10, 0x29, 0x8, 0x1}}], 0x34}, 0x10) r1 = msgget$private(0x0, 0x100) msgrcv(r1, &(0x7f0000000340)={0x0, ""/40}, 0x2c, 0x3, 0x2800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=@bridge_dellink={0x24, 0x13, 0x1, 0x70bd2c, 0xfffffffc, {0x7, 0x0, 0x0, r2}, [@IFLA_AF_SPEC={0x4}]}, 0x24}}, 0x0) r4 = openat$fuse(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r4, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x100, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x7, 0x23}, 0x90) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f0000000840)={r7, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) 10.208014277s ago: executing program 2 (id=144): r0 = openat$dsp(0xffffff9c, &(0x7f0000000000), 0x20000, 0x0) setresgid(0xee00, 0xee01, 0x0) setregid(0xffffffffffffffff, 0x0) ioctl$SOUND_MIXER_READ_RECMASK(r0, 0x80044dfd, &(0x7f0000000080)) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) syz_open_dev$usbfs(0x0, 0x75, 0x109301) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$vcsa(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'veth1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x11, 0x4000}]}}]}, 0x38}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd000071187c0000000000c3640000f10000007b0a00fe00000000850000000c00000079a000fe000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x45}, 0x48) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x2000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x100000e, 0x66032, 0xffffffffffffffff, 0x40000000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) r4 = accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) connect$unix(r4, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/user\x00') open_by_handle_at(r7, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000100", @ANYRES64=r6], 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd700000dcdf2509000000300003800600040003000000140002006272696467655f736c6176655f30000008000300010000000800010002000000"], 0x44}}, 0x48040) 10.070262344s ago: executing program 0 (id=146): r0 = socket$inet(0x2, 0x801, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) r1 = socket(0x2b, 0x1, 0x1) listen(r1, 0x5) accept4$phonet_pipe(r1, 0x0, 0x0, 0x80000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0x70bd28, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1f}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e20, 0x4e21}}]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x40804) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r7], 0x50}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000001000008000500", @ANYRES32=r11], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'hsr0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r12}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) shutdown(r0, 0x1) pipe2(&(0x7f0000000100), 0x0) 9.615110447s ago: executing program 2 (id=149): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0xc0}}, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0400000000000000000000000000000d000000000000000000000010040000000000000000000009030000000000000061"], 0x0, 0x52}, 0x28) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x88804) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x2, 0x2, &(0x7f0000000540)=ANY=[@ANYBLOB="b7881185000000ae00", @ANYRESHEX=r0, @ANYRESOCT=r1], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b702", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[], 0x6f4}}, 0x0) 9.229900845s ago: executing program 2 (id=152): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) write$nci(r3, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 9.141489727s ago: executing program 4 (id=153): openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='\"', 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 8.382950998s ago: executing program 3 (id=154): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb) write(r0, &(0x7f00000002c0)='\n', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) 8.052207728s ago: executing program 1 (id=155): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x10004, &(0x7f0000000300)=ANY=[@ANYBLOB='fd=', @ANYRESDEC=r0, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000200)={0x100, r2}, 0x0) close(r2) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 7.460803127s ago: executing program 4 (id=156): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) write$nci(r0, &(0x7f00000009c0)=ANY=[@ANYBLOB="7105b88601"], 0xbb) 7.029007765s ago: executing program 1 (id=157): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000001100)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) mq_open(&(0x7f0000000080)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a\x9e@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e*\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|', 0x42, 0x0, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x4, 0x90743) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc854}, 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) epoll_create(0x5) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$vim2m(0x0, 0x0, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x501, 0x70bd2c, 0x25dfdbf8}, 0x14}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) sendmsg$NL80211_CMD_DEL_KEY(r1, 0x0, 0x24002000) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4001) socket$inet_mptcp(0x2, 0x1, 0x106) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) write(r3, &(0x7f00000002c0)='16', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs_dir/trace\x00', 0x0, 0x0) 6.65768731s ago: executing program 4 (id=158): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001b40)={0x2020}, 0x205c) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0xa) fchdir(r4) r5 = open(&(0x7f0000000080)='./bus\x00', 0x1031c2, 0x0) ftruncate(r5, 0x2007ffb) close(r5) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r6, 0x402, 0x8000003d) openat(r5, &(0x7f0000000180)='./bus\x00', 0x88882, 0x0) 6.366869534s ago: executing program 0 (id=159): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x300, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 6.217660641s ago: executing program 3 (id=160): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000240)="2dbf", 0x2}], 0x1) 5.844882583s ago: executing program 2 (id=161): r0 = memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r1 = dup(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000018c0)={0x28, 0x41, 0x107, 0xfffffefe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, @nested={0x4, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) write$binfmt_elf64(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="7f454c4606ff05a0020000000000000002003e"], 0xbe) mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8000000004) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r5, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) writev(r4, &(0x7f0000000200)=[{0x0}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='proc/kallsyms\x00', 0x0, 0x0) 4.472504961s ago: executing program 3 (id=162): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) socket$l2tp6(0xa, 0x2, 0x73) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000180)={0x14, 0x0, 0x0}, &(0x7f0000000340)={0x1c, &(0x7f0000000080)=ANY=[@ANYBLOB="200b98000000c96a6401cba6760d815fc0bc7719039576f54c397a725b0bad1019a008d3bfaf784d70d159fdd8bf0b69bf7adc21dbd01e25f976d2d72b9ff5af28071c7e9b3fd15cb04bc1f565a92e9bb5225a8850c0209c00666486cce5de49a22ed54e944581d84d8a36b11a07d18b06a733e0e74bedd5dc96e20d568063e3a03d2022bc51789235883a09bd5073072cba5301b7611831e7a59f", @ANYRES64=r0], 0x0, 0x0}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xc38, &(0x7f0000000080)=ANY=[]) 4.34849937s ago: executing program 0 (id=163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xf3f, 0x70fd2c, 0x25dddbbf, {0x0, 0x0, 0x0, r6, {0x5, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x0, 0x7, 0x5}, {{0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20045080}, 0x4880) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x7, r3, 0x41}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000300)="74949ebb27e184548454f16a8d898482", 0x10}], 0x1}, 0x0) 3.940398624s ago: executing program 2 (id=164): r0 = fsopen(&(0x7f0000000080)='bpf\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) openat$dsp1(0xffffff9c, 0x0, 0x2, 0x0) mount$9p_fd(0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000400)=ANY=[]) pipe2$9p(&(0x7f0000000080), 0x84880) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file1'}}]}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x100080, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x28) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r5, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000080)={0x0, 0x4379, 0xfffffff9, 0x8000, 0x16, "0462027d820000000000000002004000ffff00"}) r6 = syz_open_pts(r5, 0x0) r7 = dup3(r6, r5, 0x0) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x17) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000200)=0x1) 3.790957906s ago: executing program 1 (id=165): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='dir0/trace_marker\x00', 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x9, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0xfffffffd, 0x7, 0x0, 0x0, 0x2000000003, 0x0, 0x82a, 0x0, 0x81, 0x7}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) r5 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000080)={0x40000002}) write$P9_RSTATu(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="1e0200000400000005a8"], 0x21e) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) 2.483571426s ago: executing program 1 (id=166): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)='63', 0x2, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) shutdown(r0, 0x1) 1.466137656s ago: executing program 4 (id=167): openat$tun(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x7}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='\"', 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.27273071s ago: executing program 4 (id=168): socket$kcm(0xa, 0x2, 0x11) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x240, 0x0) socket$rds(0x15, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) move_mount(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x325) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = inotify_init() r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000002500010328bd6e06fedbdf2504"], 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4000010) inotify_add_watch(r2, 0x0, 0xa50003d1) readv(r2, &(0x7f0000000140)=[{&(0x7f0000000280)=""/181, 0xb5}], 0x1) close(0x3) syz_clone(0x4080800, 0x0, 0x0, &(0x7f0000000240), &(0x7f0000000380), &(0x7f00000003c0)="f61cc6a3d027efc3") r4 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r4, 0x110, 0x5, 0x0, 0x0) listen(r5, 0x0) listen(r4, 0x3) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r3, 0x0, 0x4c015) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="280000001200010228bd7000fddbdf25e0000002"], 0x28}}, 0x1a95e0a62f118818) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x20) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xd, 0x4012011, r0, 0x0) 832.668036ms ago: executing program 3 (id=169): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) chdir(&(0x7f0000000000)='./bus\x00') linkat(r1, &(0x7f0000000100)='./file1\x00', r1, &(0x7f0000000180)='./file0\x00', 0x1000) unlink(&(0x7f00000004c0)='./file1\x00') openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x79, 0x0) 600.56738ms ago: executing program 3 (id=170): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = syz_open_dev$cec(0x0, 0x0, 0x0) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f00000010c0)={0xd52, 0x8000, 0x6, 0x0, 0x1fc, 0x7, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x5c, 0x3, 0x1, 0x4, 0x9c, 0xff}) 224.041387ms ago: executing program 0 (id=171): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb) write(r0, &(0x7f00000002c0)='\n', 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00', 0x0) 98.774828ms ago: executing program 3 (id=172): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./rpc_pipefs\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./rpc_pipefs\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./rpc_pipefs/gssd/clntXX/gssd\x00', 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r0, 0x0}]) 0s ago: executing program 4 (id=173): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb) close(r0) rmdir(&(0x7f0000000340)='./config/usb_gadget/g1/functions/phonet.usb0\x00') rmdir(&(0x7f00000003c0)='./config/usb_gadget/g1\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.106' (ED25519) to the list of known hosts. [ 78.206224][ T5605] cgroup: Unknown subsys name 'net' [ 78.347032][ T5605] cgroup: Unknown subsys name 'cpuset' [ 78.356207][ T5605] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.839752][ T5605] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.763994][ T5627] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.766858][ T5626] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.779874][ T5630] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.787146][ T5626] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.795622][ T5630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.804441][ T5626] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.812676][ T5630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.819884][ T5626] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.827292][ T5626] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.845839][ T5635] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.855566][ T5635] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.863625][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.872495][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.879968][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.887829][ T5631] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.894610][ T5639] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.895139][ T5642] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 82.902278][ T5639] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.909059][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.917996][ T5639] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.923676][ T5631] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.938949][ T5631] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.939811][ T4935] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 82.955164][ T5631] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 82.956079][ T4935] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.962468][ T5631] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.971150][ T4935] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.989374][ T5626] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 82.998038][ T5626] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 83.005640][ T4935] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 84.951923][ T5631] Bluetooth: hci1: command tx timeout [ 85.031095][ T5631] Bluetooth: hci0: command tx timeout [ 85.114334][ T5631] Bluetooth: hci2: command tx timeout [ 85.114371][ T5626] Bluetooth: hci4: command tx timeout [ 85.120151][ T5635] Bluetooth: hci3: command tx timeout [ 85.125625][ T4935] Bluetooth: hci5: command tx timeout [ 85.204370][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.211608][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.218752][ T5618] bridge_slave_0: entered allmulticast mode [ 85.226313][ T5618] bridge_slave_0: entered promiscuous mode [ 85.302001][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.309124][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.316298][ T5618] bridge_slave_1: entered allmulticast mode [ 85.323771][ T5618] bridge_slave_1: entered promiscuous mode [ 85.338313][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.345450][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.352687][ T5620] bridge_slave_0: entered allmulticast mode [ 85.360051][ T5620] bridge_slave_0: entered promiscuous mode [ 85.424506][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.431700][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.438862][ T5620] bridge_slave_1: entered allmulticast mode [ 85.447112][ T5620] bridge_slave_1: entered promiscuous mode [ 85.562218][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.571675][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.578907][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.586240][ T5621] bridge_slave_0: entered allmulticast mode [ 85.593945][ T5621] bridge_slave_0: entered promiscuous mode [ 85.614459][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.621620][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.628737][ T5619] bridge_slave_0: entered allmulticast mode [ 85.636235][ T5619] bridge_slave_0: entered promiscuous mode [ 85.669349][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.704199][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.711354][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.718471][ T5621] bridge_slave_1: entered allmulticast mode [ 85.726090][ T5621] bridge_slave_1: entered promiscuous mode [ 85.735567][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.745055][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.752403][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.759710][ T5619] bridge_slave_1: entered allmulticast mode [ 85.767452][ T5619] bridge_slave_1: entered promiscuous mode [ 85.785923][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.793122][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.800226][ T5623] bridge_slave_0: entered allmulticast mode [ 85.807851][ T5623] bridge_slave_0: entered promiscuous mode [ 85.816715][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.824035][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.831232][ T5623] bridge_slave_1: entered allmulticast mode [ 85.838559][ T5623] bridge_slave_1: entered promiscuous mode [ 85.848469][ T5618] team0: Port device team_slave_0 added [ 85.869204][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.890433][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.897687][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.904908][ T5622] bridge_slave_0: entered allmulticast mode [ 85.912692][ T5622] bridge_slave_0: entered promiscuous mode [ 85.934064][ T5618] team0: Port device team_slave_1 added [ 85.975140][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.982431][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.989765][ T5622] bridge_slave_1: entered allmulticast mode [ 85.998536][ T5622] bridge_slave_1: entered promiscuous mode [ 86.053120][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.066052][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.109923][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.139627][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.182089][ T5620] team0: Port device team_slave_0 added [ 86.191466][ T5620] team0: Port device team_slave_1 added [ 86.199878][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.212548][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.225608][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.235953][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.243179][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.269130][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.352565][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.378484][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.386045][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.412228][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.425405][ T5621] team0: Port device team_slave_0 added [ 86.445286][ T5619] team0: Port device team_slave_0 added [ 86.492758][ T5621] team0: Port device team_slave_1 added [ 86.498979][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.506233][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.532458][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.545712][ T5619] team0: Port device team_slave_1 added [ 86.577184][ T5623] team0: Port device team_slave_0 added [ 86.586175][ T5623] team0: Port device team_slave_1 added [ 86.606137][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.613357][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.639477][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.665675][ T5622] team0: Port device team_slave_0 added [ 86.674056][ T5622] team0: Port device team_slave_1 added [ 86.725396][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.732396][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.758325][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.814390][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.821456][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.847536][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.860581][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.867588][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.894003][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.924257][ T5618] hsr_slave_0: entered promiscuous mode [ 86.930746][ T5618] hsr_slave_1: entered promiscuous mode [ 86.938161][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.945386][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.972522][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.984387][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.991352][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.017292][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.031122][ T4935] Bluetooth: hci1: command tx timeout [ 87.046124][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.053089][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.079009][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.091780][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.098752][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.124776][ T4935] Bluetooth: hci0: command tx timeout [ 87.130444][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.142992][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.149965][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.178108][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.190982][ T4935] Bluetooth: hci5: command tx timeout [ 87.196758][ T5626] Bluetooth: hci4: command tx timeout [ 87.196817][ T5631] Bluetooth: hci2: command tx timeout [ 87.207911][ T5635] Bluetooth: hci3: command tx timeout [ 87.251831][ T5620] hsr_slave_0: entered promiscuous mode [ 87.258929][ T5620] hsr_slave_1: entered promiscuous mode [ 87.274776][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 87.281142][ T5620] Cannot create hsr debugfs directory [ 87.413397][ T5619] hsr_slave_0: entered promiscuous mode [ 87.419805][ T5619] hsr_slave_1: entered promiscuous mode [ 87.426074][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 87.431887][ T5619] Cannot create hsr debugfs directory [ 87.526898][ T5621] hsr_slave_0: entered promiscuous mode [ 87.533360][ T5621] hsr_slave_1: entered promiscuous mode [ 87.539473][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 87.545515][ T5621] Cannot create hsr debugfs directory [ 87.572898][ T5622] hsr_slave_0: entered promiscuous mode [ 87.579388][ T5622] hsr_slave_1: entered promiscuous mode [ 87.585823][ T5622] debugfs: 'hsr0' already exists in 'hsr' [ 87.591887][ T5622] Cannot create hsr debugfs directory [ 87.610777][ T5623] hsr_slave_0: entered promiscuous mode [ 87.617238][ T5623] hsr_slave_1: entered promiscuous mode [ 87.623578][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 87.629289][ T5623] Cannot create hsr debugfs directory [ 88.280345][ T5620] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.297318][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.305917][ T5620] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.315802][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.324059][ T5620] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.334046][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.342073][ T5620] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.352783][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.424605][ T5622] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.437098][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.449691][ T5622] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.462603][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.476262][ T5622] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.487658][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.506871][ T5622] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.517168][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.587680][ T5619] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.597961][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.615762][ T5619] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.625849][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.633915][ T5619] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.643975][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.652487][ T5619] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.662736][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.769648][ T5623] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.779924][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.789872][ T5623] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.799351][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.808734][ T5623] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.819103][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.827227][ T5623] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.836985][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.875408][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.955092][ T5621] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 88.967477][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.975795][ T5621] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 88.986969][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.997187][ T5621] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 89.007247][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.032415][ T5621] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 89.042889][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.073549][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.110644][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.112576][ T5635] Bluetooth: hci1: command tx timeout [ 89.118522][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.162140][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.169307][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.191510][ T5635] Bluetooth: hci0: command tx timeout [ 89.271537][ T5635] Bluetooth: hci4: command tx timeout [ 89.277028][ T5631] Bluetooth: hci5: command tx timeout [ 89.277066][ T5631] Bluetooth: hci3: command tx timeout [ 89.277092][ T5631] Bluetooth: hci2: command tx timeout [ 89.286994][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.306617][ T5618] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.316720][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.325103][ T5618] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.335481][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.343942][ T5618] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.357354][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.375439][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.382569][ T5618] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.393599][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.454361][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.481309][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.516608][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.523814][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.533919][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.541067][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.593350][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.600566][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.646064][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.653286][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.780578][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.803735][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.910031][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.977159][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.006135][ T1103] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.013350][ T1103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.074583][ T1103] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.081822][ T1103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.115376][ T1103] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.122573][ T1103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.155667][ T1103] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.162830][ T1103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.217198][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.364144][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.422794][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.429963][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.465585][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.472758][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.504167][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.762999][ T5620] veth0_vlan: entered promiscuous mode [ 90.852150][ T5620] veth1_vlan: entered promiscuous mode [ 90.920576][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.004479][ T5620] veth0_macvtap: entered promiscuous mode [ 91.097820][ T5620] veth1_macvtap: entered promiscuous mode [ 91.119233][ T29] cfg80211: failed to load regulatory.db [ 91.191554][ T5635] Bluetooth: hci1: command tx timeout [ 91.233177][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.273708][ T5635] Bluetooth: hci0: command tx timeout [ 91.319530][ T5622] veth0_vlan: entered promiscuous mode [ 91.329570][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.351108][ T5635] Bluetooth: hci4: command tx timeout [ 91.351159][ T5626] Bluetooth: hci2: command tx timeout [ 91.351284][ T5631] Bluetooth: hci3: command tx timeout [ 91.356603][ T4935] Bluetooth: hci5: command tx timeout [ 91.364781][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.442920][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.469167][ T5622] veth1_vlan: entered promiscuous mode [ 91.505773][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.532305][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.550813][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.699183][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.805987][ T746] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.828968][ T746] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.855815][ T5619] veth0_vlan: entered promiscuous mode [ 91.893020][ T5622] veth0_macvtap: entered promiscuous mode [ 91.929462][ T5619] veth1_vlan: entered promiscuous mode [ 91.947165][ T5622] veth1_macvtap: entered promiscuous mode [ 91.971705][ T746] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.984419][ T746] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.989601][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.115845][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.149084][ T5620] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.169255][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.184722][ T5619] veth0_macvtap: entered promiscuous mode [ 92.216025][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.257267][ T5619] veth1_macvtap: entered promiscuous mode [ 92.276724][ T77] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.301823][ T77] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.330373][ T77] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.367916][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.469715][ T5623] veth0_vlan: entered promiscuous mode [ 92.497302][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.554646][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.590337][ T5623] veth1_vlan: entered promiscuous mode [ 92.676992][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.699147][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.714367][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.725991][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.735922][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.765890][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.782745][ T5621] veth0_vlan: entered promiscuous mode [ 92.858084][ T77] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.862296][ T5621] veth1_vlan: entered promiscuous mode [ 92.877896][ T77] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.928749][ T5623] veth0_macvtap: entered promiscuous mode [ 93.007073][ T5623] veth1_macvtap: entered promiscuous mode [ 93.072277][ T5809] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.110236][ T5809] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.160512][ T5618] veth0_vlan: entered promiscuous mode [ 93.238720][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.312247][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.325560][ T5621] veth0_macvtap: entered promiscuous mode [ 93.336125][ T5618] veth1_vlan: entered promiscuous mode [ 93.344636][ T5809] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.367523][ T5621] veth1_macvtap: entered promiscuous mode [ 93.373454][ T5809] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.389546][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.416334][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.417812][ T5622] svc: failed to register nfsdv3 RPC service (errno 111). [ 93.455358][ T5622] svc: failed to register nfsaclv3 RPC service (errno 111). [ 93.464791][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.468700][ T5622] failed to unregister udp with rpcbind [ 93.482919][ T5622] svc: failed to register nfsdv3 RPC service (errno 97). [ 93.490030][ T5622] svc: failed to register nfsaclv3 RPC service (errno 97). [ 93.494303][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.497716][ T5622] failed to unregister udp with rpcbind [ 93.607033][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.692272][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.248854][ T5809] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.289072][ T5809] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.440401][ T5809] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.473649][ T5879] 9pnet_virtio: no channels available for device syz [ 94.499065][ T5809] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.546914][ T5618] veth0_macvtap: entered promiscuous mode [ 94.573287][ T5881] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10'. [ 94.643932][ T5881] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10'. [ 94.757437][ T5881] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10'. [ 94.855698][ T5881] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10'. [ 94.885329][ T5618] veth1_macvtap: entered promiscuous mode [ 95.006627][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.129551][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.512383][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.555954][ T5908] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.558354][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.566968][ T5908] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.773007][ T5916] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.782661][ T5896] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.807686][ T5896] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.816332][ T5916] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.877458][ T5916] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.907796][ T5916] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.047504][ T5916] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.105111][ T5916] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.306154][ T5921] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 96.346985][ T5921] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 96.543800][ T5921] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 96.704439][ T5921] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 96.788628][ T5921] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 96.844876][ T5921] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 96.889381][ T5921] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 96.911089][ T5921] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 96.934753][ T5921] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 96.965830][ T5921] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 97.171243][ T5921] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 97.388034][ T5921] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 97.439780][ T5921] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 97.474733][ T5921] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 97.517042][ T5921] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 97.564599][ T5921] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 97.585608][ T5921] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 97.856774][ T5921] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 97.992754][ T5635] Bluetooth: hci1: command 0x0c1a tx timeout [ 98.270297][ T5969] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15'. [ 98.548778][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.581669][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.697578][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.713464][ T5635] Bluetooth: hci2: command 0x0c1a tx timeout [ 98.756708][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.951098][ T5635] Bluetooth: hci0: command 0x0c1a tx timeout [ 99.016591][ T5976] configfs-gadget.g1 gadget.0: USB CDC Phonet function [ 99.031388][ T5635] Bluetooth: hci3: command 0x0c1a tx timeout [ 99.043926][ T5976] configfs-gadget.g1 gadget.0: using dummy_udc, OUT ep2out-bulk, IN ep1in-bulk [ 99.511324][ T5635] Bluetooth: hci4: command 0x0c1a tx timeout [ 99.591690][ T5635] Bluetooth: hci5: command 0x0c1a tx timeout [ 100.081767][ T5635] Bluetooth: hci1: command 0x0c1a tx timeout [ 100.791495][ T5635] Bluetooth: hci2: command 0x0c1a tx timeout [ 100.924985][ T6010] netlink: 268 bytes leftover after parsing attributes in process `syz.4.27'. [ 100.947175][ T6012] netlink: 44 bytes leftover after parsing attributes in process `syz.3.28'. [ 100.969235][ T6010] Zero length message leads to an empty skb [ 101.030956][ T5635] Bluetooth: hci0: command 0x0c1a tx timeout [ 101.111703][ T5635] Bluetooth: hci3: command 0x0c1a tx timeout [ 101.390016][ T6030] overlay: Unknown parameter 'dont_measure' [ 101.423518][ T30] audit: type=1800 audit(1785287275.051:2): pid=6024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.34" name="enable" dev="configfs" ino=10302 res=0 errno=0 [ 101.527058][ T6041] ======================================================= [ 101.527058][ T6041] WARNING: The mand mount option has been deprecated and [ 101.527058][ T6041] and is ignored by this kernel. Remove the mand [ 101.527058][ T6041] option from the mount to silence this warning. [ 101.527058][ T6041] ======================================================= [ 101.591008][ T4935] Bluetooth: hci4: command 0x0c1a tx timeout [ 101.647728][ T6006] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 101.671782][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 101.729643][ T6006] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 101.750466][ T6006] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 101.767836][ T6006] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 101.804500][ T6006] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 101.880734][ T6006] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 102.538569][ T6034] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 102.659605][ T6041] random: crng reseeded on system resumption [ 102.891251][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 102.952479][ T4935] Bluetooth: hci1: command 0x0c1a tx timeout [ 103.064697][ T6056] overlayfs: failed to get inode (-116) [ 103.077334][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.099780][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 103.132221][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 103.170062][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 103.220093][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 103.261580][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 103.299836][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 103.330900][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 103.360597][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 103.751039][ T4935] Bluetooth: hci2: command 0x0c1a tx timeout [ 103.760990][ T4935] Bluetooth: hci0: command 0x0c1a tx timeout [ 103.841058][ T4935] Bluetooth: hci4: command 0x0c1a tx timeout [ 103.847235][ T4935] Bluetooth: hci3: command 0x0c1a tx timeout [ 104.016362][ T5635] Bluetooth: hci5: command 0x0c1a tx timeout [ 104.036288][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 106.260987][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 106.368311][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 107.100607][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 107.110675][ T10] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 107.122525][ T10] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 107.134131][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 12 endpoint descriptors, different from the interface descriptor's value: 14 [ 107.153861][ T10] usb 2-1: string descriptor 0 read error: -71 [ 107.160202][ T10] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 107.169324][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.472743][ T10] usb 2-1: can't set config #1, error -71 [ 107.502924][ T10] usb 2-1: USB disconnect, device number 2 [ 108.691166][ T6110] mmap: syz.3.52 (6110) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 109.291329][ T10] IPVS: starting estimator thread 0... [ 109.341939][ T6128] syzkaller0: entered promiscuous mode [ 109.362636][ T6128] syzkaller0: entered allmulticast mode [ 109.414774][ T6129] IPVS: using max 29 ests per chain, 69600 per kthread [ 110.784130][ T6145] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 110.797613][ T6145] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 110.825716][ T6145] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 110.852739][ T6145] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 110.877435][ T6145] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 110.969576][ T6145] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 111.142905][ T6162] overlayfs: missing 'lowerdir' [ 111.528262][ T6171] futex_wake_op: syz.2.75 tries to shift op by 32; fix this program [ 112.150959][ T4935] Bluetooth: hci1: command 0x0c1a tx timeout [ 112.211836][ T6181] syzkaller0: entered promiscuous mode [ 112.239787][ T6181] syzkaller0: entered allmulticast mode [ 112.860759][ T6197] usb usb8: usbfs: process 6197 (syz.1.84) did not claim interface 0 before use [ 112.882457][ T4935] Bluetooth: hci0: command 0x0c1a tx timeout [ 112.888516][ T5635] Bluetooth: hci2: command 0x0c1a tx timeout [ 112.909619][ T6197] netlink: 'syz.1.84': attribute type 2 has an invalid length. [ 112.951054][ T4935] Bluetooth: hci3: command 0x0c1a tx timeout [ 112.957136][ T5635] Bluetooth: hci4: command 0x0c1a tx timeout [ 113.031003][ T4935] Bluetooth: hci5: command 0x0c1a tx timeout [ 114.099748][ T6224] fuse: Bad value for 'fd' [ 114.116124][ T6223] overlayfs: missing 'workdir' [ 114.646127][ T6238] syzkaller0: entered promiscuous mode [ 114.678027][ T6238] syzkaller0: entered allmulticast mode [ 114.924764][ T6252] futex_wake_op: syz.4.97 tries to shift op by 32; fix this program [ 115.547931][ T30] audit: type=1804 audit(1785287287.175:3): pid=6268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.100" name="bus" dev="ramfs" ino=9865 res=1 errno=0 [ 115.647599][ T30] audit: type=1804 audit(1785287287.275:4): pid=6268 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.100" name="bus" dev="ramfs" ino=9865 res=1 errno=0 [ 116.549255][ T6283] fuse: Bad value for 'fd' [ 117.357645][ T6307] netlink: 12 bytes leftover after parsing attributes in process `syz.2.111'. [ 117.410426][ T5635] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 117.436868][ T5635] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 117.446089][ T5635] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 117.458673][ T5635] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 117.483750][ T5635] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 117.656315][ T6293] netlink: 24 bytes leftover after parsing attributes in process `syz.4.101'. [ 117.689882][ T6316] warning: `syz.0.110' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 118.503172][ T6325] syzkaller0: entered promiscuous mode [ 118.512852][ T6325] syzkaller0: entered allmulticast mode [ 119.200594][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 119.434070][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.454651][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.918573][ T13] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.770755][ T6354] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 121.777529][ T6354] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 121.938624][ T6354] vhci_hcd vhci_hcd.0: Device attached [ 121.948981][ T6386] configfs-gadget.g1 gadget.0: HOST MAC c2:aa:b9:8f:c8:2c [ 121.971271][ T6386] configfs-gadget.g1 gadget.0: MAC d6:c3:fe:3e:3c:38 [ 122.159952][ T5873] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 122.240968][ T5799] usb 36-1: SetAddress Request (2) to port 0 [ 122.318019][ T5799] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd [ 122.363745][ T5628] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 122.393209][ T13] bridge_slave_1: left allmulticast mode [ 122.406506][ T13] bridge_slave_1: left promiscuous mode [ 122.442032][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.460975][ T5873] usb 3-1: Using ep0 maxpacket: 16 [ 122.547014][ T5873] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 122.598316][ T13] bridge_slave_0: left allmulticast mode [ 122.609350][ T13] bridge_slave_0: left promiscuous mode [ 122.615347][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 122.616347][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.658543][ T5628] usb 1-1: Dual-Role OTG device on HNP port [ 122.683106][ T5873] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 122.693900][ T5628] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 122.807219][ T5873] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 122.817173][ T5628] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.874006][ T5873] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 123.067394][ T5873] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 123.183523][ T5873] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 123.196665][ T5628] usb 1-1: No union descriptors [ 123.224316][ T5873] usb 3-1: Manufacturer: syz [ 123.326960][ T5628] gspca_main: spca501-2.14.0 probing 0000:0000 [ 123.337493][ T5873] usb 3-1: config 0 descriptor?? [ 123.355149][ T5628] gspca_spca501: reg write: error -32 [ 123.378128][ T5628] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 123.400210][ T5628] spca501 1-1:1.0: probe with driver spca501 failed with error -22 [ 123.614093][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 123.671533][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 123.704725][ T13] bond0 (unregistering): Released all slaves [ 124.198327][ T6379] vhci_hcd: connection reset by peer [ 124.313678][ T5906] vhci_hcd vhci_hcd.1: stop threads [ 124.438142][ T5906] vhci_hcd vhci_hcd.1: release socket [ 125.549271][ T5906] vhci_hcd vhci_hcd.1: disconnect device [ 126.220932][ T5873] rc_core: IR keymap rc-hauppauge not found [ 126.226937][ T5873] Registered IR keymap rc-empty [ 126.255338][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.428894][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.525281][ T5873] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 126.561577][ T5873] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input5 [ 126.628682][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.693305][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.724083][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.762313][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.811983][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.861101][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.911926][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.941330][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 126.963383][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 127.002025][ T5873] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 127.038261][ T5873] mceusb 3-1:0.0: Registered with mce emulator interface version 1 [ 127.056962][ T5873] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 127.120292][ T5873] usb 3-1: USB disconnect, device number 2 [ 127.161002][ T5872] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 127.240351][ T6474] Bluetooth: MGMT ver 1.23 [ 127.374849][ T5872] usb 2-1: Using ep0 maxpacket: 32 [ 127.414074][ T5872] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 127.424355][ T5872] usb 2-1: config 0 has no interface number 0 [ 127.443232][ T5872] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 127.469046][ T5872] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.548459][ T5799] usb 36-1: device descriptor read/8, error -110 [ 127.566371][ T5750] usb 1-1: USB disconnect, device number 2 [ 127.580175][ T5872] usb 2-1: Product: syz [ 127.671245][ T5872] usb 2-1: Manufacturer: syz [ 127.747119][ T5872] usb 2-1: SerialNumber: syz [ 127.775482][ T5872] usb 2-1: config 0 descriptor?? [ 128.023912][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 128.053815][ T5799] usb usb36-port1: attempt power cycle [ 128.185458][ T10] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 128.203527][ T10] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 128.218248][ T5872] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 128.235103][ T5872] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 128.248632][ T10] usb 4-1: Product: syz [ 128.259037][ T10] usb 4-1: SerialNumber: syz [ 128.272934][ T10] usb 4-1: config 0 descriptor?? [ 128.632344][ T5799] usb usb36-port1: unable to enumerate USB device [ 128.722648][ T5799] usb 4-1: USB disconnect, device number 2 [ 129.485732][ T5872] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 129.539026][ T5872] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61 [ 129.625733][ T6507] overlayfs: failed to resolve './file0': -2 [ 129.798342][ T6513] netlink: 4 bytes leftover after parsing attributes in process `syz.0.146'. [ 129.887608][ T6302] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.917813][ T6302] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.940238][ T6302] bridge_slave_0: entered allmulticast mode [ 129.960165][ T6302] bridge_slave_0: entered promiscuous mode [ 129.983702][ T6302] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.001879][ T6302] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.010039][ T6302] bridge_slave_1: entered allmulticast mode [ 130.018117][ T6302] bridge_slave_1: entered promiscuous mode [ 130.038477][ T6505] vlan2: entered promiscuous mode [ 130.043573][ T6505] hsr0: entered promiscuous mode [ 130.049019][ T6505] vlan2: entered allmulticast mode [ 130.075318][ T6505] hsr0: entered allmulticast mode [ 130.139507][ T6505] hsr_slave_0: entered allmulticast mode [ 130.207700][ T6505] hsr_slave_1: entered allmulticast mode [ 130.271098][ T6513] hsr_slave_0: left promiscuous mode [ 130.677966][ T6513] hsr_slave_1: left promiscuous mode [ 131.271150][ T5750] usb 2-1: USB disconnect, device number 3 [ 132.035262][ T6553] fuse: Bad value for 'fd' [ 132.078872][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.086356][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.486864][ T6544] udc dummy_udc.0: failed to start g1: -4 [ 132.554543][ T6544] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -4 [ 132.584202][ T6544] UDC core: g1: couldn't find an available UDC or it's busy [ 134.862448][ T6601] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 134.888099][ T6302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 135.054352][ T30] audit: type=1800 audit(1785287305.674:5): pid=6588 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.157" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 135.095367][ T6588] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 135.243940][ T6588] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 135.336414][ T6588] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 135.381967][ T13] hsr_slave_0: left promiscuous mode [ 135.407801][ T13] hsr_slave_1: left promiscuous mode [ 135.415488][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.423152][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.445100][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 135.456110][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 135.561218][ T5799] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 135.589920][ T13] veth1_macvtap: left promiscuous mode [ 135.620543][ T13] veth0_macvtap: left promiscuous mode [ 135.646744][ T13] veth1_vlan: left promiscuous mode [ 135.680659][ T13] veth0_vlan: left promiscuous mode [ 135.754467][ T5799] usb 4-1: Using ep0 maxpacket: 16 [ 135.784014][ T5799] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 135.835561][ T5799] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 135.883109][ T5799] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 135.926054][ T5799] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 136.108528][ T5799] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 136.123835][ T5799] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 136.133879][ T5799] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 136.144372][ T5799] usb 4-1: Manufacturer: syz [ 136.156577][ T5799] usb 4-1: config 0 descriptor?? [ 137.400966][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 137.561095][ T9] usb 2-1: device descriptor read/64, error -71 [ 137.757897][ T13] team0 (unregistering): Port device team_slave_1 removed [ 137.828448][ T13] team0 (unregistering): Port device team_slave_0 removed [ 137.845149][ T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 138.002029][ T9] usb 2-1: device descriptor read/64, error -71 [ 138.133003][ T9] usb usb2-port1: attempt power cycle [ 138.371149][ T6637] netlink: 24 bytes leftover after parsing attributes in process `syz.4.168'. [ 138.587969][ T6302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 138.680897][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 138.699675][ T5280] 8021q: adding VLAN 0 to HW filter on device eth1 [ 138.699754][ T6640] overlayfs: failed to resolve './file0': -2 [ 138.713318][ T9] usb 2-1: device descriptor read/8, error -71 [ 138.761835][ T5799] rc_core: IR keymap rc-hauppauge not found [ 138.781122][ T5799] Registered IR keymap rc-empty [ 138.798531][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 138.841751][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 138.856783][ T6302] team0: Port device team_slave_0 added [ 138.872021][ T6302] team0: Port device team_slave_1 added [ 138.892093][ T5799] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 138.935312][ T5799] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input6 [ 138.970905][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 139.000995][ T6302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 139.010888][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.026664][ T9] usb 2-1: device descriptor read/8, error -71 [ 139.027605][ T6302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.081017][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.112807][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.144314][ T6302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 139.170936][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.208819][ T6302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 139.225162][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.243607][ T6302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 139.300010][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.311419][ T9] usb usb2-port1: unable to enumerate USB device [ 139.320906][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.337474][ T6302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 139.364171][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.414631][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.472232][ T5799] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 139.558228][ T6651] ================================================================== [ 139.560228][ T5799] mceusb 4-1:0.0: Registered with mce emulator interface version 1 [ 139.566317][ T6651] BUG: KASAN: slab-use-after-free in pn_bind+0x106/0xb20 [ 139.566355][ T6651] Write of size 8 at addr ffff888052490800 by task syz.0.171/6651 [ 139.566376][ T6651] [ 139.566392][ T6651] CPU: 0 UID: 0 PID: 6651 Comm: syz.0.171 Tainted: G L syzkaller #0 PREEMPT(full) [ 139.566423][ T6651] Tainted: [L]=SOFTLOCKUP [ 139.566432][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 139.566446][ T6651] Call Trace: [ 139.566454][ T6651] [ 139.566463][ T6651] dump_stack_lvl+0xe8/0x150 [ 139.566502][ T6651] print_address_description+0x55/0x1e0 [ 139.566538][ T6651] ? pn_bind+0x106/0xb20 [ 139.566567][ T6651] print_report+0x58/0x70 [ 139.566599][ T6651] kasan_report+0x117/0x150 [ 139.566639][ T6651] ? pn_bind+0x106/0xb20 [ 139.566674][ T6651] pn_bind+0x106/0xb20 [ 139.566709][ T6651] usb_add_function+0x2e1/0x9f0 [ 139.566733][ T6651] ? check_remote_wakeup_config+0x58/0x1c0 [ 139.566766][ T6651] configfs_composite_bind+0xde0/0x1410 [ 139.566799][ T6651] ? __pfx_configfs_composite_bind+0x10/0x10 [ 139.566824][ T6651] gadget_bind_driver+0x2ca/0x9e0 [ 139.566865][ T6651] ? __pfx_gadget_bind_driver+0x10/0x10 [ 139.566896][ T6651] really_probe+0x254/0xae0 [ 139.566931][ T6651] __driver_probe_device+0x1e8/0x360 [ 139.566962][ T6651] driver_probe_device+0x4f/0x240 [ 139.566995][ T6651] __driver_attach+0x339/0x600 [ 139.567026][ T6651] bus_for_each_dev+0x23b/0x2c0 [ 139.567064][ T6651] ? __pfx___driver_attach+0x10/0x10 [ 139.567093][ T6651] ? __pfx_bus_for_each_dev+0x10/0x10 [ 139.567132][ T6651] ? srso_alias_return_thunk+0x5/0xfbef5 [ 139.567160][ T6651] ? do_raw_spin_unlock+0xf5/0x210 [ 139.567191][ T6651] bus_add_driver+0x345/0x670 [ 139.567233][ T6651] driver_register+0x23a/0x320 [ 139.567267][ T6651] usb_gadget_register_driver_owner+0xf9/0x270 [ 139.567302][ T6651] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 139.567337][ T6651] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 139.567372][ T6651] configfs_write_iter+0x337/0x430 [ 139.567412][ T6651] vfs_write+0x612/0xba0 [ 139.567440][ T6651] ? __pfx_vfs_write+0x10/0x10 [ 139.567469][ T6651] ? __fget_files+0x2a/0x420 [ 139.567505][ T6651] ? srso_alias_return_thunk+0x5/0xfbef5 [ 139.567535][ T6651] ksys_write+0x150/0x270 [ 139.567560][ T6651] ? __pfx_ksys_write+0x10/0x10 [ 139.567588][ T6651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.567613][ T6651] do_syscall_64+0x174/0x580 [ 139.567641][ T6651] ? trace_irq_disable+0x3b/0x140 [ 139.567676][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.567701][ T6651] RIP: 0033:0x7fb938b9de99 [ 139.567721][ T6651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.567741][ T6651] RSP: 002b:00007fb939aac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 139.567770][ T6651] RAX: ffffffffffffffda RBX: 00007fb938e25fa0 RCX: 00007fb938b9de99 [ 139.567788][ T6651] RDX: 000000000000000b RSI: 0000200000000280 RDI: 0000000000000003 [ 139.567803][ T6651] RBP: 00007fb938c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 139.567818][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.567832][ T6651] R13: 00007fb938e26038 R14: 00007fb938e25fa0 R15: 00007fffc6eca108 [ 139.567860][ T6651] [ 139.567868][ T6651] [ 139.618927][ T5799] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 139.620186][ T6651] Allocated by task 6481: [ 139.904181][ T6651] kasan_save_track+0x3e/0x80 [ 139.908863][ T6651] __kasan_kmalloc+0x93/0xb0 [ 139.913448][ T6651] __kvmalloc_node_noprof+0x53f/0x860 [ 139.918817][ T6651] alloc_netdev_mqs+0xa9/0x12b0 [ 139.923663][ T6651] phonet_alloc_inst+0xa4/0x180 [ 139.928506][ T6651] usb_get_function_instance+0xe3/0x2f0 [ 139.934042][ T6651] function_make+0x127/0x360 [ 139.938626][ T6651] configfs_mkdir+0x4f6/0x9e0 [ 139.943288][ T6651] vfs_mkdir+0x406/0x620 [ 139.947517][ T6651] filename_mkdirat+0x285/0x510 [ 139.952355][ T6651] __se_sys_mkdirat+0x35/0x150 [ 139.957107][ T6651] do_syscall_64+0x174/0x580 [ 139.961685][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.967568][ T6651] [ 139.969873][ T6651] Freed by task 6544: [ 139.973831][ T6651] kasan_save_track+0x3e/0x80 [ 139.978501][ T6651] kasan_save_free_info+0x40/0x50 [ 139.983515][ T6651] __kasan_slab_free+0x5c/0x80 [ 139.988272][ T6651] kfree+0x1c5/0x640 [ 139.992155][ T6651] pn_bind+0x131/0xb20 [ 139.996216][ T6651] usb_add_function+0x2e1/0x9f0 [ 140.001051][ T6651] configfs_composite_bind+0xde0/0x1410 [ 140.006584][ T6651] gadget_bind_driver+0x2ca/0x9e0 [ 140.011606][ T6651] really_probe+0x254/0xae0 [ 140.016105][ T6651] __driver_probe_device+0x1e8/0x360 [ 140.021381][ T6651] driver_probe_device+0x4f/0x240 [ 140.026397][ T6651] __driver_attach+0x339/0x600 [ 140.031150][ T6651] bus_for_each_dev+0x23b/0x2c0 [ 140.035997][ T6651] bus_add_driver+0x345/0x670 [ 140.040670][ T6651] driver_register+0x23a/0x320 [ 140.045426][ T6651] usb_gadget_register_driver_owner+0xf9/0x270 [ 140.051573][ T6651] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 140.057200][ T6651] configfs_write_iter+0x337/0x430 [ 140.062309][ T6651] vfs_write+0x612/0xba0 [ 140.066536][ T6651] ksys_write+0x150/0x270 [ 140.070849][ T6651] do_syscall_64+0x174/0x580 [ 140.075435][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.081316][ T6651] [ 140.083624][ T6651] The buggy address belongs to the object at ffff888052490000 [ 140.083624][ T6651] which belongs to the cache kmalloc-cg-4k of size 4096 [ 140.097920][ T6651] The buggy address is located 2048 bytes inside of [ 140.097920][ T6651] freed 4096-byte region [ffff888052490000, ffff888052491000) [ 140.111875][ T6651] [ 140.114181][ T6651] The buggy address belongs to the physical page: [ 140.120569][ T6651] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52490 [ 140.129311][ T6651] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 140.137790][ T6651] memcg:ffff8880561b3cc1 [ 140.142010][ T6651] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 140.149547][ T6651] page_type: f5(slab) [ 140.153516][ T6651] raw: 00fff00000000040 ffff88801b00a500 dead000000000100 dead000000000122 [ 140.162087][ T6651] raw: 0000000000000000 0000000800040004 00000000f5000000 ffff8880561b3cc1 [ 140.170662][ T6651] head: 00fff00000000040 ffff88801b00a500 dead000000000100 dead000000000122 [ 140.179317][ T6651] head: 0000000000000000 0000000800040004 00000000f5000000 ffff8880561b3cc1 [ 140.187973][ T6651] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 140.196628][ T6651] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 140.205275][ T6651] page dumped because: kasan: bad access detected [ 140.211695][ T6651] page_owner tracks the page as allocated [ 140.217388][ T6651] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5622, tgid 5622 (syz-executor), ts 88894415861, free_ts 25105488941 [ 140.238734][ T6651] post_alloc_hook+0x1f9/0x250 [ 140.243499][ T6651] get_page_from_freelist+0x21fa/0x2270 [ 140.249042][ T6651] __alloc_frozen_pages_noprof+0x18d/0x380 [ 140.254842][ T6651] allocate_slab+0x79/0x5e0 [ 140.259332][ T6651] refill_objects+0x2d5/0x350 [ 140.263996][ T6651] __pcs_replace_empty_main+0x2bf/0x6b0 [ 140.269528][ T6651] __kmalloc_noprof+0x485/0x720 [ 140.274371][ T6651] __register_sysctl_table+0x6f/0x1370 [ 140.279828][ T6651] __addrconf_sysctl_register+0x31c/0x4b0 [ 140.285547][ T6651] addrconf_sysctl_register+0x168/0x1c0 [ 140.291093][ T6651] ipv6_add_dev+0xd26/0x13a0 [ 140.295673][ T6651] ipv6_find_idev+0xb1/0x1c0 [ 140.300254][ T6651] inet6_rtm_newaddr+0x7c8/0xdf0 [ 140.305175][ T6651] rtnetlink_rcv_msg+0x802/0xc00 [ 140.310099][ T6651] netlink_rcv_skb+0x226/0x4a0 [ 140.314852][ T6651] netlink_unicast+0x7bb/0x940 [ 140.319604][ T6651] page last free pid 1 tgid 1 stack trace: [ 140.325387][ T6651] free_pages_prepare+0x960/0xa60 [ 140.330404][ T6651] __free_contig_range_common+0x174/0x340 [ 140.336108][ T6651] destroy_args+0x4e5/0x570 [ 140.340608][ T6651] debug_vm_pgtable+0x3f8/0x410 [ 140.345453][ T6651] do_one_initcall+0x250/0x870 [ 140.350215][ T6651] do_initcall_level+0x10a/0x1a0 [ 140.355147][ T6651] do_initcalls+0x59/0xa0 [ 140.359499][ T6651] kernel_init_freeable+0x29d/0x3e0 [ 140.364690][ T6651] kernel_init+0x1d/0x1d0 [ 140.369015][ T6651] ret_from_fork+0x514/0xb70 [ 140.373602][ T6651] ret_from_fork_asm+0x1a/0x30 [ 140.378350][ T6651] [ 140.380654][ T6651] Memory state around the buggy address: [ 140.386262][ T6651] ffff888052490700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.394306][ T6651] ffff888052490780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.402352][ T6651] >ffff888052490800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 140.410392][ T6651] ^ [ 140.414468][ T6651] ffff888052490880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.422513][ T6651] ffff888052490900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 140.430554][ T6651] ================================================================== [ 140.450706][ T5799] usb 4-1: USB disconnect, device number 3 [ 140.549989][ T6302] hsr_slave_0: entered promiscuous mode [ 140.557227][ T6302] hsr_slave_1: entered promiscuous mode [ 140.566200][ T6302] debugfs: 'hsr0' already exists in 'hsr' [ 140.577211][ T6302] Cannot create hsr debugfs directory [ 140.671656][ T6651] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 140.678892][ T6651] CPU: 1 UID: 0 PID: 6651 Comm: syz.0.171 Tainted: G L syzkaller #0 PREEMPT(full) [ 140.689662][ T6651] Tainted: [L]=SOFTLOCKUP [ 140.693974][ T6651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 140.704015][ T6651] Call Trace: [ 140.707277][ T6651] [ 140.710193][ T6651] vpanic+0x56c/0xa60 [ 140.714184][ T6651] ? __pfx_vpanic+0x10/0x10 [ 140.718698][ T6651] panic+0xc5/0xd0 [ 140.722436][ T6651] ? __pfx_panic+0x10/0x10 [ 140.726861][ T6651] ? preempt_schedule_thunk+0x16/0x40 [ 140.732228][ T6651] ? srso_alias_return_thunk+0x5/0xfbef5 [ 140.737860][ T6651] ? preempt_schedule_thunk+0x16/0x40 [ 140.743227][ T6651] ? pn_bind+0x106/0xb20 [ 140.747468][ T6651] check_panic_on_warn+0x89/0xb0 [ 140.752408][ T6651] ? pn_bind+0x106/0xb20 [ 140.756647][ T6651] end_report+0x73/0x170 [ 140.760891][ T6651] ? pn_bind+0x106/0xb20 [ 140.765132][ T6651] kasan_report+0x128/0x150 [ 140.769659][ T6651] ? pn_bind+0x106/0xb20 [ 140.773900][ T6651] pn_bind+0x106/0xb20 [ 140.777968][ T6651] usb_add_function+0x2e1/0x9f0 [ 140.782807][ T6651] ? check_remote_wakeup_config+0x58/0x1c0 [ 140.788605][ T6651] configfs_composite_bind+0xde0/0x1410 [ 140.794150][ T6651] ? __pfx_configfs_composite_bind+0x10/0x10 [ 140.800119][ T6651] gadget_bind_driver+0x2ca/0x9e0 [ 140.805146][ T6651] ? __pfx_gadget_bind_driver+0x10/0x10 [ 140.810688][ T6651] really_probe+0x254/0xae0 [ 140.815191][ T6651] __driver_probe_device+0x1e8/0x360 [ 140.820470][ T6651] driver_probe_device+0x4f/0x240 [ 140.825490][ T6651] __driver_attach+0x339/0x600 [ 140.830249][ T6651] bus_for_each_dev+0x23b/0x2c0 [ 140.835105][ T6651] ? __pfx___driver_attach+0x10/0x10 [ 140.840384][ T6651] ? __pfx_bus_for_each_dev+0x10/0x10 [ 140.845759][ T6651] ? srso_alias_return_thunk+0x5/0xfbef5 [ 140.851386][ T6651] ? do_raw_spin_unlock+0xf5/0x210 [ 140.856493][ T6651] bus_add_driver+0x345/0x670 [ 140.861174][ T6651] driver_register+0x23a/0x320 [ 140.865937][ T6651] usb_gadget_register_driver_owner+0xf9/0x270 [ 140.872090][ T6651] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 140.877721][ T6651] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 140.883875][ T6651] configfs_write_iter+0x337/0x430 [ 140.888993][ T6651] vfs_write+0x612/0xba0 [ 140.893228][ T6651] ? __pfx_vfs_write+0x10/0x10 [ 140.897988][ T6651] ? __fget_files+0x2a/0x420 [ 140.902578][ T6651] ? srso_alias_return_thunk+0x5/0xfbef5 [ 140.908205][ T6651] ksys_write+0x150/0x270 [ 140.912530][ T6651] ? __pfx_ksys_write+0x10/0x10 [ 140.917373][ T6651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.923430][ T6651] do_syscall_64+0x174/0x580 [ 140.928020][ T6651] ? trace_irq_disable+0x3b/0x140 [ 140.933046][ T6651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.938930][ T6651] RIP: 0033:0x7fb938b9de99 [ 140.943331][ T6651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.962925][ T6651] RSP: 002b:00007fb939aac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 140.971329][ T6651] RAX: ffffffffffffffda RBX: 00007fb938e25fa0 RCX: 00007fb938b9de99 [ 140.979285][ T6651] RDX: 000000000000000b RSI: 0000200000000280 RDI: 0000000000000003 [ 140.987240][ T6651] RBP: 00007fb938c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 140.995202][ T6651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 141.003158][ T6651] R13: 00007fb938e26038 R14: 00007fb938e25fa0 R15: 00007fffc6eca108 [ 141.011125][ T6651] [ 141.014366][ T6651] Kernel Offset: disabled [ 141.018668][ T6651] Rebooting in 86400 seconds..