last executing test programs: 8.020567036s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) 6.78882533s ago: executing program 0 (id=6): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_open_procfs(0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xb, 0x11, r3, 0x180000000) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000003500)={0x0, 0x0, &(0x7f00000034c0)={&(0x7f0000003300)={0x2, 0x3, 0x8, 0x9, 0x2, 0x0, 0x70bd27, 0x25dfdbfb}, 0x10}}, 0x40880) 6.731991691s ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x40) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3b, 0xe, {{{}, {}, @device_b, @device_a, @from_mac=@broadcast}, 0x0, @random, 0x8848, @void, @void, @val={0x3, 0x1, 0x5c}, @void, @val={0x6, 0x2, 0x10}, @void, @void, @val={0x2a, 0x1, {0x1, 0x0, 0x1}}, @void, @void, @void, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x54}}, @void}}], @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x40) 6.303670464s ago: executing program 2 (id=7): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r2, {0xe, 0x7}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x14, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 5.144978703s ago: executing program 1 (id=8): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)='\x00'/14, 0x0, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.140903743s ago: executing program 3 (id=4): write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)={'#! ', './tracing'}, 0xd) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 4.884109504s ago: executing program 1 (id=9): r0 = socket(0x10, 0x803, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000110f00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000100001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r7], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 4.420759324s ago: executing program 3 (id=10): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000e00)=ANY=[@ANYBLOB="400f13"], 0x0, 0x0, 0x0, 0x0, 0x0}) 4.374212037s ago: executing program 0 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknod$loop(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) execve(&(0x7f0000000740)='./file0\x00', 0x0, 0x0) chown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRESOCT=r3, @ANYRESOCT, @ANYBLOB="d5eb6c08", @ANYRESOCT, @ANYRES16=r3, @ANYBLOB="00000000000000000000004fd08a50c4d21d89000014000000000000"], 0x48) socket(0x1d, 0x2, 0x6) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000002000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000691000/0x2000)=nil, 0x0}, 0xfffffe78) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x1198, &(0x7f0000000040)={0x0, 0x3cbe, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r4, 0x2219, 0xcf74, 0x16, 0x0, 0x0) bpf$MAP_CREATE(0x1800000000000000, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000040000000200000000000000017f7502", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000000000000000000000200000000000000000000005c001400636d616328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000003509fe8fd57fd44aa5074c50bc700e530c001c00", @ANYRES32=0x0, @ANYBLOB="06"], 0x158}, 0x1, 0x0, 0x0, 0x40001}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 4.12754308s ago: executing program 2 (id=12): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) writev(r0, &(0x7f0000002300)=[{&(0x7f00000003c0)="74a50cf2d23cab", 0x7}], 0x1) sendto$inet(r0, &(0x7f0000000300)="ab", 0x34000, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) 3.963789716s ago: executing program 4 (id=5): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r3, {0xe, 0x7}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x14, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x8, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 3.855962224s ago: executing program 2 (id=13): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000004026093333400000000001090224"], 0x0) syz_usb_connect$midi(0x0, 0x143, &(0x7f00000001c0)=ANY=[@ANYBLOB="12011003000000ef410e5041400001020301090231010101092004090400000801030040072401080007000d240301e2035d010903917f050724010800070007240101000700192403020109d00c01010700ff081b6c020102008709010d080624020108040724158e00070013240303fd064aff04930440090408400502f3072401071a6967e2d72e2ce7070009050800ff030303091225010ef0e11694252eb08d92d47c17e95d0905040220000409060925010558fc647575090503100800008105082501052501017809050f1010004e080914"], 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000740)={0x14, &(0x7f0000000680)={0x20, 0xf, 0x3b, {0x3b, 0xb, "9e03946043e37b7f1dc01d9ab4d94476dbf30d1a1f14019cf555f4337db03720c76d2011741852bff648661ade85ed178a9fbe6def1107452c"}}, &(0x7f0000000700)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_connect$midi(0x2, 0x6d, &(0x7f0000000f80)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x18d1, 0x2d04, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5b, 0x1, 0x1, 0x0, 0x40, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x3, 0x1, 0x3, 0x0, 0x6, [@ms_header={0x7, 0x24, 0x1, 0x8685, 0x7}], [{{0x9, 0x5, 0x4, 0x0, 0x40, 0x2, 0x7, 0xf, {0x10, 0x25, 0x1, 0xc, "67df5382540e985d33626ed5"}}}, {{0x9, 0x5, 0x6, 0x0, 0x8, 0x0, 0x8, 0xf, {0xe, 0x25, 0x1, 0xa, "17cd9639649ac0f53b3f"}}}, {{0x9, 0x5, 0xe, 0x4, 0x400, 0x6, 0x2b, 0xa7, {0x9, 0x25, 0x1, 0x5, "f35ad5c413"}}}]}}}}}]}}, &(0x7f0000001440)={0x0, 0x0, 0xd3, &(0x7f0000001340)={0x5, 0xf, 0xd3, 0x1, [@generic={0xce, 0x10, 0x2, "e1c12fed47b3e99a5d896a24a80f32476cffd650bab9a182c327a4d54a797e74a66c7502ab86b63eac49cf63f787096675da2db0d3c62d86067f53af4d498f97504fcef5b950925b36b1f0486963560720b21eabdd1ec75506ae58f40ab678a939b7bc105288bfe023109295280ab3de561d0d08c6a8d7286df94899e6b517e065239b4d1b17e10f551f649d27caf12d9116abce02bb0b02cbe7e0bcad9be6f5ca7bf143702a964ed4277f91a852506c426ffc77caed1ca9e81f60192fe6ff6cd0edb95cc4dc7cb111a302"}]}}) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_control_io$uac3(r1, &(0x7f0000000a40)={0x14, &(0x7f0000000940)={0x40, 0x5, 0x65, {0x65, 0x6, "a65bd01eade545bf9bb273d60b72487de7d4652d55528acc39b93ad893586a45384510d6bed5e13602d10c3defbd7ae2bdbae6c624fe22bcd70590cc7f8c9e6eb331283ed4b2ce4f64a9c3d2eecccdf1d9696e08a7bbaa6c659a502ab612a88fe93012"}}, &(0x7f00000009c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc14}}}, &(0x7f0000000c80)={0x44, &(0x7f0000000a80)={0x20, 0x31, 0x34, "32dcfd0b6ada2d879601fefcce16501184119fa05474c6c67440a3fa22c24011758a15354e0e9a02f38958fbe0497609d654dace"}, &(0x7f0000000ac0)={0x0, 0xa, 0x1, 0x10}, &(0x7f0000000b00)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000b40)={0x20, 0x81, 0x3, "675dd6"}, &(0x7f0000000b80)={0x20, 0x82, 0x1, "97"}, &(0x7f0000000bc0)={0x20, 0x83, 0x1, 'T'}, &(0x7f0000000c00)={0x20, 0x84, 0x3, "4662f6"}, &(0x7f0000000c40)={0x20, 0x85, 0x3, "ef27d8"}}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x80000001) syz_usb_control_io$hid(r0, &(0x7f0000000f40)={0x24, &(0x7f0000000d00)={0x20, 0x21, 0x9b, {0x9b, 0x3, "f067a4e04d5d4a4cefa292ad85e5d7357c05487ab65700c93644e8f2ab09d5506fac6ba3d25cd3548727c59db367c7ee13170539940e8443751b23136a233e15fe09f17c398c70680a0200f3c5006379cf25d2ed615081c814eb7aa4aa5b1cf82f6f3acfe3e2053031d20fb830c95a5f22af096561c0aa468e4cc78354a42785b42650c3b5dd056acc6817d4f24d34e1ace7f6dd124ff40822"}}, &(0x7f0000000dc0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x448}}, &(0x7f0000000e00)={0x0, 0x22, 0x2, {[@local=@item_012={0x1, 0x2, 0x4, "f2"}]}}, &(0x7f0000000f00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0xa, 0x1, {0x22, 0x952}}}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) 3.792824933s ago: executing program 1 (id=14): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004024042c0100000000000109022e0001010080320904000004ffffff0007058102000200070502020002000705830200020007050402"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000340)={0x44, &(0x7f0000000100)={0x60, 0xe, 0xf, "cf0d416510d44aa84085a068b5207a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_disconnect(0xffffffffffffffff) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000200)={0x20, 0x11, 0x8, "0c5bfbd8c79b3161"}, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x81, 0x2, "07bb"}, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x85, 0x3, "cbc4ba"}}) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) 3.491089139s ago: executing program 4 (id=15): open_tree(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0x100) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) syz_mount_image$squashfs(&(0x7f00000001c0), &(0x7f0000000200)='./file0\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10"], 0x1, 0x19e, &(0x7f0000000440)="$eJzs0L1rU1EYx/Hvc87Ji0qVqDhU0IDF65VqXqoOLganCLng4CIYNKSxKSZqejPYUrGLFKTY2dGpzoKOouBcHAQHvS7dpBk6iYNcubkn4v/g+cDld59zX855nm44CHPA773VNjXGNAf5hGCAK5KuKZXmW1v/sLmZBldtvWHzlc3pcHnlXqvX6ywVLxcpJAvxk/RRcbIff98JFccUI6GGfNlbbbfkTkBco6/mAwoNzoJuMvCfM22mOHobTextcE0xEK8Bh0rD/sNSuLxybrHfWugsdO5Xq3OXyhfK5YvV0t3FXqf8BvGfiUIl5wvIBezzH5Np8nTb7FezgvhdFengBWSbbG7rM6dmRyh/lxjhvTci9810i+oGp8nfShqqc0R4iT5gmzGMN6rnuK5eS8V8Nj8zivya1ufbD3rz6zeV/Mpu1WQ3L5UdMl4GqDCXjIbDfGA9YiaiHrEVsfOdk2L+natZI9Zgq+OcgCyPWsPhUiULH8ULqCZXAabGv1MBM43knO/sNzb4OrlxHMdxHMdxHMdx/gN/AgAA//8Dhlz/") timer_settime(0x0, 0x1, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0xf0, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f00000002c0), 0x0) syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="6e66732c646f74732c636865636b3d7374726963742c646f74732c6572726f72733d72656d6f756e742d726f2c00fc403bb14281bbfb9b8213bd6284536d64789a24dd73b98b3e33cb47fed8a736464bb62e9e891aa832722dfc28bfa4489b3a127a503e72326b737d0f67c97be6f37ef46154dec39ef8718946ffc8cd4d735a0b101c1722477bbe2f923577ea51f7116f17c3ddf5c497fba2d0bb3272d123b31e9461d4e2d65a42e1174fa269de92e463fc1ca202650fe2628e15341e45dce6c0de2367bdb50cc5b2b462e1d45fc3265f1a88561ab6afb1b73a00340b5c5fc6e601843a59f3cdeb36991cfa985453287d4c9d2d6e21adddc57a607369c682e821b20dc0efd51d12f386f3f8e53c05e696e50c7c3f79b1b0bd7e5cfaf3f63d89cb9412c30c45f9d4d63d267d2a43f03a47fa56b300"/318], 0x1, 0x242, &(0x7f0000000300)="$eJzs3bFqFFEUBuBjskmWNKYWiwEbq0WtbBeJIA4IK1No5UC0SUSYNKPVPIbP4CP5GKnSjZhZsklcbczm7s58Hyz3wM/Cuc3eLc6d+fDw8/HRl9NP7c/vMR5nMYpo2jbiILZiOzr35uvWRb0bVzUBAGya2aycpu6B1aqqabkTEXt/JMWPJA0BAAAAAAAAAADw35bN/8e5+X8A6DPz//1XVdNyf/7/7Trz/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA65217v/3HJ3V/AMDtc/4DwPA4/wFgeJz/ADA8b9+9fz3N88NZlo0jzpq6qItu7fKXr/LDJ9mFg8W3zuq62L7Mn3Z5dj3fif15/mxpvhuPH3X57+zFm/xGvhdHq98+AAAAAAAAAAAAAAAAAAAArIVJdmnp/f7J5G95V115PsCN+/ujeDC6s20AAAAAAAAAAAAAAAAAAADARjv9+u24PDn5WCl6U8TztWjjrouItWijL0XqXyYAAAAAAAAAAAAAAAAAABiexaXf1J0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQDqL9/+vroiIpu2k3i4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQY78CAAD//139ms4=") prlimit64(0x0, 0xe, &(0x7f0000000200)={0x7, 0x7ff}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000004840), 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x101140, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x8008000000010, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000100), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) 2.331257636s ago: executing program 4 (id=16): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000980)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7888d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba255854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6955889fcc8cce51ecd73721ad8c044534221e457a1fa6ce4f38845f0077e10f19314402484b81bc3727426283f803d9c60eb5e9320574a599d763952148fb2bd655e900c850243e43246c70a3b317b0d87a001ce1972a24ba7a5e294243829ead8f34d4d740101eb880d8c51bc1f55905e873c1e2c6a411503f02ef69a757e52e6db9e9566232c3323909b8ac8d2ab060db81c109b1239c44a9420d9251e6fa5", 0x1e8}, {&(0x7f0000000f00)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e", 0x28}], 0x2}}, {{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000640)="3da39b2ad5defd21d90486407e56e26daf1a5c6f937e2b330e7f2a369d4e1d7d075b45ee8b8b533ce21787a34cc98008199ec62730423ed278abd4e2bb8877d253d1c697ecb90b33871b36094c4147ad2fee", 0x52}], 0x1}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb8656", 0x39a) 2.122347943s ago: executing program 4 (id=17): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff000000070501020002000705810200020007050202000200070582020002"], 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_write(r0, 0x81, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x0, 0x0) 880.063037ms ago: executing program 0 (id=18): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000440)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff88a849008100310008004500002400680000"], 0x0) 742.529684ms ago: executing program 3 (id=19): r0 = syz_usb_connect$hid(0x0, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408680000000000000000109022200010100803209040000010300000009211101000122"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00224c00000005200973a10185010a19031500250575089501b1020a16031500250575089501b10285020a5304150025057508950181020a5404150025057508950181020a550415002505750895018102c0", @ANYRESDEC, @ANYRES32], 0x0}, 0x0) 669.961444ms ago: executing program 0 (id=20): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, 0x0, 0x0) listen(r0, 0x8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) r1 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f680, 0x0, 0x39d}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="d9c38c", 0x3}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x23, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) io_uring_enter(r1, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 568.743199ms ago: executing program 0 (id=21): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3b, 0xe, {{{}, {}, @device_b, @device_a, @from_mac=@broadcast}, 0x0, @random, 0x8848, @void, @void, @val={0x3, 0x1, 0x5c}, @void, @val={0x6, 0x2, 0x10}, @void, @void, @val={0x2a, 0x1, {0x1, 0x0, 0x1}}, @void, @void, @void, @val={0x71, 0x7, {0x1, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x54}}, @void}}], @NL80211_ATTR_SMPS_MODE={0x5, 0xd5, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x40) 567.588551ms ago: executing program 0 (id=22): write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)={'#! ', './tracing'}, 0xd) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 164.147439ms ago: executing program 4 (id=23): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_open_procfs(0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_open_procfs(0x0, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xb, 0x11, r3, 0x180000000) socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000003500)={0x0, 0x0, &(0x7f00000034c0)={&(0x7f0000003300)={0x2, 0x3, 0x8, 0x9, 0x2, 0x0, 0x70bd27, 0x25dfdbfb}, 0x10}}, 0x40880) 150.410431ms ago: executing program 1 (id=24): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0xe, 0x0, &(0x7f00000003c0)='\x00'/14, 0x0, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 1 (id=25): socket$alg(0x26, 0x5, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x10, 0x101000) syz_ublk_setup_io_uring(0x20, &(0x7f0000000340)={0x0, 0x57a, 0x1000, 0x40002, 0x2a7}, 0x0, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x82042, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x0, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x2100, 0x2d8, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf910, 0x0, 0x2, 0x1f0, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xe0b, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000000a01020000000000000000010000006c000000160a010000000000000000000100000009000100737945b6195ee7e65a9e020073797a320000000040000380080002402000000008000140000000002c0003801400010070696d367265673100000000000000001400010076657468305f746f5f626f6e6400000048000000160a0101000b000000000000010000000900020073797a32000000000900010073797a30000000001c000380180003801400010076657468305f746f5f626f6e64000000140000001000010000000000000000000000000ab0b463e72286675a3f546dc93d0df0bc0b3c4c019997d23e8b66446a3169c5e7a09ba4ecb3eab20661ca6ae7fc1c60339c36d0ce204c22c6c7c64eb06fc7083439a98ca98cf4dbc2aa22adba831efd30d2619803d9476ce8087f346541f00fd99cbb87dda2919ca16474049e245d6694755a0b9a86f999bfa72d6f86c602178850d7f9ee9313b63799d3e0d1c9b6339da9755db2"], 0xf0}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.131' (ED25519) to the list of known hosts. [ 73.638003][ T5607] cgroup: Unknown subsys name 'net' [ 73.774905][ T5607] cgroup: Unknown subsys name 'cpuset' [ 73.777799][ T5607] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.246306][ T5607] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.652125][ T5635] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.654445][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.654707][ T5635] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.654966][ T5635] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.655218][ T5635] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.655415][ T5635] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.656887][ T5637] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.658080][ T5637] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.659032][ T5637] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.659322][ T5637] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.660823][ T5637] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.661492][ T5637] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.662695][ T5637] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.663345][ T5637] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.674568][ T5635] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.678339][ T5623] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.696580][ T5623] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.703645][ T5635] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.704034][ T5635] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.720506][ T5635] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.728343][ T5635] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.728843][ T5635] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.743762][ T5635] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.751327][ T5635] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 77.765438][ T5633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.562833][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.562939][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.563293][ T5622] bridge_slave_0: entered allmulticast mode [ 79.565058][ T5622] bridge_slave_0: entered promiscuous mode [ 79.616983][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.617112][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.617365][ T5622] bridge_slave_1: entered allmulticast mode [ 79.618559][ T5622] bridge_slave_1: entered promiscuous mode [ 79.692869][ T5633] Bluetooth: hci3: command tx timeout [ 79.735392][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.735550][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.735664][ T5619] bridge_slave_0: entered allmulticast mode [ 79.737201][ T5619] bridge_slave_0: entered promiscuous mode [ 79.741848][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.742132][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.743208][ T5619] bridge_slave_1: entered allmulticast mode [ 79.747188][ T5619] bridge_slave_1: entered promiscuous mode [ 79.772249][ T5633] Bluetooth: hci1: command tx timeout [ 79.790486][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.790707][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.794330][ T5620] bridge_slave_0: entered allmulticast mode [ 79.798112][ T5620] bridge_slave_0: entered promiscuous mode [ 79.840289][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.851484][ T5633] Bluetooth: hci4: command tx timeout [ 79.851698][ T52] Bluetooth: hci2: command tx timeout [ 79.851802][ T5633] Bluetooth: hci0: command tx timeout [ 79.858983][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.859088][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.859218][ T5620] bridge_slave_1: entered allmulticast mode [ 79.860855][ T5620] bridge_slave_1: entered promiscuous mode [ 79.864472][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.864687][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.865495][ T5618] bridge_slave_0: entered allmulticast mode [ 79.869900][ T5618] bridge_slave_0: entered promiscuous mode [ 79.875476][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.875802][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.876062][ T5621] bridge_slave_0: entered allmulticast mode [ 79.882836][ T5621] bridge_slave_0: entered promiscuous mode [ 79.896483][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.953475][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.969419][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.992183][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.992281][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.992403][ T5618] bridge_slave_1: entered allmulticast mode [ 79.993901][ T5618] bridge_slave_1: entered promiscuous mode [ 80.025014][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.025107][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.025185][ T5621] bridge_slave_1: entered allmulticast mode [ 80.026237][ T5621] bridge_slave_1: entered promiscuous mode [ 80.099200][ T5622] team0: Port device team_slave_0 added [ 80.115637][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.117803][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.149617][ T5622] team0: Port device team_slave_1 added [ 80.153395][ T5619] team0: Port device team_slave_0 added [ 80.162682][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.164595][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.166745][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.168491][ T5619] team0: Port device team_slave_1 added [ 80.229311][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.294514][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.294527][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.294546][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.298310][ T5620] team0: Port device team_slave_0 added [ 80.300054][ T5618] team0: Port device team_slave_0 added [ 80.333626][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.333660][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.333721][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.339912][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.339941][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.339995][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.357401][ T5620] team0: Port device team_slave_1 added [ 80.373922][ T5618] team0: Port device team_slave_1 added [ 80.428729][ T5621] team0: Port device team_slave_0 added [ 80.432635][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.432674][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.432744][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.515102][ T5621] team0: Port device team_slave_1 added [ 80.538593][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.538606][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.538628][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.539562][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.539574][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.539593][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.620663][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.620732][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.620804][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.703937][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.703951][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.703972][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.705635][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.705644][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.705660][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.758654][ T5622] hsr_slave_0: entered promiscuous mode [ 80.762927][ T5622] hsr_slave_1: entered promiscuous mode [ 80.803439][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.803476][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.803528][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.859225][ T5619] hsr_slave_0: entered promiscuous mode [ 80.859920][ T5619] hsr_slave_1: entered promiscuous mode [ 80.860411][ T5619] debugfs: 'hsr0' already exists in 'hsr' [ 80.860468][ T5619] Cannot create hsr debugfs directory [ 80.907586][ T5618] hsr_slave_0: entered promiscuous mode [ 80.908309][ T5618] hsr_slave_1: entered promiscuous mode [ 80.908780][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 80.908797][ T5618] Cannot create hsr debugfs directory [ 81.057741][ T5620] hsr_slave_0: entered promiscuous mode [ 81.058542][ T5620] hsr_slave_1: entered promiscuous mode [ 81.059083][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 81.059102][ T5620] Cannot create hsr debugfs directory [ 81.074322][ T5621] hsr_slave_0: entered promiscuous mode [ 81.076863][ T5621] hsr_slave_1: entered promiscuous mode [ 81.078663][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 81.078713][ T5621] Cannot create hsr debugfs directory [ 81.569354][ T5618] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.586213][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.588655][ T5618] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.606900][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.608729][ T5618] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.628113][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.644358][ T5618] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.647239][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.715802][ T5622] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.725522][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.740265][ T5622] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.751942][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.758540][ T5622] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.777029][ T5633] Bluetooth: hci3: command tx timeout [ 81.785495][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.786418][ T5622] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.807287][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.854242][ T5633] Bluetooth: hci1: command tx timeout [ 81.900228][ T5620] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 81.913600][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 81.914487][ T5620] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 81.918340][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 81.919099][ T5620] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 81.928021][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 81.935932][ T5633] Bluetooth: hci2: command tx timeout [ 81.943541][ T5633] Bluetooth: hci0: command tx timeout [ 81.943571][ T5633] Bluetooth: hci4: command tx timeout [ 81.974599][ T5620] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 81.986788][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.088205][ T5621] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 82.098763][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.110305][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.125674][ T5621] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 82.130686][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.154624][ T5621] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 82.158751][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.159908][ T5621] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 82.183894][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.258582][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.300722][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.300858][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.321366][ T5619] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.326012][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.326714][ T5619] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.329353][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.330023][ T5619] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.336212][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.384621][ T5619] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.387792][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.398962][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.399419][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.488703][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.606296][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.618145][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.659078][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.659172][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.700552][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.700617][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.756114][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.775408][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.822988][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.823063][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.835321][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.835597][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.901678][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.920633][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.946574][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.946666][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.039788][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.039885][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.065863][ T5619] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.111001][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.111096][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.121720][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.121827][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.448428][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.619672][ T5618] veth0_vlan: entered promiscuous mode [ 83.657284][ T5618] veth1_vlan: entered promiscuous mode [ 83.827820][ T5618] veth0_macvtap: entered promiscuous mode [ 83.845558][ T5618] veth1_macvtap: entered promiscuous mode [ 83.857013][ T52] Bluetooth: hci3: command tx timeout [ 83.931829][ T52] Bluetooth: hci1: command tx timeout [ 83.965487][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.989793][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.013049][ T52] Bluetooth: hci0: command tx timeout [ 84.026538][ T52] Bluetooth: hci4: command tx timeout [ 84.026569][ T52] Bluetooth: hci2: command tx timeout [ 84.133027][ T283] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.133075][ T283] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.133113][ T283] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.133149][ T283] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.287322][ T3375] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.287343][ T3375] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.410567][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.425335][ T268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.425353][ T268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.480782][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.589212][ T5618] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 84.659469][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.671668][ T5622] veth0_vlan: entered promiscuous mode [ 84.710739][ T5622] veth1_vlan: entered promiscuous mode [ 84.800396][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.857758][ T5622] veth0_macvtap: entered promiscuous mode [ 84.879052][ T5620] veth0_vlan: entered promiscuous mode [ 84.889651][ T5622] veth1_macvtap: entered promiscuous mode [ 84.915396][ T5620] veth1_vlan: entered promiscuous mode [ 84.949988][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.001141][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.031398][ T5627] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 85.056837][ T5619] veth0_vlan: entered promiscuous mode [ 85.079500][ T5620] veth0_macvtap: entered promiscuous mode [ 85.100427][ T5620] veth1_macvtap: entered promiscuous mode [ 85.136071][ T5619] veth1_vlan: entered promiscuous mode [ 85.183344][ T5627] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 85.190531][ T329] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.190610][ T329] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.198172][ T5627] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 85.243114][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.282086][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.308210][ T5621] veth0_vlan: entered promiscuous mode [ 85.341425][ T283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.341445][ T283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.350130][ T5621] veth1_vlan: entered promiscuous mode [ 85.380246][ T5619] veth0_macvtap: entered promiscuous mode [ 85.404888][ T5619] veth1_macvtap: entered promiscuous mode [ 85.431107][ T329] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.431234][ T329] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.431276][ T329] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.431314][ T329] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.512733][ T283] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.512805][ T283] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.512847][ T283] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.531355][ T268] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.595605][ T5621] veth0_macvtap: entered promiscuous mode [ 85.599439][ T329] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.599457][ T329] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.641538][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.659063][ T5621] veth1_macvtap: entered promiscuous mode [ 85.692147][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.746393][ T329] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.746413][ T329] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.786692][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.823390][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.891184][ T283] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.892115][ T283] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.932264][ T5633] Bluetooth: hci3: command tx timeout [ 85.933309][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.937604][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.937912][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.938197][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.938577][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.938731][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.998813][ T5627] cxacru 2-1:1.0: invalid response length to cm 0x91: 0 [ 85.998955][ T5627] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -5 [ 85.998981][ T5627] ATM dev 0: usbatm_atm_init: atm_start failed: -5! [ 86.013697][ T5633] Bluetooth: hci1: command tx timeout [ 86.064708][ T283] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.064727][ T283] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.091214][ T52] Bluetooth: hci0: command tx timeout [ 86.091249][ T52] Bluetooth: hci2: command tx timeout [ 86.091293][ T5633] Bluetooth: hci4: command tx timeout [ 86.092340][ T5627] cxacru 2-1:1.0: probe with driver cxacru failed with error -5 [ 86.205931][ T5627] usb 2-1: USB disconnect, device number 2 [ 86.308149][ T268] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.308170][ T268] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.476266][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.476286][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.549050][ T283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.549106][ T283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.471345][ T2245] cfg80211: failed to load regulatory.db [ 88.473711][ T5842] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.578269][ T5838] bond1 (unregistering): Released all slaves [ 89.141119][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 89.251106][ T5720] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 89.296748][ T9] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 89.299210][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 89.299301][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.333844][ T5736] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 89.336972][ T9] usb 4-1: config 0 descriptor?? [ 89.359718][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 89.393834][ T5860] loop4: detected capacity change from 0 to 8 [ 89.414168][ T5720] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 89.416055][ T5720] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 89.416076][ T5720] usb 3-1: config 0 has no interfaces? [ 89.416102][ T5720] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.421775][ T5720] usb 3-1: config 0 descriptor?? [ 89.473071][ T5860] squashfs: Unknown parameter '' [ 89.494907][ T5736] usb 2-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 89.498364][ T5736] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 89.498389][ T5736] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 89.498424][ T5736] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.576312][ T9] pwc: send_video_command error -71 [ 89.576334][ T9] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 89.576684][ T9] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 89.634424][ T9] usb 4-1: USB disconnect, device number 2 [ 89.636656][ T5736] usb 2-1: probing VID:PID(0424:012C) [ 89.663078][ T5736] usb 2-1: vub300 testing BULK IN EndPoint(0) 81 [ 89.674059][ T5736] usb 2-1: vub300 testing BULK OUT EndPoint(1) 02 [ 89.674245][ T5736] usb 2-1: vub300 testing BULK IN EndPoint(2) 83 [ 89.674354][ T5736] usb 2-1: vub300 testing BULK OUT EndPoint(3) 04 [ 89.674433][ T5736] usb 2-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 90.231923][ T5852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.232334][ T5852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.239178][ T1219] usb 3-1: USB disconnect, device number 2 [ 90.422106][ T5736] usb 2-1: operating_mode = IRQs 4-bit 48 MHz with 512 byte USB packets [ 90.511085][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 90.622631][ T5736] usb 2-1: USB vub300 remote SDIO host controller[0]connected with SD/SDIO card inserted [ 90.663542][ T9] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 90.664516][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.664560][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.667977][ T9] usb 4-1: config 0 descriptor?? [ 90.710179][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 90.721044][ T1219] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 90.881934][ T1219] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 90.883293][ T1219] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.883318][ T1219] usb 3-1: config 0 has no interfaces? [ 90.883347][ T1219] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.890019][ T1219] usb 3-1: config 0 descriptor?? [ 91.081099][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 91.083655][ T9] pwc: recv_control_msg error -32 req 02 val 2700 [ 91.084255][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 91.084849][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 91.090419][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 91.091093][ T30] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 91.131787][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 91.134818][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 91.139941][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 91.160827][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 91.186500][ T5852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.199989][ T5852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.225517][ T5852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.225942][ T5852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.243398][ T30] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 91.254922][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.381864][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 91.383890][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 91.387870][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 91.389099][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 91.390090][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 91.390479][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 91.440826][ T9] pwc: Registered as video103. [ 91.449090][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input5 [ 91.465784][ T9] usb 4-1: USB disconnect, device number 3 [ 91.611547][ T5871] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 91.614334][ T5871] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 91.894808][ T9] usb 2-1: USB disconnect, device number 3 [ 91.902228][ T5720] usb 2-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 91.906855][ T5720] usb 2-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 91.908347][ T5720] usb 2-1: SET_CLOCK_SPEED 200kHz failed with retval=-19 [ 91.916313][ T30] cxacru 5-1:1.0: invalid response length to cm 0x91: 0 [ 91.916336][ T30] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -5 [ 91.916348][ T30] ATM dev 0: usbatm_atm_init: atm_start failed: -5! [ 91.982467][ T30] cxacru 5-1:1.0: probe with driver cxacru failed with error -5 [ 92.019091][ T30] usb 5-1: USB disconnect, device number 2 [ 92.301095][ T1219] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 92.461720][ T1219] usb 4-1: New USB device found, idVendor=8086, idProduct=0000, bcdDevice= 0.00 [ 92.463459][ T1219] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.463515][ T1219] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 92.463552][ T1219] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.521271][ T1219] usbhid 4-1:1.0: couldn't find an input interrupt endpoint [ 92.596417][ T9] USB vub300 remote SDIO host controller[0] now disconnected [ 92.731333][ C1] BUG: sleeping function called from invalid context at kernel/workqueue.c:4564 [ 92.731354][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5888, name: syz.4.23 [ 92.731372][ C1] preempt_count: 100, expected: 0 [ 92.731382][ C1] RCU nest depth: 1, expected: 0 [ 92.731401][ C1] locks held by syz.4.23/5888: 3, last CPU#1: [ 92.731417][ C1] #0: ffff88807f38dcf8 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x182/0x390 [ 92.731495][ C1] #1: ffffffff8ed5c7a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 92.731555][ C1] #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 92.731612][ C1] Preemption disabled at: [ 92.731618][ C1] [] handle_softirqs+0xab/0x860 [ 92.731666][ C1] CPU: 1 UID: 0 PID: 5888 Comm: syz.4.23 Not tainted syzkaller #0 PREEMPT(full) [ 92.731690][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.731709][ C1] Call Trace: [ 92.731720][ C1] [ 92.731729][ C1] dump_stack_lvl+0xe8/0x150 [ 92.731762][ C1] __might_resched+0x36a/0x4c0 [ 92.731795][ C1] ? handle_softirqs+0xab/0x860 [ 92.731825][ C1] cancel_delayed_work_sync+0x6b/0xf0 [ 92.731859][ C1] mmc_free_host+0x19/0x30 [ 92.731886][ C1] call_timer_fn+0x18d/0x5f0 [ 92.731911][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 92.731934][ C1] ? call_timer_fn+0xd5/0x5f0 [ 92.731958][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 92.731993][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 92.732025][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 92.732050][ C1] __run_timer_base+0x652/0x8b0 [ 92.732086][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 92.732113][ C1] ? ktime_get+0x1f5/0x220 [ 92.732135][ C1] ? lapic_next_event+0x11/0x20 [ 92.732163][ C1] run_timer_softirq+0xb7/0x170 [ 92.732187][ C1] handle_softirqs+0x226/0x860 [ 92.732218][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 92.732256][ C1] __irq_exit_rcu+0xcb/0x220 [ 92.732304][ C1] irq_exit_rcu+0x9/0x30 [ 92.732334][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 92.732366][ C1] [ 92.732375][ C1] [ 92.732385][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 92.732412][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 92.732451][ C1] Code: 8b 3d 74 0b ad 0c 48 89 de 5b e9 23 99 64 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 2b ce 11 65 48 8b 15 08 2b ce 11 f7 c2 00 01 00 ff [ 92.732471][ C1] RSP: 0018:ffffc90004d3f660 EFLAGS: 00000202 [ 92.732493][ C1] RAX: ffffffff821e575c RBX: 0000000000000001 RCX: 8000000000000001 [ 92.732511][ C1] RDX: 0000000000000002 RSI: ffffffff8c6da560 RDI: ffffffff8c6da520 [ 92.732528][ C1] RBP: ffffc90004d3fa20 R08: ffff88805b6f7d23 R09: 1ffff1100b6defa4 [ 92.732547][ C1] R10: dffffc0000000000 R11: ffffed100b6defa5 R12: 0000000000000001 [ 92.732564][ C1] R13: dffffc0000000000 R14: ffff88807f38d940 R15: 0000000000000000 [ 92.732591][ C1] ? finish_fault+0xf9c/0x1220 [ 92.732632][ C1] finish_fault+0xf9c/0x1220 [ 92.732680][ C1] ? shmem_fault+0x270/0x390 [ 92.732726][ C1] ? do_pte_missing+0x140c/0x34b0 [ 92.732750][ C1] do_pte_missing+0x223d/0x34b0 [ 92.732786][ C1] ? handle_mm_fault+0xf1/0x3750 [ 92.732824][ C1] handle_mm_fault+0x1a53/0x3750 [ 92.732870][ C1] ? handle_mm_fault+0xf1/0x3750 [ 92.732916][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 92.732951][ C1] ? follow_page_pte+0x748/0xf10 [ 92.732995][ C1] ? __pfx_follow_page_pte+0x10/0x10 [ 92.733050][ C1] __get_user_pages+0x1670/0x2750 [ 92.733117][ C1] populate_vma_page_range+0x2be/0x3c0 [ 92.733152][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 92.733188][ C1] ? down_read+0x2b9/0x320 [ 92.733229][ C1] __mm_populate+0x25f/0x390 [ 92.733262][ C1] ? __pfx___mm_populate+0x10/0x10 [ 92.733304][ C1] vm_mmap_pgoff+0x353/0x4e0 [ 92.733339][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 92.733371][ C1] ? rcu_is_watching+0x16/0xb0 [ 92.733417][ C1] ? ksys_mmap_pgoff+0xf3/0x760 [ 92.733449][ C1] ? __x64_sys_mmap+0x7f/0x140 [ 92.733478][ C1] do_syscall_64+0x166/0x520 [ 92.733518][ C1] ? trace_irq_disable+0x3b/0x140 [ 92.733543][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.733565][ C1] ? clear_bhb_loop+0x70/0xc0 [ 92.733590][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.733611][ C1] RIP: 0033:0x7f0dd839e159 [ 92.733635][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.733652][ C1] RSP: 002b:00007f0dd933d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 92.733673][ C1] RAX: ffffffffffffffda RBX: 00007f0dd8625fa0 RCX: 00007f0dd839e159 [ 92.733689][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 92.733704][ C1] RBP: 00007f0dd8435024 R08: ffffffffffffffff R09: 0000000000000000 [ 92.733718][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 92.733731][ C1] R13: 00007f0dd8626038 R14: 00007f0dd8625fa0 R15: 00007ffdb19fc758 [ 92.733763][ C1] [ 92.734139][ C1] [ 93.243951][ C1] ============================= [ 93.248821][ C1] WARNING: suspicious RCU usage [ 93.253734][ C1] syzkaller #0 Tainted: G W [ 93.259724][ C1] ----------------------------- [ 93.264636][ C1] kernel/rcu/srcutree.c:1468 Illegal synchronize_srcu() in same-type SRCU (or in RCU) read-side critical section! [ 93.276656][ C1] [ 93.276656][ C1] other info that might help us debug this: [ 93.276656][ C1] [ 93.286962][ C1] [ 93.286962][ C1] rcu_scheduler_active = 2, debug_locks = 1 [ 93.295093][ C1] locks held by syz.4.23/5888: 3, last CPU#1: [ 93.301244][ C1] #0: ffff88807f38dcf8 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x182/0x390 [ 93.310726][ C1] #1: ffffffff8ed5c7a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 93.320335][ C1] #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 93.330857][ C1] [ 93.330857][ C1] stack backtrace: [ 93.336809][ C1] CPU: 1 UID: 0 PID: 5888 Comm: syz.4.23 Tainted: G W syzkaller #0 PREEMPT(full) [ 93.347506][ C1] Tainted: [W]=WARN [ 93.351332][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.361403][ C1] Call Trace: [ 93.364712][ C1] [ 93.367576][ C1] dump_stack_lvl+0xe8/0x150 [ 93.372224][ C1] lockdep_rcu_suspicious+0x140/0x1d0 [ 93.377662][ C1] __synchronize_srcu+0x157/0x2e0 [ 93.382719][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 93.388297][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.393370][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 93.399237][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 93.404848][ C1] ? synchronize_srcu+0x20a/0x260 [ 93.409908][ C1] wakeup_source_unregister+0x129/0x3f0 [ 93.415489][ C1] mmc_host_classdev_release+0x47/0x100 [ 93.421067][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 93.427249][ C1] device_release+0xc4/0x1f0 [ 93.431894][ C1] kobject_put+0x222/0x550 [ 93.436359][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 93.441172][ C1] call_timer_fn+0x18d/0x5f0 [ 93.445788][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 93.452497][ C1] ? call_timer_fn+0xd5/0x5f0 [ 93.457226][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 93.462402][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.467650][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 93.474351][ C1] __run_timer_base+0x652/0x8b0 [ 93.479239][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 93.484653][ C1] ? ktime_get+0x1f5/0x220 [ 93.489089][ C1] ? lapic_next_event+0x11/0x20 [ 93.493973][ C1] run_timer_softirq+0xb7/0x170 [ 93.498856][ C1] handle_softirqs+0x226/0x860 [ 93.503656][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 93.508457][ C1] __irq_exit_rcu+0xcb/0x220 [ 93.513080][ C1] irq_exit_rcu+0x9/0x30 [ 93.517376][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 93.523048][ C1] [ 93.526003][ C1] [ 93.528957][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 93.534958][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 93.541144][ C1] Code: 8b 3d 74 0b ad 0c 48 89 de 5b e9 23 99 64 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 2b ce 11 65 48 8b 15 08 2b ce 11 f7 c2 00 01 00 ff [ 93.560775][ C1] RSP: 0018:ffffc90004d3f660 EFLAGS: 00000202 [ 93.566897][ C1] RAX: ffffffff821e575c RBX: 0000000000000001 RCX: 8000000000000001 [ 93.574922][ C1] RDX: 0000000000000002 RSI: ffffffff8c6da560 RDI: ffffffff8c6da520 [ 93.582919][ C1] RBP: ffffc90004d3fa20 R08: ffff88805b6f7d23 R09: 1ffff1100b6defa4 [ 93.590921][ C1] R10: dffffc0000000000 R11: ffffed100b6defa5 R12: 0000000000000001 [ 93.598911][ C1] R13: dffffc0000000000 R14: ffff88807f38d940 R15: 0000000000000000 [ 93.606915][ C1] ? finish_fault+0xf9c/0x1220 [ 93.611731][ C1] finish_fault+0xf9c/0x1220 [ 93.616367][ C1] ? shmem_fault+0x270/0x390 [ 93.621008][ C1] ? do_pte_missing+0x140c/0x34b0 [ 93.626073][ C1] do_pte_missing+0x223d/0x34b0 [ 93.630958][ C1] ? handle_mm_fault+0xf1/0x3750 [ 93.635937][ C1] handle_mm_fault+0x1a53/0x3750 [ 93.640932][ C1] ? handle_mm_fault+0xf1/0x3750 [ 93.645917][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 93.651253][ C1] ? follow_page_pte+0x748/0xf10 [ 93.656252][ C1] ? __pfx_follow_page_pte+0x10/0x10 [ 93.661582][ C1] __get_user_pages+0x1670/0x2750 [ 93.666676][ C1] populate_vma_page_range+0x2be/0x3c0 [ 93.672166][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 93.678185][ C1] ? down_read+0x2b9/0x320 [ 93.682646][ C1] __mm_populate+0x25f/0x390 [ 93.687286][ C1] ? __pfx___mm_populate+0x10/0x10 [ 93.692448][ C1] vm_mmap_pgoff+0x353/0x4e0 [ 93.697085][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 93.702222][ C1] ? rcu_is_watching+0x16/0xb0 [ 93.707068][ C1] ? ksys_mmap_pgoff+0xf3/0x760 [ 93.711953][ C1] ? __x64_sys_mmap+0x7f/0x140 [ 93.716750][ C1] do_syscall_64+0x166/0x520 [ 93.721387][ C1] ? trace_irq_disable+0x3b/0x140 [ 93.726436][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.732526][ C1] ? clear_bhb_loop+0x70/0xc0 [ 93.737270][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.743197][ C1] RIP: 0033:0x7f0dd839e159 [ 93.747652][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.767275][ C1] RSP: 002b:00007f0dd933d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 93.775711][ C1] RAX: ffffffffffffffda RBX: 00007f0dd8625fa0 RCX: 00007f0dd839e159 [ 93.783702][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 93.791687][ C1] RBP: 00007f0dd8435024 R08: ffffffffffffffff R09: 0000000000000000 [ 93.799674][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 93.807660][ C1] R13: 00007f0dd8626038 R14: 00007f0dd8625fa0 R15: 00007ffdb19fc758 [ 93.815663][ C1] [ 93.819346][ C1] BUG: slee ** replaying previous printk message ** [ 93.819346][ C1] BUG: sleeping function called from invalid context at kernel/rcu/srcutree.c:1472 [ 93.819362][ C1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5888, name: syz.4.23 [ 93.819380][ C1] preempt_count: 100, expected: 0 [ 93.819390][ C1] RCU nest depth: 1, expected: 0 [ 93.819401][ C1] locks held by syz.4.23/5888: 3, last CPU#1: [ 93.819417][ C1] #0: ffff88807f38dcf8 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x182/0x390 [ 93.819479][ C1] #1: ffffffff8ed5c7a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 93.819538][ C1] #2: ffffc90000a18cc0 ((&vub300->inactivity_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x5f0 [ 93.819595][ C1] Preemption disabled at: [ 93.819600][ C1] [] handle_softirqs+0xab/0x860 [ 93.819640][ C1] CPU: 1 UID: 0 PID: 5888 Comm: syz.4.23 Tainted: G W syzkaller #0 PREEMPT(full) [ 93.819668][ C1] Tainted: [W]=WARN [ 93.819675][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.819687][ C1] Call Trace: [ 93.819696][ C1] [ 93.819704][ C1] dump_stack_lvl+0xe8/0x150 [ 93.819736][ C1] __might_resched+0x36a/0x4c0 [ 93.819769][ C1] ? handle_softirqs+0xab/0x860 [ 93.819798][ C1] __synchronize_srcu+0x1a1/0x2e0 [ 93.819821][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 93.819838][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 93.819875][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 93.819901][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 93.819936][ C1] ? synchronize_srcu+0x20a/0x260 [ 93.819960][ C1] wakeup_source_unregister+0x129/0x3f0 [ 93.820002][ C1] mmc_host_classdev_release+0x47/0x100 [ 93.820031][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 93.820075][ C1] device_release+0xc4/0x1f0 [ 93.820110][ C1] kobject_put+0x222/0x550 [ 93.820145][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 93.820181][ C1] call_timer_fn+0x18d/0x5f0 [ 93.820207][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 93.820238][ C1] ? call_timer_fn+0xd5/0x5f0 [ 93.820262][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 93.820300][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.820325][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 93.820352][ C1] __run_timer_base+0x652/0x8b0 [ 93.820391][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 93.820420][ C1] ? ktime_get+0x1f5/0x220 [ 93.820442][ C1] ? lapic_next_event+0x11/0x20 [ 93.820473][ C1] run_timer_softirq+0xb7/0x170 [ 93.820498][ C1] handle_softirqs+0x226/0x860 [ 93.820531][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 93.820567][ C1] __irq_exit_rcu+0xcb/0x220 [ 93.820597][ C1] irq_exit_rcu+0x9/0x30 [ 93.820623][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 93.820652][ C1] [ 93.820660][ C1] [ 93.820668][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 93.820693][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 93.820727][ C1] Code: 8b 3d 74 0b ad 0c 48 89 de 5b e9 23 99 64 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 2b ce 11 65 48 8b 15 08 2b ce 11 f7 c2 00 01 00 ff [ 93.820745][ C1] RSP: 0018:ffffc90004d3f660 EFLAGS: 00000202 [ 93.820764][ C1] RAX: ffffffff821e575c RBX: 0000000000000001 RCX: 8000000000000001 [ 93.820780][ C1] RDX: 0000000000000002 RSI: ffffffff8c6da560 RDI: ffffffff8c6da520 [ 93.820795][ C1] RBP: ffffc90004d3fa20 R08: ffff88805b6f7d23 R09: 1ffff1100b6defa4 [ 93.820812][ C1] R10: dffffc0000000000 R11: ffffed100b6defa5 R12: 0000000000000001 [ 93.820828][ C1] R13: dffffc0000000000 R14: ffff88807f38d940 R15: 0000000000000000 [ 93.820852][ C1] ? finish_fault+0xf9c/0x1220 [ 93.820890][ C1] finish_fault+0xf9c/0x1220 [ 93.820934][ C1] ? shmem_fault+0x270/0x390 [ 93.820978][ C1] ? do_pte_missing+0x140c/0x34b0 [ 93.820999][ C1] do_pte_missing+0x223d/0x34b0 [ 93.821032][ C1] ? handle_mm_fault+0xf1/0x3750 [ 93.821067][ C1] handle_mm_fault+0x1a53/0x3750 [ 93.821109][ C1] ? handle_mm_fault+0xf1/0x3750 [ 93.821159][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 93.821189][ C1] ? follow_page_pte+0x748/0xf10 [ 93.821232][ C1] ? __pfx_follow_page_pte+0x10/0x10 [ 93.821272][ C1] __get_user_pages+0x1670/0x2750 [ 93.821329][ C1] populate_vma_page_range+0x2be/0x3c0 [ 93.821359][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 93.821389][ C1] ? down_read+0x2b9/0x320 [ 93.821424][ C1] __mm_populate+0x25f/0x390 [ 93.821452][ C1] ? __pfx___mm_populate+0x10/0x10 [ 93.821486][ C1] vm_mmap_pgoff+0x353/0x4e0 [ 93.821515][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 93.821542][ C1] ? rcu_is_watching+0x16/0xb0 [ 93.821570][ C1] ? ksys_mmap_pgoff+0xf3/0x760 [ 93.821599][ C1] ? __x64_sys_mmap+0x7f/0x140 [ 93.821624][ C1] do_syscall_64+0x166/0x520 [ 93.821652][ C1] ? trace_irq_disable+0x3b/0x140 [ 93.821672][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.821693][ C1] ? clear_bhb_loop+0x70/0xc0 [ 93.821719][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.821739][ C1] RIP: 0033:0x7f0dd839e159 [ 93.821758][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.821774][ C1] RSP: 002b:00007f0dd933d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 93.821795][ C1] RAX: ffffffffffffffda RBX: 00007f0dd8625fa0 RCX: 00007f0dd839e159 [ 93.821810][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 93.821825][ C1] RBP: 00007f0dd8435024 R08: ffffffffffffffff R09: 0000000000000000 [ 93.821839][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 93.821852][ C1] R13: 00007f0dd8626038 R14: 00007f0dd8625fa0 R15: 00007ffdb19fc758 [ 93.821883][ C1] [ 93.821939][ C1] ODEBUG: object ffffc90000a18a80 is NOT on stack ffffc90004d38000, but annotated. [ 93.823751][ C1] ------------[ cut here ]------------ [ 93.823771][ C1] 1 [ 93.823794][ C1] WARNING: lib/debugobjects.c:672 at __debug_object_init+0x2c4/0x3c0, CPU#1: syz.4.23/5888 [ 94.412575][ C1] Modules linked in: [ 94.416510][ C1] CPU: 1 UID: 0 PID: 5888 Comm: syz.4.23 Tainted: G W syzkaller #0 PREEMPT(full) [ 94.427214][ C1] Tainted: [W]=WARN [ 94.431042][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.441123][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 94.447084][ C1] Code: cc cc cc 41 ff c7 44 89 3d 59 8b e8 15 48 c7 c1 80 ae 6d 8c 48 c7 c7 e0 ae 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 dd 7c 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 d1 80 6d 0a 3b 05 cf [ 94.466708][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 94.472800][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: c4c1db05f8add700 [ 94.480809][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 94.488809][ C1] RBP: ffff888032669f60 R08: 0000000000000100 R09: 0000000000000001 [ 94.496801][ C1] R10: dffffc0000000000 R11: fffff520001430b9 R12: 1ffff9200014314c [ 94.504794][ C1] R13: ffff888057185968 R14: dffffc0000000000 R15: 0000000000000001 [ 94.512789][ C1] FS: 00007f0dd933d6c0(0000) GS:ffff888124dc0000(0000) knlGS:0000000000000000 [ 94.521773][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.528391][ C1] CR2: 0000200000000240 CR3: 000000007cb2a000 CR4: 00000000003526f0 [ 94.536382][ C1] Call Trace: [ 94.539686][ C1] [ 94.542564][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 94.548155][ C1] __synchronize_srcu+0x1d0/0x2e0 [ 94.553227][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 94.558810][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.563887][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 94.569729][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 94.575325][ C1] ? synchronize_srcu+0x20a/0x260 [ 94.580384][ C1] wakeup_source_unregister+0x129/0x3f0 [ 94.585973][ C1] mmc_host_classdev_release+0x47/0x100 [ 94.591567][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 94.597760][ C1] device_release+0xc4/0x1f0 [ 94.602396][ C1] kobject_put+0x222/0x550 [ 94.606860][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 94.611684][ C1] call_timer_fn+0x18d/0x5f0 [ 94.616302][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 94.623005][ C1] ? call_timer_fn+0xd5/0x5f0 [ 94.627729][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 94.632896][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 94.638138][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 94.644846][ C1] __run_timer_base+0x652/0x8b0 [ 94.649739][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 94.655140][ C1] ? ktime_get+0x1f5/0x220 [ 94.659589][ C1] ? lapic_next_event+0x11/0x20 [ 94.664469][ C1] run_timer_softirq+0xb7/0x170 [ 94.669347][ C1] handle_softirqs+0x226/0x860 [ 94.674143][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 94.678952][ C1] __irq_exit_rcu+0xcb/0x220 [ 94.683574][ C1] irq_exit_rcu+0x9/0x30 [ 94.687841][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 94.693524][ C1] [ 94.696471][ C1] [ 94.699421][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 94.705428][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 94.711531][ C1] Code: 8b 3d 74 0b ad 0c 48 89 de 5b e9 23 99 64 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 2b ce 11 65 48 8b 15 08 2b ce 11 f7 c2 00 01 00 ff [ 94.731153][ C1] RSP: 0018:ffffc90004d3f660 EFLAGS: 00000202 [ 94.737251][ C1] RAX: ffffffff821e575c RBX: 0000000000000001 RCX: 8000000000000001 [ 94.745239][ C1] RDX: 0000000000000002 RSI: ffffffff8c6da560 RDI: ffffffff8c6da520 [ 94.753234][ C1] RBP: ffffc90004d3fa20 R08: ffff88805b6f7d23 R09: 1ffff1100b6defa4 [ 94.761244][ C1] R10: dffffc0000000000 R11: ffffed100b6defa5 R12: 0000000000000001 [ 94.769246][ C1] R13: dffffc0000000000 R14: ffff88807f38d940 R15: 0000000000000000 [ 94.777261][ C1] ? finish_fault+0xf9c/0x1220 [ 94.782064][ C1] finish_fault+0xf9c/0x1220 [ 94.786704][ C1] ? shmem_fault+0x270/0x390 [ 94.791328][ C1] ? do_pte_missing+0x140c/0x34b0 [ 94.796368][ C1] do_pte_missing+0x223d/0x34b0 [ 94.801250][ C1] ? handle_mm_fault+0xf1/0x3750 [ 94.806226][ C1] handle_mm_fault+0x1a53/0x3750 [ 94.811220][ C1] ? handle_mm_fault+0xf1/0x3750 [ 94.816193][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 94.821512][ C1] ? follow_page_pte+0x748/0xf10 [ 94.826481][ C1] ? __pfx_follow_page_pte+0x10/0x10 [ 94.831791][ C1] __get_user_pages+0x1670/0x2750 [ 94.836861][ C1] populate_vma_page_range+0x2be/0x3c0 [ 94.842348][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 94.848370][ C1] ? down_read+0x2b9/0x320 [ 94.852838][ C1] __mm_populate+0x25f/0x390 [ 94.857465][ C1] ? __pfx___mm_populate+0x10/0x10 [ 94.862621][ C1] vm_mmap_pgoff+0x353/0x4e0 [ 94.867251][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 94.872388][ C1] ? rcu_is_watching+0x16/0xb0 [ 94.877200][ C1] ? ksys_mmap_pgoff+0xf3/0x760 [ 94.882079][ C1] ? __x64_sys_mmap+0x7f/0x140 [ 94.886880][ C1] do_syscall_64+0x166/0x520 [ 94.891491][ C1] ? trace_irq_disable+0x3b/0x140 [ 94.896536][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.902649][ C1] ? clear_bhb_loop+0x70/0xc0 [ 94.907380][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.913293][ C1] RIP: 0033:0x7f0dd839e159 [ 94.917741][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.937445][ C1] RSP: 002b:00007f0dd933d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 94.945907][ C1] RAX: ffffffffffffffda RBX: 00007f0dd8625fa0 RCX: 00007f0dd839e159 [ 94.953894][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 94.961891][ C1] RBP: 00007f0dd8435024 R08: ffffffffffffffff R09: 0000000000000000 [ 94.969884][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 94.977872][ C1] R13: 00007f0dd8626038 R14: 00007f0dd8625fa0 R15: 00007ffdb19fc758 [ 94.985924][ C1] [ 94.988966][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.996284][ C1] CPU: 1 UID: 0 PID: 5888 Comm: syz.4.23 Tainted: G W syzkaller #0 PREEMPT(full) [ 95.006981][ C1] Tainted: [W]=WARN [ 95.010798][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.020869][ C1] Call Trace: [ 95.024172][ C1] [ 95.027053][ C1] vpanic+0x56d/0xa70 [ 95.031057][ C1] ? __pfx__printk+0x10/0x10 [ 95.035660][ C1] ? __pfx_vpanic+0x10/0x10 [ 95.040190][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 95.045501][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 95.050720][ C1] panic+0xc5/0xd0 [ 95.054456][ C1] ? __pfx_panic+0x10/0x10 [ 95.058904][ C1] __warn+0x315/0x4c0 [ 95.062925][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 95.068251][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 95.073584][ C1] __report_bug+0x276/0x570 [ 95.078122][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 95.083454][ C1] ? __pfx___report_bug+0x10/0x10 [ 95.088508][ C1] ? __wake_up_klogd+0xf0/0x130 [ 95.093396][ C1] ? vprintk_emit+0x4ee/0x560 [ 95.098105][ C1] ? __pfx_vprintk_emit+0x10/0x10 [ 95.103170][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 95.108501][ C1] report_bug+0x16b/0x220 [ 95.112867][ C1] ? __debug_object_init+0x2c4/0x3c0 [ 95.118194][ C1] ? __debug_object_init+0x2c6/0x3c0 [ 95.123520][ C1] handle_bug+0x9c/0x200 [ 95.127809][ C1] exc_invalid_op+0x1a/0x50 [ 95.132409][ C1] asm_exc_invalid_op+0x1a/0x20 [ 95.137309][ C1] RIP: 0010:__debug_object_init+0x2c4/0x3c0 [ 95.143240][ C1] Code: cc cc cc 41 ff c7 44 89 3d 59 8b e8 15 48 c7 c1 80 ae 6d 8c 48 c7 c7 e0 ae 6d 8c 84 c0 48 0f 45 f9 48 89 de e8 dd 7c 3c fc 90 <0f> 0b 90 e9 c0 fe ff ff e8 4f 1c 00 00 8b 05 d1 80 6d 0a 3b 05 cf [ 95.162877][ C1] RSP: 0018:ffffc90000a189b8 EFLAGS: 00010046 [ 95.168988][ C1] RAX: 0000000000000050 RBX: ffffc90000a18a80 RCX: c4c1db05f8add700 [ 95.176978][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 95.184970][ C1] RBP: ffff888032669f60 R08: 0000000000000100 R09: 0000000000000001 [ 95.192983][ C1] R10: dffffc0000000000 R11: fffff520001430b9 R12: 1ffff9200014314c [ 95.200981][ C1] R13: ffff888057185968 R14: dffffc0000000000 R15: 0000000000000001 [ 95.209000][ C1] ? __debug_object_init+0x2c3/0x3c0 [ 95.214328][ C1] ? __init_swait_queue_head+0xa8/0x150 [ 95.219924][ C1] __synchronize_srcu+0x1d0/0x2e0 [ 95.224974][ C1] ? __pfx___synchronize_srcu+0x10/0x10 [ 95.230533][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 95.235583][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 95.241406][ C1] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 95.246986][ C1] ? synchronize_srcu+0x20a/0x260 [ 95.252033][ C1] wakeup_source_unregister+0x129/0x3f0 [ 95.257691][ C1] mmc_host_classdev_release+0x47/0x100 [ 95.263273][ C1] ? __pfx_mmc_host_classdev_release+0x10/0x10 [ 95.269466][ C1] device_release+0xc4/0x1f0 [ 95.274080][ C1] kobject_put+0x222/0x550 [ 95.278522][ C1] ? mmc_pwrseq_free+0x86/0xa0 [ 95.283307][ C1] call_timer_fn+0x18d/0x5f0 [ 95.287931][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 95.294619][ C1] ? call_timer_fn+0xd5/0x5f0 [ 95.299310][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 95.304440][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 95.309657][ C1] ? __pfx_vub300_inactivity_timer_expired+0x10/0x10 [ 95.316367][ C1] __run_timer_base+0x652/0x8b0 [ 95.321244][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 95.326632][ C1] ? ktime_get+0x1f5/0x220 [ 95.331060][ C1] ? lapic_next_event+0x11/0x20 [ 95.335929][ C1] run_timer_softirq+0xb7/0x170 [ 95.340801][ C1] handle_softirqs+0x226/0x860 [ 95.345588][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 95.350388][ C1] __irq_exit_rcu+0xcb/0x220 [ 95.354998][ C1] irq_exit_rcu+0x9/0x30 [ 95.359259][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 95.364909][ C1] [ 95.367853][ C1] [ 95.370802][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 95.376810][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x80 [ 95.382903][ C1] Code: 8b 3d 74 0b ad 0c 48 89 de 5b e9 23 99 64 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 08 2b ce 11 65 48 8b 15 08 2b ce 11 f7 c2 00 01 00 ff [ 95.402538][ C1] RSP: 0018:ffffc90004d3f660 EFLAGS: 00000202 [ 95.408642][ C1] RAX: ffffffff821e575c RBX: 0000000000000001 RCX: 8000000000000001 [ 95.416620][ C1] RDX: 0000000000000002 RSI: ffffffff8c6da560 RDI: ffffffff8c6da520 [ 95.424596][ C1] RBP: ffffc90004d3fa20 R08: ffff88805b6f7d23 R09: 1ffff1100b6defa4 [ 95.432587][ C1] R10: dffffc0000000000 R11: ffffed100b6defa5 R12: 0000000000000001 [ 95.440572][ C1] R13: dffffc0000000000 R14: ffff88807f38d940 R15: 0000000000000000 [ 95.448560][ C1] ? finish_fault+0xf9c/0x1220 [ 95.453353][ C1] finish_fault+0xf9c/0x1220 [ 95.457977][ C1] ? shmem_fault+0x270/0x390 [ 95.462600][ C1] ? do_pte_missing+0x140c/0x34b0 [ 95.467640][ C1] do_pte_missing+0x223d/0x34b0 [ 95.472513][ C1] ? handle_mm_fault+0xf1/0x3750 [ 95.477507][ C1] handle_mm_fault+0x1a53/0x3750 [ 95.482491][ C1] ? handle_mm_fault+0xf1/0x3750 [ 95.487457][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 95.492757][ C1] ? follow_page_pte+0x748/0xf10 [ 95.497721][ C1] ? __pfx_follow_page_pte+0x10/0x10 [ 95.503034][ C1] __get_user_pages+0x1670/0x2750 [ 95.508099][ C1] populate_vma_page_range+0x2be/0x3c0 [ 95.513580][ C1] ? __pfx_populate_vma_page_range+0x10/0x10 [ 95.519575][ C1] ? down_read+0x2b9/0x320 [ 95.524004][ C1] __mm_populate+0x25f/0x390 [ 95.528602][ C1] ? __pfx___mm_populate+0x10/0x10 [ 95.533728][ C1] vm_mmap_pgoff+0x353/0x4e0 [ 95.538329][ C1] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 95.543454][ C1] ? rcu_is_watching+0x16/0xb0 [ 95.548242][ C1] ? ksys_mmap_pgoff+0xf3/0x760 [ 95.553108][ C1] ? __x64_sys_mmap+0x7f/0x140 [ 95.557888][ C1] do_syscall_64+0x166/0x520 [ 95.562490][ C1] ? trace_irq_disable+0x3b/0x140 [ 95.567528][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.573605][ C1] ? clear_bhb_loop+0x70/0xc0 [ 95.578294][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.584207][ C1] RIP: 0033:0x7f0dd839e159 [ 95.588646][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.608289][ C1] RSP: 002b:00007f0dd933d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 95.616714][ C1] RAX: ffffffffffffffda RBX: 00007f0dd8625fa0 RCX: 00007f0dd839e159 [ 95.624687][ C1] RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000 [ 95.632671][ C1] RBP: 00007f0dd8435024 R08: ffffffffffffffff R09: 0000000000000000 [ 95.640655][ C1] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 95.648632][ C1] R13: 00007f0dd8626038 R14: 00007f0dd8625fa0 R15: 00007ffdb19fc758 [ 95.656621][ C1] [ 95.660235][ C1] Kernel Offset: disabled [ 95.664604][ C1] Rebooting in 86400 seconds..