last executing test programs: 18.80518203s ago: executing program 1 (id=2): r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) 18.363710053s ago: executing program 2 (id=3): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x60}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0x1, 0x1f4}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x40040001, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 17.4667832s ago: executing program 1 (id=6): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f00000002c0)='.\x00', 0x101000, 0x12d) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 14.307340043s ago: executing program 1 (id=7): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000680), 0x320, 0xa00) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000800)={0x21, &(0x7f00000006c0)=[{0x1c, '\x00', @buffer={"d98e74194335bb9f36a63ee17d5e997bbad854f6dc10b5eb24aaac90562de9fd", 0x20}, 0xfffffff9}]}) 13.951225926s ago: executing program 3 (id=8): bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) gettid() mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x20000023896) 13.950616026s ago: executing program 1 (id=9): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x101, 0x0) writev(r1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000180)=0x4000000000009) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) ioctl$TCSETS2(r6, 0x402c542b, &(0x7f0000000080)={0xfffffe01, 0x9, 0xbf3ffe01, 0x8004, 0x7, "202b9809007d0000cd681ec267a000", 0x6, 0xd}) ioctl$TIOCL_PASTESEL(r6, 0x541c, &(0x7f00000002c0)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000002c0)=0x31) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_newrule={0x4c, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x14, 0x0, 0x6, 0x0, 0x0, 0x0, 0x20016}, [@FRA_SRC={0x14, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00'}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e21, 0x4e22}}]}, 0x4c}}, 0x40000) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000010003904000000000002020000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000003c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc0200"/68], 0x5c}}, 0x0) r8 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x0, 0x3}, 0x18, 0x0) landlock_restrict_self(r8, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000080)={0x220, 0x1, 0x1}, 0x18, 0x0) 12.359925858s ago: executing program 1 (id=10): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getpid() r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4342, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x13, r1, 0x0) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd86) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) 12.307044038s ago: executing program 2 (id=11): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x4001, @random="040003e31e00", 'gre0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) 11.254579496s ago: executing program 3 (id=13): r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$VIDIOC_ENCODER_CMD(r0, 0xc028564d, &(0x7f0000000000)={0x1, 0x1, [0x9, 0x10, 0x80, 0x9, 0x8, 0x3, 0x1000, 0x9]}) 11.213591327s ago: executing program 2 (id=15): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x3, 0x2) recvmmsg(r0, 0x0, 0x0, 0x40000142, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001840)) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000740)=""/183, 0x0, 0x9000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_open_procfs(0x0, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, 0x0) 11.074199427s ago: executing program 3 (id=16): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioperm(0x6, 0x9, 0x824) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @dev, @void, {@arp={0x806, @ether_ipv4={0x6, 0x800, 0x6, 0x4, 0x0, @multicast, @rand_addr, @broadcast, @empty}}}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r1, 0x4004f50d, &(0x7f0000000000)) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r4 = socket$inet(0x2, 0xa, 0x4) setsockopt$sock_int(r4, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r4, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xc) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000700)='source', &(0x7f0000000780)='c:::/\x83\xc1\xcfD\xc4AO\x06)\xb03\xfcI\x95w\x96\x9b\xe9\xa6\x1a\x96\xael\x11\xa6\x06\xe3G\xb1\x1d$\xc2;\x8f\xf3\x13\xebB\x93\x94\x01\x8b\x88\xeb\xa3\x01\rx\x86bK&\x13a~\x04/\x18\x14ZM\xcb\xad\x92>\xe5\x01V\xdc\x05#\x13\xe9F\xa0\x1b\xf8\xe12\xe9\x80\x988\xd8?\x86\xe9i\x7f\xa8\xe0c\x94\xc1\xae\x9c\xba\x1c\xfa\xbc\xa8\xbf\xff\xfe\xfe!\x7f2\xf1\xc7P\x80A\x1c2k\xf6}P\x19\xee:i|0\x1c\x13u\xb0I\xaa\xe3\x14\x9a\x1f\x9f(\xd1$\x06\xa8&t&A0\xa7\xef\x9cL\x8e1K', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = timerfd_create(0x0, 0x80000) read(r6, &(0x7f0000000080)=""/149, 0x95) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x2c, r5, 0x1, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_CHANNEL={0x5}]}, 0x2c}}, 0x0) 10.039953835s ago: executing program 0 (id=17): timer_create(0x2, 0x0, &(0x7f0000bbdffc)) socket$rds(0x15, 0x5, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x34424752, 0x0, 0x0, 0x0, 0x0, 0x2, 0x779acd4f0ad4811f, 0x0, 0x2, 0x2}}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40010021, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x1, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000040)={0x2, 0x4, 0x5075, 0x6}, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000240)=0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000001c0)={0x2, 0x1, 0x100, "3a8e0300d614000001000100000040004000000000000016c713b41e2a3600", 0x4745504a}) 10.006284706s ago: executing program 2 (id=18): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x2, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r3, &(0x7f0000019500)=""/102400, 0x19000) openat(0xffffffffffffff9c, 0x0, 0x0, 0x18) r4 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r4, &(0x7f0000000240)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, r4) 7.644267933s ago: executing program 0 (id=19): syz_open_dev$dri(0x0, 0x1f, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYRES32, @ANYRES16, @ANYBLOB="010000000000000000000500000014000180060001000a0000000800050001000000"], 0x58}, 0x1, 0x0, 0x0, 0x40810}, 0x48001) openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) socket$netlink(0x10, 0x3, 0x10) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r1, 0x89e1, &(0x7f00000000c0)='lapb0') socket$inet_udp(0x2, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x1) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000900), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000940)={0x3, 0x0, 0xffffffff, 0x2, 0xb3}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'dummy0\x00', @random="8ed3e46724fa"}) sendmsg$NFT_BATCH(r3, 0x0, 0x800) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r5, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x3, 0x0, 0x4, "e88509de7f1939e8abff005597c8ef039a5be42200", 0x80000000010}, 0x60) listen(r5, 0x0) accept(r5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r6 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSWINSZ(r6, 0x5414, &(0x7f0000000000)={0x0, 0x0, 0x80, 0x7f}) 7.632143923s ago: executing program 2 (id=20): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120100004bec0220a20603008cb40102030109021200"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsopen(&(0x7f0000000040)='affs\x00', 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r3 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="0200000001"], 0x48) r6 = fsmount(r3, 0x1, 0x0) fchdir(r6) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000000)='./file0\x00', r5}, 0x18) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$packet(0x11, 0x3, 0x300) write$tun(r2, &(0x7f00000000c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x9, 0x4, 0x0, 0xca6}, @ipv6=@generic={0x8, 0x6, "061ee1", 0x6f, 0x49, 0x1, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {[], "196d473f8cb407995c5f23e98b23573f70b5e1d931ea3db14caa6bbcbb505b3610be6f5ba5014757ab52eef7bc579525d98a230535048603368c3e72540f4eb9f16c7dbc5f64c67ef4b6236682609b5e66e5f5d5a7b35bff282cc7d7700e7b1aa2fbd88cc794af9b88e8af974abaac"}}}, 0xa5) r8 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r8, &(0x7f00000001c0)='\x00\x00', 0x2) close_range(r1, 0xffffffffffffffff, 0x0) fchdir(0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x80, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='environ\x00') syz_usb_disconnect(0xffffffffffffffff) 6.365085303s ago: executing program 3 (id=21): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000001000)=ANY=[@ANYBLOB="1201000200000040501d4d610001000000010902200001010080320904000002ff00000007050102"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000100)=ANY=[@ANYBLOB="3cc81e0000004d61501d0100000000000000100000000000800700000000000038"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x80002, 0x0) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) accept4(r1, &(0x7f0000000140)=@nfc_llcp={0x27, 0x0}, &(0x7f00000001c0)=0x80, 0x80800) keyctl$chown(0x4, r3, 0xee01, 0xee00) keyctl$KEYCTL_MOVE(0x1e, r3, 0x0, 0x0, 0x1) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)=ANY=[@ANYRES16=r1, @ANYRES32=0x0, @ANYRESHEX=r3, @ANYRES64=r0, @ANYRES8=r2, @ANYRES32=r4], 0x1c}], 0x1, 0x0, 0x0, 0x810}, 0x84) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_ro(r6, &(0x7f0000000240)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r7, 0x0, 0x0) mkdir(0x0, 0x0) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/../file0\x00', 0x0, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r9, 0xc020660b, &(0x7f0000000000)={0x3fffffffc00, 0xffffffffffffffff, 0x4, 0x9}) r10 = openat$cgroup_ro(r8, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000100)=0x1, 0x12) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000080)={0x0, 0x8000}, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt(r11, 0x84, 0x7f, &(0x7f0000000080)="d3d0666d223e4686", 0x8) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000000)={0x84, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.351631842s ago: executing program 0 (id=22): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="0e0000000500"}) 4.557154026s ago: executing program 0 (id=23): syz_usb_connect(0x6, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) getpid() mkdirat(0xffffffffffffffff, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1f7) syz_open_dev$usbfs(0x0, 0x80, 0x113201) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0x10, 0x1, 'BATMAN_V'}]}}}]}, 0xfd12}}, 0x0) write(r1, &(0x7f00000000c0)='1\x00', 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b870113948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba190681103b5cb8dbd189543ac4d64867e39469625a900852b3220d4788d9f52245fb79fec8cffb", 0x8b) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x103000, 0x0) ioctl$KVM_GET_MSRS_sys(r4, 0xc008ae88, &(0x7f00000003c0)) 740.785195ms ago: executing program 3 (id=24): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1, 0x10000000000000}, {0x0, 0x200000, 0x3, 0xfffffffffffffffd}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0x2, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x0) 658.361765ms ago: executing program 3 (id=25): r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a00000007058102"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 636.239435ms ago: executing program 1 (id=26): r0 = syz_usb_connect(0x3, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b06100001810203010902450001010080fa0904000002ff00000007050302000200"], 0x0) syz_usb_ep_read(r0, 0x3, 0x0, 0x0) 193.614219ms ago: executing program 0 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x482, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x7, r1, 0x0}]) 0s ago: executing program 0 (id=28): openat$ptp0(0xffffffffffffff9c, 0x0, 0x60442, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000280), 0x20682) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000780)={0xfffffffe, 0x0, 0x0, 'queue0\x00', 0x48}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @rand_addr, 0x5}, 0x1c) listen(r4, 0x10040) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x40000080}, 0x40000) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[], 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f0000000100)={0x80, 0x1, 'client1\x00', 0xffffffff80000004, "00000000ffffffe3", "71a19060009f0000000000005c4100a0200010040400", 0x800000, 0x40}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="050000e3ffffffffffff0500000008000300", @ANYRES32=r8], 0x24}}, 0x0) socket$kcm(0x2, 0xa, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.173' (ED25519) to the list of known hosts. [ 70.710802][ T5759] cgroup: Unknown subsys name 'net' [ 70.849095][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.658625][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.665212][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.222794][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 73.776478][ T5775] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.784694][ T5776] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.787119][ T5775] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 73.792416][ T5776] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.802277][ T5775] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.812643][ T5776] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 73.821401][ T5776] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 73.829934][ T5775] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 73.830214][ T5776] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 73.844459][ T5783] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.854484][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 73.859606][ T5784] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.863122][ T5776] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.869890][ T5784] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.875994][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 73.883600][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 73.890690][ T5776] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 73.904250][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 73.905048][ T5776] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.912584][ T5783] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 73.935287][ T5776] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 73.970107][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 73.983017][ T5776] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 73.991270][ T5776] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.409265][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 74.455701][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 74.483622][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 74.505294][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 74.622006][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.629276][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.636915][ T5771] bridge_slave_0: entered allmulticast mode [ 74.643947][ T5771] bridge_slave_0: entered promiscuous mode [ 74.677507][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.684765][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.692005][ T5771] bridge_slave_1: entered allmulticast mode [ 74.698954][ T5771] bridge_slave_1: entered promiscuous mode [ 74.724263][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.731480][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.739109][ T5772] bridge_slave_0: entered allmulticast mode [ 74.745926][ T5772] bridge_slave_0: entered promiscuous mode [ 74.771421][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.778764][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.786728][ T5770] bridge_slave_0: entered allmulticast mode [ 74.794305][ T5770] bridge_slave_0: entered promiscuous mode [ 74.813581][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.820761][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.828090][ T5772] bridge_slave_1: entered allmulticast mode [ 74.834914][ T5772] bridge_slave_1: entered promiscuous mode [ 74.848074][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.855404][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.862694][ T5770] bridge_slave_1: entered allmulticast mode [ 74.869404][ T5770] bridge_slave_1: entered promiscuous mode [ 74.907522][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.926982][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.934494][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.942004][ T5773] bridge_slave_0: entered allmulticast mode [ 74.948697][ T5773] bridge_slave_0: entered promiscuous mode [ 74.966813][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.980292][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.989720][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.999764][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.007204][ T5773] bridge_slave_1: entered allmulticast mode [ 75.014677][ T5773] bridge_slave_1: entered promiscuous mode [ 75.023888][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.036371][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.064458][ T5771] team0: Port device team_slave_0 added [ 75.074890][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.106361][ T5771] team0: Port device team_slave_1 added [ 75.176081][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.188104][ T5772] team0: Port device team_slave_0 added [ 75.195854][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.203085][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.229068][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.242191][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.249160][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.275431][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.289214][ T5770] team0: Port device team_slave_0 added [ 75.297575][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.315677][ T5772] team0: Port device team_slave_1 added [ 75.339057][ T5770] team0: Port device team_slave_1 added [ 75.370216][ T5773] team0: Port device team_slave_0 added [ 75.408541][ T5773] team0: Port device team_slave_1 added [ 75.433522][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.440511][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.469346][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.481092][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.490483][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.517126][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.542184][ T5771] hsr_slave_0: entered promiscuous mode [ 75.548480][ T5771] hsr_slave_1: entered promiscuous mode [ 75.557922][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.565161][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.592131][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.603961][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.610910][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.637238][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.689341][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.696364][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.722455][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.762679][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.769656][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.795900][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.828255][ T5770] hsr_slave_0: entered promiscuous mode [ 75.835467][ T5770] hsr_slave_1: entered promiscuous mode [ 75.841666][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.850091][ T5770] Cannot create hsr debugfs directory [ 75.891448][ T5773] hsr_slave_0: entered promiscuous mode [ 75.898724][ T5773] hsr_slave_1: entered promiscuous mode [ 75.905123][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.913124][ T5773] Cannot create hsr debugfs directory [ 75.929293][ T5772] hsr_slave_0: entered promiscuous mode [ 75.935963][ T5772] hsr_slave_1: entered promiscuous mode [ 75.943333][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.950913][ T5772] Cannot create hsr debugfs directory [ 75.972671][ T5782] Bluetooth: hci2: command tx timeout [ 75.972751][ T5776] Bluetooth: hci0: command tx timeout [ 76.052271][ T5776] Bluetooth: hci3: command tx timeout [ 76.052287][ T5782] Bluetooth: hci1: command tx timeout [ 76.332093][ T5772] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.351514][ T5772] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.362799][ T5772] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.374069][ T5772] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.420541][ T5770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.443539][ T5770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.454977][ T5770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.465560][ T5770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.533127][ T5771] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 76.550190][ T5771] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 76.562510][ T5771] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 76.597069][ T5771] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 76.648360][ T5773] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.658215][ T5773] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.670974][ T5773] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.690567][ T5773] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.817206][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.850728][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.867661][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.909103][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.916449][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.931688][ T751] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.938953][ T751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.959001][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.976383][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.990870][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.010801][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.017980][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.050528][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.057836][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.080117][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.117533][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.124724][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.137595][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.177937][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.185071][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.199368][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.206517][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.242804][ T751] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.250059][ T751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.374670][ T5771] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.655862][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.719747][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.796271][ T5772] veth0_vlan: entered promiscuous mode [ 77.840170][ T5772] veth1_vlan: entered promiscuous mode [ 77.859772][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.897287][ T5770] veth0_vlan: entered promiscuous mode [ 77.925184][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.945304][ T5770] veth1_vlan: entered promiscuous mode [ 77.966053][ T5772] veth0_macvtap: entered promiscuous mode [ 77.998652][ T5772] veth1_macvtap: entered promiscuous mode [ 78.009829][ T5773] veth0_vlan: entered promiscuous mode [ 78.034565][ T5773] veth1_vlan: entered promiscuous mode [ 78.055482][ T5776] Bluetooth: hci2: command tx timeout [ 78.061012][ T5776] Bluetooth: hci0: command tx timeout [ 78.076850][ T5770] veth0_macvtap: entered promiscuous mode [ 78.087774][ T5770] veth1_macvtap: entered promiscuous mode [ 78.106979][ T5771] veth0_vlan: entered promiscuous mode [ 78.128424][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.135870][ T5776] Bluetooth: hci3: command tx timeout [ 78.145090][ T5776] Bluetooth: hci1: command tx timeout [ 78.161060][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.175468][ T5771] veth1_vlan: entered promiscuous mode [ 78.200339][ T5773] veth0_macvtap: entered promiscuous mode [ 78.209770][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.227954][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.239202][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.248359][ T5772] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.257733][ T5772] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.266921][ T5772] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.276059][ T5772] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.298765][ T5773] veth1_macvtap: entered promiscuous mode [ 78.329085][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.342696][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.354240][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.377497][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.389851][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.402042][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.412693][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.425256][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.439603][ T5770] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.448839][ T5770] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.459227][ T5770] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.469949][ T5770] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.490081][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.507665][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.517882][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.528358][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.539646][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.566918][ T5771] veth0_macvtap: entered promiscuous mode [ 78.579173][ T5773] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.588719][ T5773] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.597602][ T5773] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.606953][ T5773] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.635571][ T5771] veth1_macvtap: entered promiscuous mode [ 78.695235][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.714834][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.737949][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.749617][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.764217][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.775883][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.788630][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.799203][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.810098][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.830313][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.848184][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.859142][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.869972][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.880401][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.890879][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.904432][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.937917][ T5771] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.951342][ T5771] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.962213][ T5771] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.970934][ T5771] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.994111][ T1092] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.995760][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.002106][ T1092] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.019855][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.063227][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.102487][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.131736][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.157575][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.174068][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.200547][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.232265][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.240123][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.343313][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.351177][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.141928][ T5776] Bluetooth: hci0: command tx timeout [ 80.147608][ T5776] Bluetooth: hci2: command tx timeout [ 80.213024][ T5782] Bluetooth: hci1: command tx timeout [ 80.218653][ T5776] Bluetooth: hci3: command tx timeout [ 80.376035][ T5812] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 80.561921][ T5812] usb 4-1: Using ep0 maxpacket: 8 [ 80.618189][ T5812] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 80.649424][ T5812] usb 4-1: config 179 has no interface number 0 [ 80.667066][ T5812] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 80.701190][ T5812] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 80.721384][ T5812] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 80.849313][ T5812] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 81.027182][ T5812] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 81.275243][ T5812] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 81.480049][ T5812] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.039884][ T5838] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 82.211949][ T5776] Bluetooth: hci2: command tx timeout [ 82.217410][ T5776] Bluetooth: hci0: command tx timeout [ 82.292145][ T5782] Bluetooth: hci1: command tx timeout [ 82.297638][ T5776] Bluetooth: hci3: command tx timeout [ 84.054434][ C0] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 84.062866][ C0] xpad 4-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 84.093587][ T5761] usb 4-1: USB disconnect, device number 2 [ 85.168314][ T5861] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 85.811670][ T12] Bluetooth: hci4: Frame reassembly failed (-84) [ 87.032843][ T5879] binder: 5878:5879 ioctl c00c620f 200000000240 returned -22 [ 87.120492][ T5883] netlink: 36 bytes leftover after parsing attributes in process `syz.0.14'. [ 87.313532][ T5883] ceph: No mds server is up or the cluster is laggy [ 87.374668][ T5830] libceph: connect (1)[c::]:6789 error -101 [ 87.490289][ T5830] libceph: mon0 (1)[c::]:6789 connect error [ 87.731934][ T5782] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 88.131614][ T23] libceph: connect (1)[c::]:6789 error -101 [ 88.143567][ T23] libceph: mon0 (1)[c::]:6789 connect error [ 88.150410][ T5888] ceph: No mds server is up or the cluster is laggy [ 88.212985][ T5889] syz.3.16 uses obsolete (PF_INET,SOCK_PACKET) [ 88.515329][ T5813] libceph: connect (1)[c::]:6789 error -101 [ 88.522181][ T5813] libceph: mon0 (1)[c::]:6789 connect error [ 89.115978][ T5813] libceph: connect (1)[c::]:6789 error -101 [ 89.122843][ T5813] libceph: mon0 (1)[c::]:6789 connect error [ 89.521787][ C0] sched: RT throttling activated [ 90.469626][ T5813] libceph: connect (1)[c::]:6789 error -101 [ 90.511958][ T5813] libceph: mon0 (1)[c::]:6789 connect error [ 90.538552][ T5898] ceph: No mds server is up or the cluster is laggy [ 90.545775][ T5813] libceph: connect (1)[c::]:6789 error -101 [ 90.552030][ T5813] libceph: mon0 (1)[c::]:6789 connect error [ 90.847189][ T5906] dummy0: entered promiscuous mode [ 90.854730][ T5906] dummy0: entered allmulticast mode [ 92.537870][ T173] cfg80211: failed to load regulatory.db [ 92.618535][ T23] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 92.736283][ T5916] warning: `syz.0.22' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 92.889077][ T23] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.965083][ T23] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 93.051382][ T23] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 93.158426][ T23] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 93.298105][ T23] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 93.391574][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.811797][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 95.139332][ T5923] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 97.102475][ T5914] sctp: failed to load transform for md5: -2 [ 97.314818][ T23] gud: probe of 4-1:1.0 failed with error -71 [ 97.354769][ T23] usb 4-1: USB disconnect, device number 3 [ 97.801908][ T5811] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 97.851978][ T23] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 97.904584][ T8] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.924442][ T5940] gadgetfs: bound to dummy_udc driver [ 97.994959][ T5811] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.005859][ T5811] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 98.022328][ T5811] usb 2-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice= 1.00 [ 98.032091][ T5811] usb 2-1: New USB device strings: Mfr=129, Product=2, SerialNumber=3 [ 98.040278][ T5811] usb 2-1: Product: syz [ 98.052082][ T5811] usb 2-1: Manufacturer: syz [ 98.056815][ T5811] usb 2-1: SerialNumber: syz [ 98.064304][ T23] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.077013][ T23] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 98.097193][ T23] usb 4-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 98.107140][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 98.122858][ T8] usb 3-1: Using ep0 maxpacket: 32 [ 98.153921][ T23] idmouse 4-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 98.155295][ T8] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 98.191949][ T5941] gadgetfs: suspended from state 2 [ 98.202209][ T8] usb 3-1: config 0 has no interfaces? [ 98.208560][ T5773] ================================================================== [ 98.216655][ T5773] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 [ 98.224046][ T5773] Read of size 8 at addr ffff88801bfbec60 by task syz-executor/5773 [ 98.232066][ T5773] [ 98.234411][ T5773] CPU: 0 PID: 5773 Comm: syz-executor Not tainted syzkaller #0 [ 98.241966][ T5773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.252039][ T5773] Call Trace: [ 98.255313][ T5773] [ 98.258246][ T5773] dump_stack_lvl+0x18c/0x250 [ 98.262925][ T5773] ? __lock_acquire+0x7d80/0x7d80 [ 98.267957][ T5773] ? show_regs_print_info+0x20/0x20 [ 98.273151][ T5773] ? load_image+0x420/0x420 [ 98.277653][ T5773] ? __virt_addr_valid+0x10c/0x380 [ 98.282760][ T5773] ? __virt_addr_valid+0x10c/0x380 [ 98.287871][ T5773] ? __virt_addr_valid+0x10c/0x380 [ 98.292984][ T5773] print_report+0xa8/0x210 [ 98.297394][ T5773] ? __mutex_lock+0xfc/0xc80 [ 98.302006][ T5773] kasan_report+0x117/0x150 [ 98.306524][ T5773] ? tomoyo_check_open_permission+0x384/0x460 [ 98.312799][ T5773] ? __mutex_lock+0xfc/0xc80 [ 98.317393][ T5773] __mutex_lock+0xfc/0xc80 [ 98.321809][ T5773] ? end_current_label_crit_section+0x170/0x170 [ 98.328045][ T5773] ? ep_open+0x4e/0x270 [ 98.332194][ T5773] ? mutex_lock_nested+0x20/0x20 [ 98.337130][ T5773] ? apparmor_file_open+0x5ab/0x760 [ 98.342328][ T5773] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 98.347860][ T5773] ? __rwlock_init+0x150/0x150 [ 98.352620][ T5773] ep_open+0x4e/0x270 [ 98.356595][ T5773] ? do_dentry_open+0x86f/0x14b0 [ 98.361531][ T5773] do_dentry_open+0x880/0x14b0 [ 98.366294][ T5773] ? ep_ioctl+0x1c0/0x1c0 [ 98.370622][ T5773] path_openat+0x284f/0x3270 [ 98.375209][ T5773] ? do_sys_openat2+0xda/0x1d0 [ 98.379976][ T5773] ? __x64_sys_openat+0x139/0x160 [ 98.385011][ T5773] ? verify_lock_unused+0x140/0x140 [ 98.390243][ T5773] ? do_filp_open+0x430/0x430 [ 98.394918][ T5773] do_filp_open+0x1f2/0x430 [ 98.399429][ T5773] ? vfs_tmpfile+0x620/0x620 [ 98.404014][ T5773] ? _raw_spin_unlock+0x28/0x40 [ 98.408858][ T5773] ? alloc_fd+0x590/0x640 [ 98.413180][ T5773] do_sys_openat2+0x134/0x1d0 [ 98.417850][ T5773] ? do_sys_open+0xe0/0xe0 [ 98.422264][ T5773] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 98.428238][ T5773] ? fsnotify_link_count+0xf0/0xf0 [ 98.433343][ T5773] ? lock_chain_count+0x20/0x20 [ 98.438202][ T5773] __x64_sys_openat+0x139/0x160 [ 98.443053][ T5773] do_syscall_64+0x55/0xb0 [ 98.447467][ T5773] ? clear_bhb_loop+0x40/0x90 [ 98.452139][ T5773] ? clear_bhb_loop+0x40/0x90 [ 98.456817][ T5773] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.462706][ T5773] RIP: 0033:0x7f425355e98e [ 98.467127][ T5773] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 98.487073][ T5773] RSP: 002b:00007ffd9bf65d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 98.495484][ T5773] RAX: ffffffffffffffda RBX: 000055555d805500 RCX: 00007f425355e98e [ 98.503449][ T5773] RDX: 0000000000000000 RSI: 00007ffd9bf65ec0 RDI: ffffffffffffff9c [ 98.511421][ T5773] RBP: 00007ffd9bf65ec0 R08: 0000000000000000 R09: 0000000000000000 [ 98.519387][ T5773] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd9bf66fb0 [ 98.527353][ T5773] R13: 00007f4253634474 R14: 000055555d8054e8 R15: 0000000000000006 [ 98.535326][ T5773] [ 98.538337][ T5773] [ 98.540646][ T5773] Allocated by task 5940: [ 98.544962][ T5773] kasan_set_track+0x4e/0x70 [ 98.549551][ T5773] __kasan_kmalloc+0x8f/0xa0 [ 98.554135][ T5773] gadgetfs_bind+0x25f/0x830 [ 98.558713][ T5773] gadget_bind_driver+0x2b3/0x770 [ 98.563727][ T5773] really_probe+0x247/0xae0 [ 98.568228][ T5773] __driver_probe_device+0x1f5/0x390 [ 98.573507][ T5773] driver_probe_device+0x4f/0x420 [ 98.578525][ T5773] __driver_attach+0x444/0x6d0 [ 98.583284][ T5773] bus_for_each_dev+0x235/0x2b0 [ 98.588161][ T5773] bus_add_driver+0x340/0x630 [ 98.592832][ T5773] driver_register+0x23a/0x310 [ 98.597587][ T5773] usb_gadget_register_driver_owner+0xf9/0x270 [ 98.603735][ T5773] dev_config+0xe49/0x1260 [ 98.608147][ T5773] vfs_write+0x299/0x9a0 [ 98.612384][ T5773] ksys_write+0x151/0x260 [ 98.616798][ T5773] do_syscall_64+0x55/0xb0 [ 98.621205][ T5773] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.627114][ T5773] [ 98.629429][ T5773] Freed by task 5941: [ 98.633391][ T5773] kasan_set_track+0x4e/0x70 [ 98.637978][ T5773] kasan_save_free_info+0x28/0x40 [ 98.643032][ T5773] ____kasan_slab_free+0x126/0x1f0 [ 98.648143][ T5773] slab_free_freelist_hook+0x130/0x1a0 [ 98.653610][ T5773] __kmem_cache_free+0xba/0x1f0 [ 98.658476][ T5773] destroy_ep_files+0x280/0x340 [ 98.663317][ T5773] gadgetfs_unbind+0x109/0x2b0 [ 98.668070][ T5773] gadget_unbind_driver+0x1bf/0x3e0 [ 98.673266][ T5773] device_release_driver_internal+0x408/0x6f0 [ 98.679331][ T5773] driver_detach+0x1f3/0x2d0 [ 98.683918][ T5773] bus_remove_driver+0x221/0x2f0 [ 98.688851][ T5773] usb_gadget_unregister_driver+0x4e/0x70 [ 98.694568][ T5773] dev_release+0x86/0x200 [ 98.698886][ T5773] __fput+0x221/0x940 [ 98.702855][ T5773] task_work_run+0x1d4/0x260 [ 98.707446][ T5773] do_exit+0x986/0x2530 [ 98.711605][ T5773] __ia32_sys_exit+0x0/0x40 [ 98.716106][ T5773] do_syscall_64+0x55/0xb0 [ 98.720515][ T5773] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 98.726404][ T5773] [ 98.728724][ T5773] The buggy address belongs to the object at ffff88801bfbec00 [ 98.728724][ T5773] which belongs to the cache kmalloc-512 of size 512 [ 98.742764][ T5773] The buggy address is located 96 bytes inside of [ 98.742764][ T5773] freed 512-byte region [ffff88801bfbec00, ffff88801bfbee00) [ 98.756497][ T5773] [ 98.758814][ T5773] The buggy address belongs to the physical page: [ 98.765226][ T5773] page:ffffea00006fef00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bfbc [ 98.775369][ T5773] head:ffffea00006fef00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 98.784287][ T5773] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 98.792253][ T5773] page_type: 0xffffffff() [ 98.796576][ T5773] raw: 00fff00000000840 ffff888017c41c80 ffffea0000b44900 dead000000000002 [ 98.805152][ T5773] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 98.813742][ T5773] page dumped because: kasan: bad access detected [ 98.820150][ T5773] page_owner tracks the page as allocated [ 98.825858][ T5773] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6221745776, free_ts 0 [ 98.845484][ T5773] post_alloc_hook+0x1c1/0x200 [ 98.850257][ T5773] get_page_from_freelist+0x2181/0x22a0 [ 98.855804][ T5773] __alloc_pages+0x1f0/0x460 [ 98.860389][ T5773] alloc_page_interleave+0x24/0x1e0 [ 98.865583][ T5773] alloc_slab_page+0x5d/0x180 [ 98.870290][ T5773] new_slab+0x87/0x2d0 [ 98.874360][ T5773] ___slab_alloc+0xc5c/0x12f0 [ 98.879039][ T5773] __kmem_cache_alloc_node+0x11f/0x250 [ 98.884585][ T5773] kmalloc_trace+0x2a/0xe0 [ 98.888995][ T5773] device_add+0xb6/0xc40 [ 98.893233][ T5773] tty_register_device_attr+0x425/0x950 [ 98.898774][ T5773] tty_register_driver+0x598/0xb30 [ 98.903881][ T5773] legacy_pty_init+0x3a6/0x600 [ 98.908643][ T5773] pty_init+0xe/0x20 [ 98.912537][ T5773] do_one_initcall+0x242/0x790 [ 98.917297][ T5773] do_initcall_level+0x13d/0x1f0 [ 98.922231][ T5773] page_owner free stack trace missing [ 98.927582][ T5773] [ 98.929894][ T5773] Memory state around the buggy address: [ 98.935509][ T5773] ffff88801bfbeb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.943561][ T5773] ffff88801bfbeb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 98.951609][ T5773] >ffff88801bfbec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.959667][ T5773] ^ [ 98.966858][ T5773] ffff88801bfbec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.974924][ T5773] ffff88801bfbed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 98.982976][ T5773] ================================================================== [ 99.019618][ T5830] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 99.030579][ T5811] ttusb_dec_send_command: result bulk message failed: error -22 [ 99.031520][ T8] usb 3-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 99.041390][ T5773] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 99.041402][ T5773] CPU: 1 PID: 5773 Comm: syz-executor Not tainted syzkaller #0 [ 99.041420][ T5773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.041429][ T5773] Call Trace: [ 99.041435][ T5773] [ 99.041441][ T5773] dump_stack_lvl+0x18c/0x250 [ 99.041467][ T5773] ? show_regs_print_info+0x20/0x20 [ 99.041485][ T5773] ? load_image+0x420/0x420 [ 99.041505][ T5773] panic+0x2ca/0x720 [ 99.041528][ T5773] ? bpf_jit_dump+0xd0/0xd0 [ 99.041549][ T5773] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 99.041566][ T5773] ? _raw_spin_unlock+0x40/0x40 [ 99.041580][ T5773] ? print_memory_metadata+0x314/0x400 [ 99.041598][ T5773] ? __mutex_lock+0xfc/0xc80 [ 99.041617][ T5773] check_panic_on_warn+0x84/0xa0 [ 99.041636][ T5773] ? __mutex_lock+0xfc/0xc80 [ 99.041654][ T5773] end_report+0x6f/0x130 [ 99.041673][ T5773] kasan_report+0x128/0x150 [ 99.041690][ T5773] ? tomoyo_check_open_permission+0x384/0x460 [ 99.041713][ T5773] ? __mutex_lock+0xfc/0xc80 [ 99.041733][ T5773] __mutex_lock+0xfc/0xc80 [ 99.041753][ T5773] ? end_current_label_crit_section+0x170/0x170 [ 99.041777][ T5773] ? ep_open+0x4e/0x270 [ 99.041792][ T5773] ? mutex_lock_nested+0x20/0x20 [ 99.041810][ T5773] ? apparmor_file_open+0x5ab/0x760 [ 99.041827][ T5773] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 99.041844][ T5773] ? __rwlock_init+0x150/0x150 [ 99.041864][ T5773] ep_open+0x4e/0x270 [ 99.041878][ T5773] ? do_dentry_open+0x86f/0x14b0 [ 99.041897][ T5773] do_dentry_open+0x880/0x14b0 [ 99.041916][ T5773] ? ep_ioctl+0x1c0/0x1c0 [ 99.041932][ T5773] path_openat+0x284f/0x3270 [ 99.041956][ T5773] ? do_sys_openat2+0xda/0x1d0 [ 99.041974][ T5773] ? __x64_sys_openat+0x139/0x160 [ 99.041993][ T5773] ? verify_lock_unused+0x140/0x140 [ 99.042010][ T5773] ? do_filp_open+0x430/0x430 [ 99.042033][ T5773] do_filp_open+0x1f2/0x430 [ 99.042051][ T5773] ? vfs_tmpfile+0x620/0x620 [ 99.042075][ T5773] ? _raw_spin_unlock+0x28/0x40 [ 99.042089][ T5773] ? alloc_fd+0x590/0x640 [ 99.042111][ T5773] do_sys_openat2+0x134/0x1d0 [ 99.042131][ T5773] ? do_sys_open+0xe0/0xe0 [ 99.042149][ T5773] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 99.042167][ T5773] ? fsnotify_link_count+0xf0/0xf0 [ 99.042183][ T5773] ? lock_chain_count+0x20/0x20 [ 99.042202][ T5773] __x64_sys_openat+0x139/0x160 [ 99.042223][ T5773] do_syscall_64+0x55/0xb0 [ 99.042239][ T5773] ? clear_bhb_loop+0x40/0x90 [ 99.042257][ T5773] ? clear_bhb_loop+0x40/0x90 [ 99.042275][ T5773] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 99.042292][ T5773] RIP: 0033:0x7f425355e98e [ 99.042307][ T5773] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 99.042319][ T5773] RSP: 002b:00007ffd9bf65d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 99.042337][ T5773] RAX: ffffffffffffffda RBX: 000055555d805500 RCX: 00007f425355e98e [ 99.042349][ T5773] RDX: 0000000000000000 RSI: 00007ffd9bf65ec0 RDI: ffffffffffffff9c [ 99.042360][ T5773] RBP: 00007ffd9bf65ec0 R08: 0000000000000000 R09: 0000000000000000 [ 99.042371][ T5773] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd9bf66fb0 [ 99.042387][ T5773] R13: 00007f4253634474 R14: 000055555d8054e8 R15: 0000000000000006 [ 99.042404][ T5773] [ 99.048047][ T5773] Kernel Offset: disabled