last executing test programs: 5m7.183513828s ago: executing program 0 (id=435): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$comedi(0xffffff9c, 0x0, 0x101001, 0x0) r2 = syz_clone(0x200000, 0x0, 0x36, 0x0, 0x0, 0x0) r3 = syz_open_procfs(r2, &(0x7f0000000400)='stat\x00') pread64(r3, 0x0, 0x0, 0x4) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000240)={'ip6_vti0\x00', 0x0, 0x0, 0xd1, 0x5, 0x0, 0x1, @local, @dev={0xfe, 0x80, '\x00', 0x3d}, 0x7800, 0x8, 0x9, 0x1}}) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000180)='cgroup.max.depth\x00', 0x2, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xd) ioctl$TCFLSH(r4, 0x540b, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[], 0x50) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x8880, 0x85) 5m3.9676585s ago: executing program 2 (id=438): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) 5m2.111359836s ago: executing program 2 (id=442): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) write(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0) 5m0.576067279s ago: executing program 2 (id=444): r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000200)={0x2, 0x0, {&(0x7f0000000080)=""/23, 0x17, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f0000001b80)={0x2, 0x0, {&(0x7f0000000b00)=""/4096, 0x1000, 0x0, 0x1, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000006c0)={0x2, 0x0, {&(0x7f0000000580)=""/85, 0x52, 0x0, 0x2, 0x2}}, 0x4f) write$vhost_msg_v2(r0, &(0x7f0000000180)={0x2, 0x0, {&(0x7f0000000280)=""/184, 0x2562bac182d8b35a, 0x0, 0x2, 0x3}}, 0x48) 4m59.541498271s ago: executing program 2 (id=446): fsopen(&(0x7f0000000000)='ceph\x00', 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000940), &(0x7f00000009c0), 0x5b0}, 0x38) syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./lower1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./lower1/dir1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./lower1/file1\x00', 0x42, 0x1ff) close(r0) mount(0x0, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000340)='overlay\x00', 0x0, &(0x7f0000000380)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00') r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000480)='./mnt/dir1\x00', &(0x7f0000000100)=@raw={0x80, 0x0, {'\x00'}}, &(0x7f0000000200), 0x0) close(r1) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/dir1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./mnt/dir2\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000680)='overlay\x00', 0x0, &(0x7f00000006c0)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./mnt\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000100)=@raw={0x80, 0x0, {'\x00'}}, 0x0) 4m59.308409031s ago: executing program 0 (id=447): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(0xffffffffffffffff, 0x1, 0x3) fchdir(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r4, 0x402, 0x44) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) 4m58.835090629s ago: executing program 2 (id=449): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) socket(0x2, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r4, 0x8, &(0x7f0000000080)=0x7) syz_emit_ethernet(0x22, &(0x7f0000000380)={@link_local, @random="65c537c46509", @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x0, 0x14, 0x0, 0x0, 0x0, 0x29, 0x0, @empty, @broadcast}}}}}, 0x0) unshare(0x22020400) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) prctl$PR_SET_NAME(0xf, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x88602, 0x0) bind$tipc(r0, 0x0, 0x0) bind$tipc(r1, &(0x7f0000000200)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x3}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x0, 0xffffffff}}, 0x10) socket$tipc(0x1e, 0x5, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000280)={r0, &(0x7f0000000080)='}%{/\x00', 0x1c5a00, &(0x7f0000000180)={@align=0x4, {0xff, 0x6, 0xac5e, 0x1ffffffffffffffe}}, 0x1000, &(0x7f00000001c0)={@_ha_fsid}, 0x0}) 4m57.812793048s ago: executing program 0 (id=451): fsopen(&(0x7f0000000000)='ceph\x00', 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000940), &(0x7f00000009c0), 0x5b0}, 0x38) syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./lower1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./lower1/dir1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./lower1/file1\x00', 0x42, 0x1ff) close(r0) mount(0x0, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000340)='overlay\x00', 0x0, &(0x7f0000000380)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00') r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000480)='./mnt/dir1\x00', &(0x7f0000000100)=@raw={0x80, 0x0, {'\x00'}}, &(0x7f0000000200), 0x0) close(r1) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/dir1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./mnt/dir2\x00', 0x0) mount(0x0, &(0x7f0000000640)='./mnt\x00', 0x0, 0x0, &(0x7f00000006c0)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./mnt\x00', 0x0, 0x0) open_by_handle_at(r2, &(0x7f0000000100)=@raw={0x80, 0x0, {'\x00'}}, 0x0) 4m56.482099248s ago: executing program 2 (id=453): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)=@x86={0x37, 0xe, 0x81, 0x0, 0x6, 0x6, 0x6a, 0x0, 0x3, 0x6, 0x6, 0x9, 0x0, 0x5, 0x8, 0x3, 0xf4, 0x2, 0x3, '\x00', 0x5, 0xa4f}) 4m52.969624961s ago: executing program 0 (id=455): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000340)={0x5, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) r5 = socket$key(0xf, 0x3, 0x2) openat$hwrng(0xffffff9c, &(0x7f0000000480), 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x1, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe4) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmsg$key(r5, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0x0, 0x25dfdbff}, 0x10}}, 0x0) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x19) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000440)={0x3ff}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x28000001}, 0x20008800) 4m46.051697221s ago: executing program 0 (id=460): r0 = socket$pptp(0x18, 0x1, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0xcc) r2 = syz_io_uring_setup(0x657d, &(0x7f00000003c0)={0x0, 0x3b40, 0x1000, 0xffffffff, 0x2b8, 0x0, r1}, &(0x7f0000000080), &(0x7f0000000180), &(0x7f0000000000)) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) r4 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x0) ioctl$MON_IOCG_STATS(r4, 0x80089203, &(0x7f0000000ffc)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x5793, &(0x7f0000000340)={0x0, 0xca23, 0x8000, 0xfffffff7, 0x212}, &(0x7f0000000100), &(0x7f00000001c0), 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000280)={{&(0x7f0000ff0000/0xd000)=nil, 0xd000}}) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000480), 0x84, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f00000004c0)={{0x11101000, 0x100000, 0xb, 0x2, 0x1, 0x8, 0x9, 0xe, 0x8, 0x2, 0x6, 0x2}, {0x1, 0xffffffff, 0xe, 0xf, 0x9, 0x7, 0xff, 0x7, 0x2, 0x5, 0x5, 0xd}, {0x60000, 0x80a0000, 0xa, 0xff, 0x0, 0x10, 0x0, 0x2e, 0xa, 0xe, 0x8, 0x7}, {0x7000, 0xdddd1000, 0x9, 0x0, 0xc, 0xfe, 0xa, 0x2, 0x7, 0x3, 0x2, 0x5}, {0x2000, 0x1, 0xc, 0x4, 0x1, 0x9, 0x0, 0xf7, 0xff, 0x1, 0x4, 0x59}, {0x4, 0x9000, 0x4, 0x1, 0x8c, 0x6b, 0x33, 0x9, 0x80, 0x2, 0x0, 0x4}, {0x2, 0xd000, 0x4, 0x0, 0x6, 0x1, 0x1, 0x7c, 0x5, 0x5, 0x1, 0x1}, {0x30000, 0xeeee0000, 0xf, 0x7, 0x9, 0x3, 0x5, 0x10, 0x1, 0x9, 0x6, 0x3c}, {0x10000, 0x3}, {0x80a0000, 0x445}, 0x50010, 0x0, 0xc000, 0x202200, 0x10001, 0x4801, 0x9000, [0xea9f, 0x614, 0x79, 0x12000000000]}) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000100)={{0x100}, 'syz1\x00', 0x19}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000040)={0xb0000000}) ioctl$UI_DEV_CREATE(r5, 0x5501) connect$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) connect$pptp(r0, &(0x7f0000000040)={0x18, 0x2, {0x1, @broadcast}}, 0x1e) 4m40.314537218s ago: executing program 32 (id=453): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)=@x86={0x37, 0xe, 0x81, 0x0, 0x6, 0x6, 0x6a, 0x0, 0x3, 0x6, 0x6, 0x9, 0x0, 0x5, 0x8, 0x3, 0xf4, 0x2, 0x3, '\x00', 0x5, 0xa4f}) 4m40.04661933s ago: executing program 0 (id=471): setresgid(0xee00, 0x0, 0xffffffffffffffff) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x49940, 0x0) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f0000000540)=ANY=[@ANYRES32=r0, @ANYRESOCT, @ANYRESDEC, @ANYRES32, @ANYRES32=r1, @ANYRES8, @ANYRESHEX=r1], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_pscan_rep_mode={{0x20, 0x7}, {@any, 0x10}}}, 0xa) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r5 = syz_open_procfs(0x0, &(0x7f0000000500)='net/mcfilter\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xe, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5}, 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000300)={0x3, 0x3, &(0x7f0000000740)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) read$midi(r5, &(0x7f00000001c0)=""/70, 0xffffffd8) 4m24.791259523s ago: executing program 33 (id=471): setresgid(0xee00, 0x0, 0xffffffffffffffff) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x49940, 0x0) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x3, &(0x7f0000000540)=ANY=[@ANYRES32=r0, @ANYRESOCT, @ANYRESDEC, @ANYRES32, @ANYRES32=r1, @ANYRES8, @ANYRESHEX=r1], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_pscan_rep_mode={{0x20, 0x7}, {@any, 0x10}}}, 0xa) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r5 = syz_open_procfs(0x0, &(0x7f0000000500)='net/mcfilter\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xe, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r5}, 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000300)={0x3, 0x3, &(0x7f0000000740)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) read$midi(r5, &(0x7f00000001c0)=""/70, 0xffffffd8) 2m30.579234876s ago: executing program 1 (id=619): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES8=r0], 0x0, 0x9, 0xba, &(0x7f0000000480)=""/186, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') fstat(r2, 0x0) init_module(0x0, 0x2ef, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000002900)={0xfffffffffffffffa, r2, 0x0, {0x200, 0x81}, 0x4b}, 0x1) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000300)='ufs\x00', 0x2140e3, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/locks\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 2m25.323780028s ago: executing program 1 (id=624): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x6c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x38130d1, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sched_getaffinity(r0, 0x0, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000080)='btrfs\x00', 0xc000, 0x0) 2m23.329871481s ago: executing program 1 (id=625): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x800) futex(&(0x7f0000000000), 0x5, 0x2, 0x0, 0x0, 0xc6fffffd) io_submit(0x0, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000001c00), 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000003740)={0x2, 0x11, 0x5, 0x1, 0x0, 0x81, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x69, 0x10, 0xb0}, [@ldst={0x5, 0x3, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x48) r5 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@hci, &(0x7f0000000100)=0x80, 0x800) bind$vsock_stream(r5, &(0x7f0000000140)={0x28, 0x0, 0x2711, @host}, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000240)='0000:00:03.0', 0xc) 2m21.910160507s ago: executing program 1 (id=627): socket$inet6(0xa, 0x2, 0x0) fanotify_init(0x4, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r2, 0x4001af84, &(0x7f0000000000)) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) close(r0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4}, 0x0, &(0x7f0000000100)={0x3ff, 0x6, 0x8000, 0x100009, 0x75, 0xa, 0x9, 0x400}, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000500)=ANY=[@ANYBLOB="000000000000000003000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ac00000000000000000800000000000001040000000000000700000000000000000000000000000000000000000000000000000000000000f7ffffffff0f000009000000000000008a1312120000000008000000000000000100"/381]) close(0x3) socket$inet_tcp(0x2, 0x1, 0x6) fanotify_mark(0xffffffffffffffff, 0x441, 0x4800001a, 0xffffffffffffffff, 0x0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TCSETSF2(r3, 0x402c542d, &(0x7f0000000080)={0x1, 0x4, 0x4, 0x8007, 0x7, "ea710000000000f9000000024200000200", 0x4000000, 0x8000400}) 2m18.282690932s ago: executing program 1 (id=630): preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f00000015c0)=""/4095, 0xfff}], 0x1, 0x4f, 0x205) r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000340), 0x2) r1 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) ftruncate(r1, 0xffff) fcntl$addseals(r1, 0x409, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000040)={r1, 0x0, 0x1000, 0x8000}) 2m12.934280488s ago: executing program 1 (id=638): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4) mkdir(0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r3, 0x4b47, &(0x7f00000002c0)={0x4, 0x0, 0x27f}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, 0x0) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r6, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x20}, 0x94) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{}], 0x1}, 0x0) 1m57.301126462s ago: executing program 34 (id=638): sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4) mkdir(0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r3, 0x4b47, &(0x7f00000002c0)={0x4, 0x0, 0x27f}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, 0x0) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r6, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x20}, 0x94) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{}], 0x1}, 0x0) 59.158679487s ago: executing program 4 (id=709): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='smaps_rollup\x00') read$FUSE(r0, &(0x7f0000000580)={0x2020}, 0x2020) r1 = syz_io_uring_setup(0x440e, &(0x7f0000000300)={0x0, 0x0, 0x8000, 0xffffffff, 0x263, 0x0, r0}, &(0x7f0000000100), &(0x7f0000000080), 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={0x0}, 0x1) io_uring_register$IORING_REGISTER_PBUF_STATUS(r1, 0x1a, &(0x7f0000000140), 0x1) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0xd0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r2, 0x890b, &(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') connect$x25(r2, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) readv(0xffffffffffffffff, &(0x7f0000000980)=[{&(0x7f0000000480)=""/214, 0xd6}], 0x1) add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000080)}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) 58.827308971s ago: executing program 4 (id=710): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x800) futex(&(0x7f0000000000), 0x5, 0x2, 0x0, 0x0, 0xc6fffffd) io_submit(0x0, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000001c00), 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f0000002600)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f6"}) ioctl$USBDEVFS_CONTROL(r4, 0xc0185500, &(0x7f0000003740)={0x2, 0x11, 0x5, 0x1, 0x0, 0x81, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x69, 0x10, 0xb0}, [@ldst={0x5, 0x3, 0x3, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x3}, 0x48) r5 = accept4(0xffffffffffffffff, &(0x7f0000000080)=@hci, &(0x7f0000000100)=0x80, 0x800) bind$vsock_stream(r5, &(0x7f0000000140)={0x28, 0x0, 0x2711, @host}, 0x10) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1, 0x0) write(r6, &(0x7f0000000240)='0000:00:03.0', 0xc) 57.44258428s ago: executing program 4 (id=711): socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_LOOKUP_BATCH(0x1b, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$IP_SET_OP_GET_FNAME(0xffffffffffffffff, 0x1, 0x53, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10022, 0x0) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e22, @empty}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="ee", 0xfffffe5e}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8}, 0x588) 53.820137796s ago: executing program 4 (id=714): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES8=r0], 0x0, 0x9, 0xba, &(0x7f0000000480)=""/186, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) init_module(0x0, 0xa99, &(0x7f0000001800)='GPL\x00') init_module(0x0, 0x2ef, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000002900)={0xfffffffffffffffa, r2, 0x0, {0x200, 0x81}, 0x4b}, 0x1) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000300)='ufs\x00', 0x2140e3, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/locks\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 51.561405148s ago: executing program 4 (id=716): r0 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000340)=0x1) write$ppp(r1, 0x0, 0x0) 50.397425908s ago: executing program 4 (id=718): syz_open_procfs(0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) socket$inet_udp(0x2, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x4, "d30f388c52e47600000000000000000000000300", 0x0, 0x5, 0xfff, 0xffffffde}, 0x3c) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) 35.23528873s ago: executing program 35 (id=718): syz_open_procfs(0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) socket$inet_udp(0x2, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x4, "d30f388c52e47600000000000000000000000300", 0x0, 0x5, 0xfff, 0xffffffde}, 0x3c) setns(0xc9, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000080)='X\x00', 0xfdef}], 0x1) 8.564853344s ago: executing program 3 (id=753): openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0xad82, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x84c18000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = semget$private(0x0, 0x3, 0x0) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x181081) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x1, 0x3, 0x8, 0x4}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r5, 0x40026f34, &(0x7f0000000040)=0x1) ioctl$DVB_DEMUX_DMX_START(r5, 0x6f29) semctl$SETALL(r4, 0x0, 0x2, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'geneve1\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x4c840) r7 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1c0) mount(0x0, 0x0, &(0x7f0000000080)='tmpfs\x00', 0x20849b, 0x0) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000002340), 0x4808444, &(0x7f0000000240)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="3fd4d70ca529ff7fceab9e4e"]) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff3}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x0, 0xd}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 7.525792772s ago: executing program 3 (id=754): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r1 = socket(0x2b, 0x1, 0xa0c7) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, 0x0, 0x1) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000240)={'pcl812\x00', [0x100, 0x4, 0x13600, 0x6, 0x0, 0x10005, 0x79, 0x3, 0x80008, 0x5, 0x2, 0x64, 0x7, 0x1, 0x6, 0xfd, 0x6, 0x9, 0x3, 0x7fffffff, 0xb740, 0xca9f, 0x9, 0x20001e58, 0x8, 0xf39e, 0x3, 0x1539b804, 0x7, 0x1, 0x2]}) socket(0xa, 0x3, 0x3a) openat$fuse(0xffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x5, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x9) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)={0x8, 0x2, 0x0, 0x200, 0xa, "2b35740e4f4e6c04704020dd9636bce158a556"}) 4.366839953s ago: executing program 3 (id=755): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x202, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7, 0x10}, 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r4}, &(0x7f0000000240), &(0x7f00000003c0)=r3}, 0x20) 2.76825511s ago: executing program 3 (id=756): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r1 = socket(0x2b, 0x1, 0xa0c7) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, 0x0, 0x1) r2 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f0000000240)={'pcl812\x00', [0x100, 0x4, 0x13600, 0x6, 0x0, 0x10005, 0x79, 0x3, 0x80008, 0x5, 0x2, 0x64, 0x7, 0x1, 0x6, 0xfd, 0x6, 0x9, 0x3, 0x7fffffff, 0xb740, 0xca9f, 0x9, 0x20001e58, 0x8, 0xf39e, 0x3, 0x1539b804, 0x7, 0x1, 0x2]}) socket(0xa, 0x3, 0x3a) openat$fuse(0xffffff9c, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x5, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x9) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)={0x8, 0x2, 0x0, 0x200, 0xa, "2b35740e4f4e6c04704020dd9636bce158a556"}) 1.342017727s ago: executing program 3 (id=757): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYRES8=r0], 0x0, 0x9, 0xba, &(0x7f0000000480)=""/186, 0x41100, 0x76, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fstat(r2, 0x0) init_module(0x0, 0x2ef, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000002900)={0xfffffffffffffffa, r2, 0x0, {0x200, 0x81}, 0x4b}, 0x1) mount(0x0, &(0x7f0000000280)='./file1\x00', &(0x7f0000000300)='ufs\x00', 0x2140e3, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/locks\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) syz_clone3(&(0x7f0000000080)={0x2a694b000, &(0x7f0000000040), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 0s ago: executing program 3 (id=758): mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='smaps_rollup\x00') read$FUSE(r0, &(0x7f0000000580)={0x2020}, 0x2020) r1 = syz_io_uring_setup(0x440e, &(0x7f0000000300)={0x0, 0x0, 0x8000, 0xffffffff, 0x263, 0x0, r0}, &(0x7f0000000100), &(0x7f0000000080), 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x16, &(0x7f0000000380)={0x0}, 0x1) io_uring_register$IORING_REGISTER_PBUF_STATUS(r1, 0x1a, &(0x7f0000000140), 0x1) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, 0x0, 0xd0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000080), 0x12) connect$x25(r2, &(0x7f0000000100)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x0}}, 0x12) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) readv(0xffffffffffffffff, &(0x7f0000000980)=[{&(0x7f0000000480)=""/214, 0xd6}], 0x1) add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000080)}) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.20' (ED25519) to the list of known hosts. [ 73.248732][ T5573] cgroup: Unknown subsys name 'net' [ 73.491459][ T5573] cgroup: Unknown subsys name 'cpuset' [ 73.564828][ T5573] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.203833][ T5573] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.481880][ T5586] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.498142][ T5586] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.501994][ T5586] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.507096][ T5586] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.528865][ T5586] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.580109][ T59] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.594293][ T59] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.598751][ T59] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.601340][ T59] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.602735][ T59] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.777945][ T59] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.788587][ T59] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.799820][ T59] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.823130][ T59] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.833905][ T59] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.880323][ T4901] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.913592][ T5604] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.921186][ T5603] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.931181][ T5604] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.937923][ T5603] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.940034][ T5604] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.952851][ T5586] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.955794][ T5586] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.976106][ T5604] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.978795][ T5604] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 79.615926][ T4901] Bluetooth: hci0: command tx timeout [ 79.694275][ T4901] Bluetooth: hci1: command tx timeout [ 79.945541][ T4901] Bluetooth: hci2: command tx timeout [ 80.015442][ T4901] Bluetooth: hci3: command tx timeout [ 80.067869][ T5584] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.068655][ T5584] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.068839][ T5584] bridge_slave_0: entered allmulticast mode [ 80.071660][ T5584] bridge_slave_0: entered promiscuous mode [ 80.095256][ T4901] Bluetooth: hci4: command tx timeout [ 80.134806][ T5584] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.135016][ T5584] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.135197][ T5584] bridge_slave_1: entered allmulticast mode [ 80.144636][ T5584] bridge_slave_1: entered promiscuous mode [ 80.168741][ T5588] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.168973][ T5588] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.169153][ T5588] bridge_slave_0: entered allmulticast mode [ 80.171705][ T5588] bridge_slave_0: entered promiscuous mode [ 80.223125][ T5588] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.223421][ T5588] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.223629][ T5588] bridge_slave_1: entered allmulticast mode [ 80.227634][ T5588] bridge_slave_1: entered promiscuous mode [ 80.317984][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.318194][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.318390][ T5593] bridge_slave_0: entered allmulticast mode [ 80.320866][ T5593] bridge_slave_0: entered promiscuous mode [ 80.340945][ T5584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.389575][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.389732][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.389890][ T5593] bridge_slave_1: entered allmulticast mode [ 80.392526][ T5593] bridge_slave_1: entered promiscuous mode [ 80.400507][ T5584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.400962][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.401071][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.401249][ T5596] bridge_slave_0: entered allmulticast mode [ 80.403695][ T5596] bridge_slave_0: entered promiscuous mode [ 80.417793][ T5588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.478636][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.478862][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.479012][ T5596] bridge_slave_1: entered allmulticast mode [ 80.481484][ T5596] bridge_slave_1: entered promiscuous mode [ 80.489837][ T5588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.490251][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.490371][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.490512][ T5594] bridge_slave_0: entered allmulticast mode [ 80.492967][ T5594] bridge_slave_0: entered promiscuous mode [ 80.563441][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.563663][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.563831][ T5594] bridge_slave_1: entered allmulticast mode [ 80.568945][ T5594] bridge_slave_1: entered promiscuous mode [ 80.678450][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.687860][ T5584] team0: Port device team_slave_0 added [ 80.726394][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.728844][ T5584] team0: Port device team_slave_1 added [ 80.733590][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.740079][ T5588] team0: Port device team_slave_0 added [ 80.785052][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.788753][ T5588] team0: Port device team_slave_1 added [ 80.792504][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.848987][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.852741][ T5593] team0: Port device team_slave_0 added [ 80.858548][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.858572][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.858596][ T5584] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.931616][ T5593] team0: Port device team_slave_1 added [ 80.932741][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.932754][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.932778][ T5584] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.938347][ T5596] team0: Port device team_slave_0 added [ 80.939537][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.939550][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.939579][ T5588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.004462][ T5596] team0: Port device team_slave_1 added [ 81.005555][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.005568][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.005591][ T5588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.012350][ T5594] team0: Port device team_slave_0 added [ 81.071622][ T5594] team0: Port device team_slave_1 added [ 81.073564][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.073578][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.073602][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.142861][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.142923][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.142946][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.145055][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.145069][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.145092][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.224918][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.224935][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.224959][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.238015][ T5584] hsr_slave_0: entered promiscuous mode [ 81.239646][ T5584] hsr_slave_1: entered promiscuous mode [ 81.242779][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.242792][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.242815][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.286034][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.286051][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.286075][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.302986][ T5588] hsr_slave_0: entered promiscuous mode [ 81.304654][ T5588] hsr_slave_1: entered promiscuous mode [ 81.305622][ T5588] debugfs: 'hsr0' already exists in 'hsr' [ 81.305738][ T5588] Cannot create hsr debugfs directory [ 81.428894][ T5593] hsr_slave_0: entered promiscuous mode [ 81.431189][ T5593] hsr_slave_1: entered promiscuous mode [ 81.431977][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 81.431999][ T5593] Cannot create hsr debugfs directory [ 81.488463][ T5596] hsr_slave_0: entered promiscuous mode [ 81.489641][ T5596] hsr_slave_1: entered promiscuous mode [ 81.490457][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 81.490479][ T5596] Cannot create hsr debugfs directory [ 81.551884][ T5594] hsr_slave_0: entered promiscuous mode [ 81.553061][ T5594] hsr_slave_1: entered promiscuous mode [ 81.553848][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 81.553870][ T5594] Cannot create hsr debugfs directory [ 81.694343][ T4901] Bluetooth: hci0: command tx timeout [ 81.774276][ T4901] Bluetooth: hci1: command tx timeout [ 82.014726][ T4901] Bluetooth: hci2: command tx timeout [ 82.095484][ T4901] Bluetooth: hci3: command tx timeout [ 82.177012][ T4901] Bluetooth: hci4: command tx timeout [ 82.652260][ T5584] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.716762][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.727347][ T5584] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.766684][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.773054][ T5584] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.808603][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.827484][ T5584] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.869843][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 82.954589][ T5593] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.991999][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.011639][ T5593] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.048107][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.058456][ T5593] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.088818][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.111419][ T5593] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.129383][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.288130][ T5596] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.318668][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.332966][ T5596] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.367975][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.375892][ T5596] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.408803][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.441386][ T5596] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.468335][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.610187][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.637386][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.651014][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.698083][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.705882][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.728339][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.761437][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.775583][ T4901] Bluetooth: hci0: command tx timeout [ 83.788990][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.855034][ T4901] Bluetooth: hci1: command tx timeout [ 83.871952][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.923610][ T5588] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 83.949882][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.966629][ T5588] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 84.000922][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.016579][ T5588] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 84.043640][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.064578][ T5588] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 84.094764][ T4901] Bluetooth: hci2: command tx timeout [ 84.103986][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.151820][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.174613][ T4901] Bluetooth: hci3: command tx timeout [ 84.197854][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.221021][ T4668] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.228987][ T4668] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.256312][ T4901] Bluetooth: hci4: command tx timeout [ 84.291327][ T4668] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.291554][ T4668] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.369777][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.405510][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.406165][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.431055][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.459040][ T1049] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.459962][ T1049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.550930][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.572596][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.597712][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.598217][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.653398][ T1049] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.658636][ T1049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.729799][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.788974][ T3562] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.802216][ T3562] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.861621][ T5588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.903287][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.909901][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.036557][ T5588] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.123123][ T1420] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.132787][ T1420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.177145][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.177370][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.793436][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.854424][ T4901] Bluetooth: hci0: command tx timeout [ 85.935858][ T4901] Bluetooth: hci1: command tx timeout [ 86.166735][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.174339][ T4901] Bluetooth: hci2: command tx timeout [ 86.256323][ T4901] Bluetooth: hci3: command tx timeout [ 86.274460][ T5584] veth0_vlan: entered promiscuous mode [ 86.334604][ T4901] Bluetooth: hci4: command tx timeout [ 86.406940][ T5584] veth1_vlan: entered promiscuous mode [ 86.516355][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.591735][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.682959][ T5593] veth0_vlan: entered promiscuous mode [ 86.702138][ T5584] veth0_macvtap: entered promiscuous mode [ 86.730496][ T5584] veth1_macvtap: entered promiscuous mode [ 86.742824][ T5588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.752846][ T5593] veth1_vlan: entered promiscuous mode [ 86.865945][ T10] cfg80211: failed to load regulatory.db [ 86.941030][ T5596] veth0_vlan: entered promiscuous mode [ 86.962305][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.023103][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.031215][ T5594] veth0_vlan: entered promiscuous mode [ 87.043412][ T5596] veth1_vlan: entered promiscuous mode [ 87.123662][ T5593] veth0_macvtap: entered promiscuous mode [ 87.131547][ T5594] veth1_vlan: entered promiscuous mode [ 87.162160][ T5593] veth1_macvtap: entered promiscuous mode [ 87.501858][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.515990][ T5596] veth0_macvtap: entered promiscuous mode [ 87.542369][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.562035][ T5596] veth1_macvtap: entered promiscuous mode [ 87.590052][ T5594] veth0_macvtap: entered promiscuous mode [ 87.655036][ T5594] veth1_macvtap: entered promiscuous mode [ 87.679990][ T5588] veth0_vlan: entered promiscuous mode [ 87.773653][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.797350][ T4668] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.808725][ T4668] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.850422][ T5588] veth1_vlan: entered promiscuous mode [ 87.888407][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.911665][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.059070][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.110737][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.110802][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.288660][ T3562] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.288773][ T3562] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.870119][ T5588] veth0_macvtap: entered promiscuous mode [ 88.995388][ T4668] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.995456][ T4668] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.111952][ T5588] veth1_macvtap: entered promiscuous mode [ 89.149186][ T1049] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.162621][ T1049] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.268481][ T5778] CacheFiles: Failed to register: -95 [ 89.412346][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.482873][ T4668] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.482964][ T4668] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.607365][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.669812][ T1420] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.669883][ T1420] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.751402][ T5782] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 89.868429][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.868691][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.174728][ T5787] tipc: Started in network mode [ 90.174877][ T5787] tipc: Node identity 4, cluster identity 4711 [ 90.174912][ T5787] tipc: Node number set to 4 [ 91.539149][ T2187] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.290169][ T5798] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4'. [ 92.686952][ T5801] Zero length message leads to an empty skb [ 94.285410][ T5803] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'. [ 94.292079][ T2978] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.292100][ T2978] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.928163][ T2978] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.984028][ T3562] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.984097][ T3562] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.064501][ T2927] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.079205][ T1475] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.111068][ T5810] kAFS: unable to lookup cell '/,c¾ûL' [ 95.163257][ T5818] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 95.291638][ T5822] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 95.323120][ T5821] team0: Device xfrm0 is of different type [ 95.535849][ T2927] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.549627][ T2927] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.677916][ T2927] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.747372][ T92] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.804463][ T5828] genirq: Flags mismatch irq 4. 00202000 (pcl812) vs. 00202080 (ttyS0) [ 96.848400][ T2941] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.853896][ T1475] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.856060][ T1475] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.856800][ T1475] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.450907][ T2927] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.668696][ T2927] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.697338][ T2927] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.745846][ T2927] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.755032][ T2927] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.755280][ T2927] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.806056][ T37] audit: type=1800 audit(1787948729.093:2): pid=5845 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.18" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 97.917026][ T3562] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.648138][ T1475] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.793170][ T5863] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 99.719825][ T5872] process 'syz.3.23' launched './file2' with NULL argv: empty string added [ 102.104224][ T5892] netlink: 4 bytes leftover after parsing attributes in process `syz.4.25'. [ 103.759025][ T5903] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 103.759025][ T5903] program syz.2.31 not setting count and/or reply_len properly [ 104.112693][ T5891] Process accounting resumed [ 104.250744][ T5906] binder: 5905:5906 ioctl c0306201 0 returned -14 [ 104.536490][ T4901] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 104.539343][ T4901] CPU: 1 UID: 0 PID: 4901 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 104.539370][ T4901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.539383][ T4901] Workqueue: hci2 hci_rx_work [ 104.539434][ T4901] Call Trace: [ 104.539444][ T4901] [ 104.539454][ T4901] dump_stack_lvl+0xe8/0x150 [ 104.539486][ T4901] sysfs_create_dir_ns+0x271/0x2a0 [ 104.539510][ T4901] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 104.539545][ T4901] ? rt_spin_unlock+0x165/0x200 [ 104.539574][ T4901] kobject_add_internal+0x62c/0xce0 [ 104.539605][ T4901] kobject_add+0x163/0x240 [ 104.539625][ T4901] ? rt_spin_unlock+0x159/0x200 [ 104.539655][ T4901] ? __pfx_kobject_add+0x10/0x10 [ 104.539684][ T4901] ? get_device_parent+0x370/0x3a0 [ 104.539709][ T4901] device_add+0x3fa/0xb80 [ 104.539733][ T4901] hci_conn_add_sysfs+0xd5/0x210 [ 104.539762][ T4901] le_conn_complete_evt+0xfe3/0x16d0 [ 104.539790][ T4901] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 104.539811][ T4901] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 104.539840][ T4901] ? rt_mutex_slowunlock+0x219/0x460 [ 104.539865][ T4901] ? skb_pull_data+0xf0/0x200 [ 104.539896][ T4901] hci_le_conn_complete_evt+0x187/0x470 [ 104.539933][ T4901] hci_event_packet+0x67a/0xf10 [ 104.539959][ T4901] ? reacquire_held_locks+0x117/0x1a0 [ 104.539991][ T4901] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 104.540018][ T4901] ? __pfx_hci_event_packet+0x10/0x10 [ 104.540044][ T4901] ? rt_spin_unlock+0x159/0x200 [ 104.540078][ T4901] ? hci_send_to_monitor+0xe2/0x590 [ 104.540103][ T4901] hci_rx_work+0x3ee/0x1020 [ 104.540136][ T4901] ? process_scheduled_works+0x97a/0x1630 [ 104.540162][ T4901] process_scheduled_works+0xc3d/0x1630 [ 104.540217][ T4901] ? __pfx_process_scheduled_works+0x10/0x10 [ 104.540248][ T4901] ? assign_work+0x3cf/0x5d0 [ 104.540277][ T4901] worker_thread+0xa47/0xfb0 [ 104.540326][ T4901] kthread+0x38b/0x470 [ 104.540347][ T4901] ? __pfx_worker_thread+0x10/0x10 [ 104.540371][ T4901] ? __pfx_kthread+0x10/0x10 [ 104.540390][ T4901] ret_from_fork+0x514/0xb70 [ 104.540412][ T4901] ? __pfx_ret_from_fork+0x10/0x10 [ 104.540431][ T4901] ? __switch_to+0xc89/0x1420 [ 104.540461][ T4901] ? __pfx_kthread+0x10/0x10 [ 104.540481][ T4901] ret_from_fork_asm+0x1a/0x30 [ 104.540522][ T4901] [ 104.540557][ T4901] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 104.540595][ T4901] Bluetooth: hci2: failed to register connection device [ 107.205825][ T5918] kAFS: unable to lookup cell '/,c¾ûL' [ 107.452053][ T5931] jffs2: notice: (5931) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 110.705003][ T5942] binder: 5941:5942 ioctl c0306201 0 returned -14 [ 112.301267][ T5954] jffs2: notice: (5954) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 113.672032][ T5950] Process accounting resumed [ 114.410876][ T5981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.54'. [ 114.803242][ T5980] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 114.803285][ T5980] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 114.803305][ T5980] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 114.813259][ T5980] syz.2.54 (5980) used greatest stack depth: 17448 bytes left [ 114.854802][ T37] audit: type=1800 audit(1787948746.263:3): pid=5980 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.2.54" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 117.751271][ T6004] jffs2: notice: (6004) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 119.074179][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.416418][ T6031] jffs2: notice: (6031) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 119.862262][ T6020] Process accounting resumed [ 121.731543][ T6056] tipc: Started in network mode [ 121.731577][ T6056] tipc: Node identity 4, cluster identity 4711 [ 121.731590][ T6056] tipc: Node number set to 4 [ 122.054197][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 124.552424][ T4901] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 124.573079][ T4901] CPU: 1 UID: 0 PID: 4901 Comm: kworker/u9:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 124.573109][ T4901] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 124.573123][ T4901] Workqueue: hci4 hci_rx_work [ 124.573167][ T4901] Call Trace: [ 124.573176][ T4901] [ 124.573186][ T4901] dump_stack_lvl+0xe8/0x150 [ 124.573216][ T4901] sysfs_create_dir_ns+0x271/0x2a0 [ 124.573239][ T4901] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 124.573264][ T4901] ? rt_spin_unlock+0x165/0x200 [ 124.573294][ T4901] kobject_add_internal+0x62c/0xce0 [ 124.573327][ T4901] kobject_add+0x163/0x240 [ 124.573348][ T4901] ? rt_spin_unlock+0x159/0x200 [ 124.573378][ T4901] ? __pfx_kobject_add+0x10/0x10 [ 124.573405][ T4901] ? get_device_parent+0x370/0x3a0 [ 124.573429][ T4901] device_add+0x3fa/0xb80 [ 124.573453][ T4901] hci_conn_add_sysfs+0xd5/0x210 [ 124.573483][ T4901] le_conn_complete_evt+0xfe3/0x16d0 [ 124.573507][ T4901] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 124.573526][ T4901] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 124.573553][ T4901] ? rt_mutex_slowunlock+0x219/0x460 [ 124.573576][ T4901] ? skb_pull_data+0xf0/0x200 [ 124.573609][ T4901] hci_le_conn_complete_evt+0x187/0x470 [ 124.573646][ T4901] hci_event_packet+0x67a/0xf10 [ 124.573673][ T4901] ? reacquire_held_locks+0x117/0x1a0 [ 124.573705][ T4901] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 124.573757][ T4901] ? __pfx_hci_event_packet+0x10/0x10 [ 124.573784][ T4901] ? rt_spin_unlock+0x159/0x200 [ 124.573820][ T4901] ? hci_send_to_monitor+0xe2/0x590 [ 124.573846][ T4901] hci_rx_work+0x3ee/0x1020 [ 124.573883][ T4901] ? process_scheduled_works+0x97a/0x1630 [ 124.573911][ T4901] process_scheduled_works+0xc3d/0x1630 [ 124.573970][ T4901] ? __pfx_process_scheduled_works+0x10/0x10 [ 124.574004][ T4901] ? assign_work+0x3cf/0x5d0 [ 124.574035][ T4901] worker_thread+0xa47/0xfb0 [ 124.574091][ T4901] kthread+0x38b/0x470 [ 124.574112][ T4901] ? __pfx_worker_thread+0x10/0x10 [ 124.574137][ T4901] ? __pfx_kthread+0x10/0x10 [ 124.574154][ T4901] ret_from_fork+0x514/0xb70 [ 124.574177][ T4901] ? __pfx_ret_from_fork+0x10/0x10 [ 124.574197][ T4901] ? __switch_to+0xc89/0x1420 [ 124.574227][ T4901] ? __pfx_kthread+0x10/0x10 [ 124.574249][ T4901] ret_from_fork_asm+0x1a/0x30 [ 124.574285][ T4901] [ 124.585904][ T4901] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 124.585950][ T4901] Bluetooth: hci4: failed to register connection device [ 126.040419][ T6049] Process accounting resumed [ 133.065255][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.108578][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.488594][ T6145] kAFS: unable to lookup cell '/,c¾ûL' [ 140.607488][ T6154] team0: Device xfrm0 is of different type [ 140.691418][ T6157] tipc: Started in network mode [ 140.691453][ T6157] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 140.691866][ T6157] tipc: Enabled bearer , priority 0 [ 142.047066][ T5716] tipc: Node number set to 11578026 [ 142.615213][ T6177] jffs2: notice: (6177) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 142.998635][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 143.209840][ T10] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 143.256720][ T10] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 143.256837][ T10] usb 2-1: config 1 has no interface number 0 [ 143.278816][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.286918][ T10] usb 2-1: Product: syz [ 143.286938][ T10] usb 2-1: Manufacturer: syz [ 143.286953][ T10] usb 2-1: SerialNumber: syz [ 143.691581][ T10] usb 2-1: 3:1 : does not exist [ 143.701927][ T10] usb 2-1: 3:2 : does not exist [ 146.484196][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.494207][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.594211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.604225][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.614218][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.624223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.634215][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.644207][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 146.808182][ T10] usb 2-1: USB disconnect, device number 2 [ 149.179321][ T37] audit: type=1800 audit(1787948780.643:4): pid=6204 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.116" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 149.615986][ T10] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 150.522065][ T10] usb 2-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 150.539470][ T10] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 150.543355][ T10] usb 2-1: config 1 has no interface number 0 [ 150.556100][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 150.557143][ T10] usb 2-1: Product: syz [ 150.557160][ T10] usb 2-1: Manufacturer: syz [ 150.557175][ T10] usb 2-1: SerialNumber: syz [ 150.655649][ T10] usb 2-1: 3:1 : does not exist [ 150.660667][ T10] usb 2-1: 3:2 : does not exist [ 153.570794][ T10] usb 2-1: USB disconnect, device number 3 [ 153.617924][ T6224] Process accounting resumed [ 153.867779][ T6230] bridge0: port 3(syz_tun) entered blocking state [ 153.900436][ T6230] bridge0: port 3(syz_tun) entered disabled state [ 153.906481][ T6230] syz_tun: entered allmulticast mode [ 154.884034][ T6234] fuse: Bad value for 'fd' [ 155.753453][ T6230] syz_tun: entered promiscuous mode [ 155.779192][ T5791] udevd[5791]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 155.819499][ T6230] bridge0: port 3(syz_tun) entered blocking state [ 155.838735][ T6230] bridge0: port 3(syz_tun) entered forwarding state [ 156.091461][ T6250] team0: Device xfrm0 is of different type [ 156.211080][ T6251] tipc: Started in network mode [ 156.211180][ T6251] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 156.211924][ T6251] tipc: Enabled bearer , priority 0 [ 157.476833][ T31] tipc: Node number set to 11578026 [ 157.924821][ T6274] kAFS: unable to lookup cell '/,c¾ûL' [ 160.172807][ T6295] netlink: 4 bytes leftover after parsing attributes in process `syz.0.132'. [ 160.442924][ T6295] syz.0.132 (6295) used greatest stack depth: 17160 bytes left [ 164.238615][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.244389][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.252306][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.255505][ T6323] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 164.255540][ T6323] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 164.255578][ T6323] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 164.260793][ T6323] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 164.274057][ T6323] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 164.321092][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.326891][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.329489][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.331957][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 164.335884][ T6323] wlan0 speed is unknown, defaulting to 1000 [ 174.265267][ T6382] jffs2: notice: (6382) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 179.425695][ T6430] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 179.425695][ T6430] program syz.1.182 not setting count and/or reply_len properly [ 180.678880][ T6438] team0: Device xfrm0 is of different type [ 180.768474][ T6446] tipc: Enabled bearer , priority 0 [ 184.964426][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 185.134525][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 185.135624][ T10] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 185.142371][ T10] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 185.142395][ T10] usb 4-1: config 0 has no interfaces? [ 185.142424][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.195148][ T6491] netlink: 'syz.4.199': attribute type 1 has an invalid length. [ 185.202053][ T6491] netlink: 756 bytes leftover after parsing attributes in process `syz.4.199'. [ 185.254806][ T10] usb 4-1: config 0 descriptor?? [ 185.374317][ T5706] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 185.535281][ T5706] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 185.546172][ T5706] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 185.547481][ T5706] usb 2-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0x81, skipping [ 185.547506][ T5706] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 185.547546][ T5706] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 185.603301][ T6497] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 185.616270][ T6497] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 185.681969][ T6497] vhci_hcd vhci_hcd.0: Device attached [ 185.737457][ T5706] cxacru 2-1:1.0: usbatm_usb_probe: bind failed: -19! [ 185.840659][ T6497] input: syz1 as /devices/virtual/input/input5 [ 185.958733][ T6495] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 186.065536][ T10] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 186.960246][ T6498] vhci_hcd: connection reset by peer [ 187.072423][ T1049] vhci_hcd vhci_hcd.0: stop threads [ 187.122382][ T37] audit: type=1800 audit(1787948818.593:5): pid=6512 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.203" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 187.157328][ T1049] vhci_hcd vhci_hcd.0: release socket [ 187.183760][ T5599] usb 4-1: USB disconnect, device number 2 [ 187.262168][ T1049] vhci_hcd vhci_hcd.0: disconnect device [ 187.309846][ T6508] Process accounting resumed [ 188.446563][ T31] usb 2-1: USB disconnect, device number 4 [ 188.826190][ T6529] binder: 6526:6529 ioctl c0306201 0 returned -14 [ 188.844536][ T6528] jffs2: notice: (6528) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 189.062031][ T6537] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 189.096544][ T6537] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 190.529270][ T6545] Process accounting resumed [ 190.749296][ T6563] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 190.788786][ T6560] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 191.389944][ T10] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 194.336484][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.337717][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.884252][ T5318] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 194.941639][ T6584] jffs2: notice: (6584) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 196.476538][ T6591] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(8) [ 196.476567][ T6591] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 196.478169][ T6591] vhci_hcd vhci_hcd.0: Device attached [ 196.736226][ T6591] input: syz1 as /devices/virtual/input/input6 [ 196.932186][ T31] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 196.979694][ T10] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 197.096172][ T6598] vhci_hcd: connection reset by peer [ 197.102744][ T48] vhci_hcd vhci_hcd.2: stop threads [ 197.102950][ T48] vhci_hcd vhci_hcd.2: release socket [ 197.123924][ T48] vhci_hcd vhci_hcd.2: disconnect device [ 197.245048][ T31] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 197.256515][ T31] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.256689][ T31] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 197.256711][ T31] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 197.256751][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 198.698174][ T31] cxacru 1-1:1.0: cxacru_bind: interface has incorrect endpoints [ 198.722258][ T31] cxacru 1-1:1.0: usbatm_usb_probe: bind failed: -19! [ 199.423713][ T31] usb 1-1: USB disconnect, device number 2 [ 199.755636][ T59] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 201.489778][ T6635] jffs2: notice: (6635) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 201.498257][ T6621] Process accounting resumed [ 201.555841][ T59] Bluetooth: hci3: command 0x0406 tx timeout [ 201.557431][ T59] Bluetooth: hci2: command 0x0406 tx timeout [ 201.557460][ T59] Bluetooth: hci1: command 0x0406 tx timeout [ 201.557483][ T59] Bluetooth: hci4: command 0x0406 tx timeout [ 201.741538][ T6642] kAFS: unable to lookup cell '/,c¾ûL' [ 204.734910][ T10] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 204.855747][ T6647] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 204.855747][ T6647] program syz.4.244 not setting count and/or reply_len properly [ 212.033607][ T5318] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 212.815358][ T5318] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 212.829033][ T5318] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 212.829089][ T5318] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 212.829129][ T5318] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 212.923904][ T6696] jffs2: notice: (6696) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 216.391790][ T5318] cxacru 1-1:1.0: send of cm 0x90 failed (-104) [ 216.904516][ T5318] cxacru 1-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 217.107860][ T5318] cxacru 1-1:1.0: probe with driver cxacru failed with error -22 [ 217.321002][ T6713] Process accounting resumed [ 217.354466][ T5318] usb 1-1: USB disconnect, device number 3 [ 218.337236][ T6726] kAFS: unable to lookup cell '/,c¾ûL' [ 221.541336][ T37] audit: type=1800 audit(1787948853.003:6): pid=6732 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.267" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 222.672270][ T5318] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 223.447201][ T5318] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 223.452817][ T5318] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.452878][ T5318] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 223.452899][ T5318] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 223.452943][ T5318] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 225.820379][ T5318] usb 5-1: can't set config #1, error -71 [ 225.868795][ T5318] usb 5-1: USB disconnect, device number 2 [ 226.080071][ T6761] kAFS: unable to lookup cell '/,c¾ûL' [ 231.078298][ T6763] Process accounting resumed [ 232.230200][ T6788] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 233.114412][ T5601] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 233.275096][ T5601] usb 2-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 233.291398][ T5601] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 233.292455][ T5601] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 233.292480][ T5601] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 233.292522][ T5601] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.265234][ T5601] cxacru 2-1:1.0: cxacru_bind: interface has incorrect endpoints [ 235.274045][ T5601] cxacru 2-1:1.0: usbatm_usb_probe: bind failed: -19! [ 235.329040][ T5601] usb 2-1: USB disconnect, device number 6 [ 237.876733][ T6821] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(8) [ 237.961769][ T6821] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 238.125871][ T6821] vhci_hcd vhci_hcd.0: Device attached [ 238.558522][ T6820] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 239.584737][ T9] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 239.643123][ T6824] vhci_hcd: connection closed [ 239.648873][ T6825] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 239.660112][ T2978] vhci_hcd vhci_hcd.1: stop threads [ 239.660140][ T2978] vhci_hcd vhci_hcd.1: release socket [ 239.660205][ T2978] vhci_hcd vhci_hcd.1: disconnect device [ 239.730362][ T6821] input: syz1 as /devices/virtual/input/input7 [ 240.939081][ T5318] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 241.264112][ T6831] Process accounting resumed [ 241.369201][ T5318] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 241.524572][ T5318] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 241.533158][ T5318] usb 1-1: config 1 has no interface number 0 [ 241.572123][ T5318] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 241.572859][ T5318] usb 1-1: Product: syz [ 241.572919][ T5318] usb 1-1: Manufacturer: syz [ 241.572968][ T5318] usb 1-1: SerialNumber: syz [ 242.615678][ T5318] usb 1-1: can't set config #1, error -71 [ 242.774057][ T5318] usb 1-1: USB disconnect, device number 4 [ 245.428558][ T9] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 246.297147][ T6866] LUN: removable file: (no medium) [ 247.734275][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 248.440753][ T31] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 248.984245][ T9] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 249.004402][ T31] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 249.035988][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 249.037373][ T9] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 249.037438][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 249.037555][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.274978][ T9] usb 3-1: can't set config #1, error -71 [ 250.303635][ T9] usb 3-1: USB disconnect, device number 2 [ 250.484278][ T31] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 250.484371][ T31] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 250.484443][ T31] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.759645][ T31] usb 4-1: can't set config #1, error -71 [ 251.141856][ T31] usb 4-1: USB disconnect, device number 3 [ 252.270499][ T6896] netlink: 'syz.2.313': attribute type 1 has an invalid length. [ 252.270599][ T6896] netlink: 756 bytes leftover after parsing attributes in process `syz.2.313'. [ 252.508905][ T6897] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 255.921585][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.928678][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 260.343650][ T6946] LUN: removable file: (no medium) [ 262.573659][ T6954] team0: Device xfrm0 is of different type [ 262.681753][ T6956] tipc: Enabling of bearer rejected, already enabled [ 264.126346][ T36] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 264.285520][ T36] usb 2-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 264.296503][ T36] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 264.296532][ T36] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 264.296571][ T36] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 264.436087][ T36] usb 2-1: probing VID:PID(0424:012C) [ 264.519119][ T36] usb 2-1: vub300 testing BULK IN EndPoint(0) 81 [ 264.527166][ T36] usb 2-1: vub300 testing BULK OUT EndPoint(1) 02 [ 264.527192][ T36] usb 2-1: vub300 testing BULK IN EndPoint(2) 83 [ 264.527210][ T36] usb 2-1: vub300 testing BULK OUT EndPoint(3) 04 [ 264.527228][ T36] usb 2-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 265.033798][ T6988] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 265.033798][ T6988] program syz.3.338 not setting count and/or reply_len properly [ 265.597989][ T36] vub300 2-1:1.0: probe with driver vub300 failed with error -71 [ 265.858563][ T36] usb 2-1: USB disconnect, device number 7 [ 265.994098][ T5699] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 267.439190][ T7002] kAFS: unable to lookup cell '/,c¾ûL' [ 267.749534][ T5699] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 267.825225][ T5699] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 267.825324][ T5699] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 267.825366][ T5699] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 268.074489][ T5699] usb 5-1: can't set config #1, error -71 [ 269.148032][ T5699] usb 5-1: USB disconnect, device number 3 [ 271.535688][ T5699] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 272.862342][ T5699] usb 4-1: device descriptor read/all, error -71 [ 273.706379][ T7027] netlink: 4 bytes leftover after parsing attributes in process `syz.4.351'. [ 286.157412][ T5706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.220998][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 286.223237][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 287.568240][ T31] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 288.581630][ T5706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.214718][ T5699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 289.617006][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 290.445569][ T7107] wlan0 speed is unknown, defaulting to 1000 [ 290.849367][ T31] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 291.942866][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 292.363272][ T5699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 292.420112][ T9] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 292.583243][ T9] usb 4-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 292.587220][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 292.587252][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 292.587298][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 292.765689][ T9] usb 4-1: probing VID:PID(0424:012C) [ 292.793181][ T9] usb 4-1: vub300 testing BULK IN EndPoint(0) 81 [ 292.793748][ T9] usb 4-1: vub300 testing BULK OUT EndPoint(1) 02 [ 292.793769][ T9] usb 4-1: vub300 testing BULK IN EndPoint(2) 83 [ 292.793785][ T9] usb 4-1: vub300 testing BULK OUT EndPoint(3) 04 [ 292.793802][ T9] usb 4-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 293.019011][ T9] vub300 4-1:1.0: probe with driver vub300 failed with error -71 [ 294.070688][ T9] usb 4-1: USB disconnect, device number 6 [ 301.895843][ T7196] Config c/1 of g1 needs at least one function. [ 301.902497][ T7196] udc dummy_udc.0: failed to start g1: -22 [ 301.902618][ T7196] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 301.951497][ T7196] UDC core: g1: couldn't find an available UDC or it's busy [ 307.099880][ T5586] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 307.106152][ T5586] CPU: 1 UID: 0 PID: 5586 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 307.106182][ T5586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 307.106197][ T5586] Workqueue: hci3 hci_rx_work [ 307.106245][ T5586] Call Trace: [ 307.106255][ T5586] [ 307.106265][ T5586] dump_stack_lvl+0xe8/0x150 [ 307.106308][ T5586] sysfs_create_dir_ns+0x271/0x2a0 [ 307.106334][ T5586] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 307.106362][ T5586] ? rt_spin_unlock+0x165/0x200 [ 307.106393][ T5586] kobject_add_internal+0x62c/0xce0 [ 307.106426][ T5586] kobject_add+0x163/0x240 [ 307.106447][ T5586] ? rt_spin_unlock+0x159/0x200 [ 307.106478][ T5586] ? __pfx_kobject_add+0x10/0x10 [ 307.106508][ T5586] ? get_device_parent+0x370/0x3a0 [ 307.106535][ T5586] device_add+0x3fa/0xb80 [ 307.106560][ T5586] hci_conn_add_sysfs+0xd5/0x210 [ 307.106591][ T5586] le_conn_complete_evt+0xfe3/0x16d0 [ 307.106615][ T5586] ? le_conn_complete_evt+0x1b1/0x16d0 [ 307.106638][ T5586] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 307.106661][ T5586] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 307.106692][ T5586] ? rt_mutex_slowunlock+0x219/0x460 [ 307.106727][ T5586] ? skb_pull_data+0xf0/0x200 [ 307.106759][ T5586] hci_le_conn_complete_evt+0x187/0x470 [ 307.106798][ T5586] hci_event_packet+0x67a/0xf10 [ 307.106827][ T5586] ? reacquire_held_locks+0x117/0x1a0 [ 307.106860][ T5586] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 307.106889][ T5586] ? __pfx_hci_event_packet+0x10/0x10 [ 307.106916][ T5586] ? rt_spin_unlock+0x159/0x200 [ 307.106952][ T5586] ? hci_send_to_monitor+0xe2/0x590 [ 307.106978][ T5586] hci_rx_work+0x3ee/0x1020 [ 307.107014][ T5586] ? process_scheduled_works+0x97a/0x1630 [ 307.107042][ T5586] process_scheduled_works+0xc3d/0x1630 [ 307.107102][ T5586] ? __pfx_process_scheduled_works+0x10/0x10 [ 307.107136][ T5586] ? assign_work+0x3cf/0x5d0 [ 307.107167][ T5586] worker_thread+0xa47/0xfb0 [ 307.107209][ T5586] ? __kthread_parkme+0x71/0x1f0 [ 307.107249][ T5586] kthread+0x38b/0x470 [ 307.107269][ T5586] ? __pfx_worker_thread+0x10/0x10 [ 307.107300][ T5586] ? __pfx_kthread+0x10/0x10 [ 307.107322][ T5586] ret_from_fork+0x514/0xb70 [ 307.107346][ T5586] ? __pfx_ret_from_fork+0x10/0x10 [ 307.107366][ T5586] ? __switch_to+0xc89/0x1420 [ 307.107398][ T5586] ? __pfx_kthread+0x10/0x10 [ 307.107420][ T5586] ret_from_fork_asm+0x1a/0x30 [ 307.107457][ T5586] [ 307.107500][ T5586] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 307.107542][ T5586] Bluetooth: hci3: failed to register connection device [ 309.225649][ T5586] Bluetooth: hci3: command 0x0406 tx timeout [ 311.097829][ T5699] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 311.170505][ T7236] wlan0 speed is unknown, defaulting to 1000 [ 311.275388][ T5699] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice= 0.00 [ 311.277236][ T5699] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 311.277264][ T5699] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 311.277308][ T5699] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.296889][ T5586] Bluetooth: hci3: command 0x0406 tx timeout [ 311.386298][ T5699] usb 5-1: probing VID:PID(0424:012C) [ 311.405932][ T5699] usb 5-1: vub300 testing BULK IN EndPoint(0) 81 [ 311.579807][ T7256] Config c/1 of g1 needs at least one function. [ 311.579933][ T7256] udc dummy_udc.0: failed to start g1: -22 [ 311.579949][ T7256] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 311.585344][ T7256] UDC core: g1: couldn't find an available UDC or it's busy [ 312.354242][ T5699] usb 5-1: vub300 testing BULK OUT EndPoint(1) 02 [ 312.354269][ T5699] usb 5-1: vub300 testing BULK IN EndPoint(2) 83 [ 312.354286][ T5699] usb 5-1: vub300 testing BULK OUT EndPoint(3) 04 [ 312.354303][ T5699] usb 5-1: vub300 LARGE packets using EndPoints 02 81 04 83 [ 312.547119][ T5699] vub300 5-1:1.0: probe with driver vub300 failed with error -71 [ 314.711255][ T5699] usb 5-1: USB disconnect, device number 4 [ 317.244872][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.244999][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.553737][ T5599] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 317.688860][ T7286] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 317.765402][ T5599] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 317.767190][ T5599] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 317.767242][ T5599] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 317.767263][ T5599] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 317.767301][ T5599] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.135227][ T7301] Config c/1 of g1 needs at least one function. [ 318.136151][ T7301] udc dummy_udc.0: failed to start g1: -22 [ 318.136238][ T7301] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 318.146509][ T7301] UDC core: g1: couldn't find an available UDC or it's busy [ 319.946586][ T5599] cxacru 5-1:1.0: send of cm 0x90 failed (-104) [ 320.008405][ T5599] cxacru 5-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 320.695953][ T5599] cxacru 5-1:1.0: probe with driver cxacru failed with error -22 [ 320.824912][ T5697] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 321.002265][ T5697] usb 3-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 321.024292][ T5697] usb 3-1: config 1 has an invalid interface number: 3 but max is 0 [ 321.032420][ T5697] usb 3-1: config 1 has no interface number 0 [ 321.050228][ T5697] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 321.056585][ T5697] usb 3-1: Product: syz [ 321.056606][ T5697] usb 3-1: Manufacturer: syz [ 321.056621][ T5697] usb 3-1: SerialNumber: syz [ 322.747468][ T5599] usb 5-1: USB disconnect, device number 5 [ 323.095204][ T5697] usb 3-1: can't set config #1, error -71 [ 324.178055][ T5697] usb 3-1: USB disconnect, device number 3 [ 325.760602][ T7346] netlink: 'syz.3.434': attribute type 1 has an invalid length. [ 325.760671][ T7346] netlink: 756 bytes leftover after parsing attributes in process `syz.3.434'. [ 327.171652][ T7347] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 330.315922][ T7357] Process accounting resumed [ 333.141580][ T36] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 333.941040][ T36] usb 5-1: Using ep0 maxpacket: 32 [ 333.942331][ T36] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 334.036920][ T36] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 334.706128][ T36] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 335.095987][ T36] gspca_nw80x: reg_r err -32 [ 335.100856][ T36] nw80x 5-1:3.0: probe with driver nw80x failed with error -32 [ 335.163383][ T7392] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 336.516091][ T5716] usb 5-1: USB disconnect, device number 6 [ 339.274969][ T9] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 339.557711][ T9] usb 5-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 339.722079][ T9] usb 5-1: config 1 has an invalid interface number: 3 but max is 0 [ 339.730870][ T9] usb 5-1: config 1 has no interface number 0 [ 339.921352][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.924001][ T9] usb 5-1: Product: syz [ 339.924056][ T9] usb 5-1: Manufacturer: syz [ 339.924106][ T9] usb 5-1: SerialNumber: syz [ 341.153129][ T9] usb 5-1: can't set config #1, error -71 [ 341.178112][ T9] usb 5-1: USB disconnect, device number 7 [ 349.863184][ T7457] kAFS: unable to lookup cell '/,c¾ûL' [ 351.290082][ T7459] input: syz1 as /devices/virtual/input/input8 [ 357.470170][ T5604] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 357.502134][ T5604] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 357.504769][ T5604] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 357.506254][ T5604] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 357.506965][ T5604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 358.331703][ T7511] kAFS: unable to lookup cell '/,c¾ûL' [ 359.701742][ T5586] Bluetooth: hci5: command tx timeout [ 361.233504][ T7492] wlan0 speed is unknown, defaulting to 1000 [ 361.310496][ T7515] Process accounting resumed [ 361.781322][ T5586] Bluetooth: hci5: command tx timeout [ 365.238163][ T5586] Bluetooth: hci5: command tx timeout [ 367.295430][ T5586] Bluetooth: hci5: command tx timeout [ 371.809343][ T5604] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 371.889650][ T5604] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 371.897644][ T5604] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 371.907798][ T5604] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 371.921754][ T5604] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 372.629392][ T7574] kAFS: unable to lookup cell '/,c¾ûL' [ 374.014400][ T5586] Bluetooth: hci3: command tx timeout [ 376.097198][ T5586] Bluetooth: hci3: command tx timeout [ 377.982174][ T151] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 378.174280][ T5586] Bluetooth: hci3: command tx timeout [ 378.665340][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.665470][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 381.566089][ T5586] Bluetooth: hci3: command tx timeout [ 384.112042][ T7630] usb usb7: check_ctrlrecip: process 7630 (syz.3.496) requesting ep 01 but needs 81 [ 386.018283][ T151] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.664801][ T151] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 388.270532][ T7563] wlan0 speed is unknown, defaulting to 1000 [ 388.329801][ T37] audit: type=1800 audit(1787949019.793:7): pid=7656 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.504" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 389.807107][ T7669] usb usb7: check_ctrlrecip: process 7669 (syz.4.505) requesting ep 01 but needs 81 [ 392.474076][ T7679] usb usb7: check_ctrlrecip: process 7679 (syz.4.508) requesting ep 01 but needs 81 [ 394.083088][ T151] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.124135][ T7699] sg_write: data in/out 439260/178 bytes for SCSI command 0x0-- guessing data in; [ 398.124135][ T7699] program syz.4.513 not setting count and/or reply_len properly [ 398.176975][ T7492] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.184494][ T7492] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.218000][ T7492] bridge_slave_0: entered allmulticast mode [ 398.246523][ T7492] bridge_slave_0: entered promiscuous mode [ 398.489675][ T7492] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.489821][ T7492] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.490012][ T7492] bridge_slave_1: entered allmulticast mode [ 399.115513][ T7492] bridge_slave_1: entered promiscuous mode [ 399.398693][ T7706] 9pnet_virtio: no channels available for device syz [ 399.494093][ T7705] netlink: 'syz.4.515': attribute type 1 has an invalid length. [ 399.494296][ T7705] netlink: 'syz.4.515': attribute type 2 has an invalid length. [ 400.478303][ T7492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 400.671417][ T7492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 400.906771][ T7492] team0: Port device team_slave_0 added [ 400.920223][ T7492] team0: Port device team_slave_1 added [ 401.026102][ T7492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 401.026169][ T7492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.026194][ T7492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 401.082945][ T7492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 401.090454][ T7492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 401.090487][ T7492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 401.119788][ T7719] usb usb7: check_ctrlrecip: process 7719 (syz.4.518) requesting ep 01 but needs 81 [ 405.899429][ T7492] hsr_slave_0: entered promiscuous mode [ 405.939985][ T7492] hsr_slave_1: entered promiscuous mode [ 405.948884][ T7492] debugfs: 'hsr0' already exists in 'hsr' [ 405.949543][ T7492] Cannot create hsr debugfs directory [ 408.580765][ T7762] 9pnet_virtio: no channels available for device syz [ 408.898812][ T7755] netlink: 'syz.1.525': attribute type 1 has an invalid length. [ 408.898957][ T7755] netlink: 'syz.1.525': attribute type 2 has an invalid length. [ 410.406643][ T7768] jffs2: notice: (7768) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 411.195538][ T7772] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 411.202511][ T7772] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 411.202783][ T7772] vhci_hcd vhci_hcd.0: Device attached [ 411.233342][ T7776] input: syz1 as /devices/virtual/input/input9 [ 411.541095][ T31] usb 35-1: new low-speed USB device number 3 using vhci_hcd [ 411.647821][ T7778] vhci_hcd: connection reset by peer [ 411.655649][ T2941] vhci_hcd vhci_hcd.1: stop threads [ 411.655714][ T2941] vhci_hcd vhci_hcd.1: release socket [ 411.659943][ T2941] vhci_hcd vhci_hcd.1: disconnect device [ 411.763873][ T151] bridge_slave_1: left allmulticast mode [ 411.775927][ T151] bridge_slave_1: left promiscuous mode [ 411.784018][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 411.882297][ T7790] fuse: Bad value for 'fd' [ 415.573719][ T151] bridge_slave_0: left allmulticast mode [ 415.596082][ T151] bridge_slave_0: left promiscuous mode [ 415.596320][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.089581][ T5604] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 416.135096][ T5604] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 416.149937][ T5604] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 416.160349][ T5604] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 416.161069][ T5604] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 416.550622][ T7821] 9pnet_virtio: no channels available for device syz [ 416.656168][ T31] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 416.927020][ T7824] overlayfs: missing 'lowerdir' [ 416.983909][ T7826] overlayfs: failed to decode file handle (len=32, type=0, flags=0, err=-22) [ 418.430029][ T5586] Bluetooth: hci2: command tx timeout [ 420.616784][ T5586] Bluetooth: hci2: command tx timeout [ 422.618150][ T7847] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 422.633950][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 422.654390][ T5586] Bluetooth: hci2: command tx timeout [ 422.705131][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 422.752238][ T151] bond0 (unregistering): Released all slaves [ 422.842285][ T7819] netlink: 'syz.4.539': attribute type 1 has an invalid length. [ 422.842373][ T7819] netlink: 'syz.4.539': attribute type 2 has an invalid length. [ 424.694613][ T7563] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.746336][ T7563] bridge0: port 1(bridge_slave_0) entered disabled state [ 424.746577][ T7563] bridge_slave_0: entered allmulticast mode [ 424.749114][ T7563] bridge_slave_0: entered promiscuous mode [ 424.775097][ T5586] Bluetooth: hci2: command tx timeout [ 424.777593][ T7563] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.777718][ T7563] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.777943][ T7563] bridge_slave_1: entered allmulticast mode [ 424.813604][ T7563] bridge_slave_1: entered promiscuous mode [ 425.063449][ T151] tipc: Disabling bearer [ 425.194980][ T151] tipc: Left network mode [ 425.369538][ T7563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 425.436044][ T7563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 431.239093][ T5604] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 432.153842][ T5604] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 432.160046][ T5604] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 432.161344][ T5604] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 432.162145][ T5604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 433.824985][ T7920] usb usb7: check_ctrlrecip: process 7920 (syz.3.557) requesting ep 01 but needs 81 [ 433.866530][ T7922] fuse: Bad value for 'fd' [ 434.144979][ T5247] 8021q: adding VLAN 0 to HW filter on device eth1 [ 434.348020][ T7813] wlan0 speed is unknown, defaulting to 1000 [ 435.556197][ T5604] Bluetooth: hci5: command tx timeout [ 436.893429][ T7952] Process accounting resumed [ 437.614347][ T5604] Bluetooth: hci5: command tx timeout [ 439.698089][ T5604] Bluetooth: hci5: command tx timeout [ 439.933906][ T5247] 8021q: adding VLAN 0 to HW filter on device eth2 [ 440.101171][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.101302][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.097181][ T7905] wlan0 speed is unknown, defaulting to 1000 [ 441.684928][ T151] hsr_slave_0: left promiscuous mode [ 442.431569][ T5604] Bluetooth: hci5: command tx timeout [ 442.638854][ T151] hsr_slave_1: left promiscuous mode [ 442.663703][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 442.673019][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.958063][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.965765][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 444.237712][ T151] veth1_macvtap: left promiscuous mode [ 444.261920][ T151] veth0_macvtap: left promiscuous mode [ 444.262169][ T151] veth1_vlan: left promiscuous mode [ 444.262506][ T151] veth0_vlan: left promiscuous mode [ 444.901996][ T37] audit: type=1800 audit(1787949076.363:8): pid=8023 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.1.575" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 445.970520][ T8032] usb usb7: check_ctrlrecip: process 8032 (syz.1.576) requesting ep 01 but needs 81 [ 448.326909][ T8039] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 448.664326][ T37] audit: type=1800 audit(1787949080.123:9): pid=8042 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.579" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 448.958768][ T37] audit: type=1800 audit(1787949080.413:10): pid=8044 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.580" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 449.474378][ T5824] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 449.615505][ T151] team0 (unregistering): Port device team_slave_1 removed [ 449.635401][ T5824] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 449.645207][ T5824] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 449.645356][ T5824] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 449.645432][ T5824] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 449.645475][ T5824] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.762132][ T5824] cxacru 5-1:1.0: cxacru_bind: interface has incorrect endpoints [ 449.772875][ T5824] cxacru 5-1:1.0: usbatm_usb_probe: bind failed: -19! [ 449.865042][ T151] team0 (unregistering): Port device team_slave_0 removed [ 449.985812][ T5824] usb 5-1: USB disconnect, device number 8 [ 450.410363][ T5247] 8021q: adding VLAN 0 to HW filter on device eth3 [ 450.867044][ T8054] netlink: zone id is out of range [ 450.867152][ T8054] netlink: zone id is out of range [ 450.867161][ T8054] netlink: zone id is out of range [ 450.867169][ T8054] netlink: zone id is out of range [ 450.867176][ T8054] netlink: zone id is out of range [ 450.869724][ T8054] netlink: zone id is out of range [ 450.870335][ T8054] netlink: zone id is out of range [ 450.877235][ T8054] netlink: zone id is out of range [ 450.877319][ T8054] netlink: zone id is out of range [ 450.877327][ T8054] netlink: zone id is out of range [ 456.437119][ T7813] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.445870][ T7813] bridge0: port 1(bridge_slave_0) entered disabled state [ 456.446097][ T7813] bridge_slave_0: entered allmulticast mode [ 456.488539][ T7813] bridge_slave_0: entered promiscuous mode [ 456.606059][ T7813] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.613369][ T7813] bridge0: port 2(bridge_slave_1) entered disabled state [ 456.613585][ T7813] bridge_slave_1: entered allmulticast mode [ 456.638502][ T7813] bridge_slave_1: entered promiscuous mode [ 457.531910][ T5247] 8021q: adding VLAN 0 to HW filter on device eth4 [ 457.554311][ T7813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 458.800616][ T7813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 459.896225][ T8123] net_ratelimit: 385 callbacks suppressed [ 459.896466][ T8123] netlink: zone id is out of range [ 459.896526][ T8123] netlink: zone id is out of range [ 459.896683][ T8123] netlink: zone id is out of range [ 459.896816][ T8123] netlink: zone id is out of range [ 459.896907][ T8123] netlink: zone id is out of range [ 459.896989][ T8123] netlink: zone id is out of range [ 459.897059][ T8123] netlink: zone id is out of range [ 459.897137][ T8123] netlink: zone id is out of range [ 459.897210][ T8123] netlink: zone id is out of range [ 459.897284][ T8123] netlink: zone id is out of range [ 460.042407][ T7905] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.042726][ T7905] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.042948][ T7905] bridge_slave_0: entered allmulticast mode [ 460.063563][ T7905] bridge_slave_0: entered promiscuous mode [ 460.168034][ T7905] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.168190][ T7905] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.168499][ T7905] bridge_slave_1: entered allmulticast mode [ 460.180439][ T7905] bridge_slave_1: entered promiscuous mode [ 460.220179][ T7813] team0: Port device team_slave_0 added [ 461.098617][ T7813] team0: Port device team_slave_1 added [ 462.230877][ T7905] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 462.465445][ T7905] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 462.485812][ T7813] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 462.485884][ T7813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.485908][ T7813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 462.608219][ T7813] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 462.608298][ T7813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 462.608322][ T7813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 463.917235][ T7905] team0: Port device team_slave_0 added [ 464.039452][ T7905] team0: Port device team_slave_1 added [ 467.255343][ T8165] usb usb7: check_ctrlrecip: process 8165 (syz.1.601) requesting ep 01 but needs 81 [ 468.151817][ T151] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.811789][ T8173] usb usb7: check_ctrlrecip: process 8173 (syz.1.603) requesting ep 01 but needs 81 [ 470.062487][ T7813] hsr_slave_0: entered promiscuous mode [ 470.071136][ T7813] hsr_slave_1: entered promiscuous mode [ 470.081702][ T7813] debugfs: 'hsr0' already exists in 'hsr' [ 470.091251][ T7813] Cannot create hsr debugfs directory [ 470.223731][ T8180] usb usb7: check_ctrlrecip: process 8180 (syz.1.605) requesting ep 01 but needs 81 [ 471.151753][ T8181] net_ratelimit: 385 callbacks suppressed [ 471.157849][ T8181] netlink: zone id is out of range [ 471.157921][ T8181] netlink: zone id is out of range [ 471.158020][ T8181] netlink: zone id is out of range [ 471.158029][ T8181] netlink: zone id is out of range [ 471.158080][ T8181] netlink: zone id is out of range [ 471.158088][ T8181] netlink: zone id is out of range [ 471.158144][ T8181] netlink: zone id is out of range [ 471.158152][ T8181] netlink: zone id is out of range [ 471.158216][ T8181] netlink: zone id is out of range [ 471.158278][ T8181] netlink: zone id is out of range [ 472.895889][ T7905] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 472.905015][ T7905] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 472.905039][ T7905] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 473.046540][ T7905] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 473.053731][ T7905] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 473.053788][ T7905] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 478.815835][ T8220] usb usb7: check_ctrlrecip: process 8220 (syz.1.612) requesting ep 01 but needs 81 [ 480.515027][ T151] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.051750][ T5586] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 481.082152][ T5586] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 481.092134][ T5586] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 481.150929][ T5586] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 481.153986][ T5586] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 482.825911][ T8233] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 483.294347][ T5604] Bluetooth: hci3: command tx timeout [ 483.855673][ T7905] hsr_slave_0: entered promiscuous mode [ 483.860122][ T7905] hsr_slave_1: entered promiscuous mode [ 483.864140][ T7905] debugfs: 'hsr0' already exists in 'hsr' [ 483.883743][ T7905] Cannot create hsr debugfs directory [ 485.374823][ T5604] Bluetooth: hci3: command tx timeout [ 486.873145][ T8269] usb usb7: check_ctrlrecip: process 8269 (syz.4.622) requesting ep 01 but needs 81 [ 488.596465][ T5604] Bluetooth: hci3: command tx timeout [ 488.986259][ T151] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 490.755885][ T5604] Bluetooth: hci3: command tx timeout [ 491.474020][ T8295] usb usb7: check_ctrlrecip: process 8295 (syz.1.625) requesting ep 01 but needs 81 [ 495.601672][ T5586] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 495.639695][ T5586] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 495.650740][ T5586] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 495.671429][ T5586] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 495.733828][ T5586] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 495.980081][ T8317] fuse: Bad value for 'fd' [ 496.856913][ T151] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.024413][ T9] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 497.103609][ T8332] netlink: 4 bytes leftover after parsing attributes in process `syz.4.632'. [ 497.985120][ T9] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 497.986722][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 497.986776][ T9] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 497.986797][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 497.986839][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.024386][ T5586] Bluetooth: hci2: command tx timeout [ 498.740855][ T9] cxacru 4-1:1.0: send of cm 0x90 failed (-71) [ 498.740945][ T9] cxacru 4-1:1.0: usbatm_usb_probe: invalid endpoint 02! [ 498.741200][ T9] cxacru 4-1:1.0: probe with driver cxacru failed with error -22 [ 498.851894][ T8341] ======================================================= [ 498.851894][ T8341] WARNING: The mand mount option has been deprecated and [ 498.851894][ T8341] and is ignored by this kernel. Remove the mand [ 498.851894][ T8341] option from the mount to silence this warning. [ 498.851894][ T8341] ======================================================= [ 498.852586][ T8341] 9p: Bad value for 'wfdno' [ 499.782773][ T9] usb 4-1: USB disconnect, device number 7 [ 500.094345][ T5586] Bluetooth: hci2: command tx timeout [ 501.392670][ T8226] wlan0 speed is unknown, defaulting to 1000 [ 501.536312][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.536421][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.794370][ T5586] Bluetooth: hci2: command tx timeout [ 503.095181][ T8361] fuse: Bad value for 'fd' [ 504.814338][ T5586] Bluetooth: hci2: command tx timeout [ 508.074709][ T151] bridge_slave_1: left allmulticast mode [ 508.074788][ T151] bridge_slave_1: left promiscuous mode [ 508.075064][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.236395][ T151] bridge_slave_0: left allmulticast mode [ 508.236716][ T151] bridge_slave_0: left promiscuous mode [ 508.237000][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.262259][ T151] bridge_slave_1: left allmulticast mode [ 509.272611][ T151] bridge_slave_1: left promiscuous mode [ 509.417012][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.825851][ T151] bridge_slave_0: left allmulticast mode [ 509.965260][ T151] bridge_slave_0: left promiscuous mode [ 509.965517][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.018634][ T8407] Process accounting resumed [ 511.168914][ T151] bridge_slave_1: left allmulticast mode [ 511.168946][ T151] bridge_slave_1: left promiscuous mode [ 511.169117][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.277860][ T8417] usb usb7: check_ctrlrecip: process 8417 (syz.4.649) requesting ep 01 but needs 81 [ 512.196280][ T151] bridge_slave_0: left allmulticast mode [ 512.196327][ T151] bridge_slave_0: left promiscuous mode [ 512.196577][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.339937][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 515.491077][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 515.577482][ T151] bond0 (unregistering): Released all slaves [ 515.845023][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 516.055197][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 517.079423][ T151] bond0 (unregistering): Released all slaves [ 517.258676][ T8434] usb usb7: check_ctrlrecip: process 8434 (syz.4.654) requesting ep 01 but needs 81 [ 517.483529][ T5604] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 517.554092][ T5604] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 517.563265][ T5604] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 517.575111][ T5604] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 517.577634][ T5604] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 517.775408][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 517.886075][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 517.955635][ T151] bond0 (unregistering): Released all slaves [ 518.064437][ T8301] wlan0 speed is unknown, defaulting to 1000 [ 519.721623][ T5604] Bluetooth: hci5: command tx timeout [ 521.854494][ T5604] Bluetooth: hci5: command tx timeout [ 523.938453][ T5604] Bluetooth: hci5: command tx timeout [ 524.095043][ T151] tipc: Left network mode [ 524.211113][ T8470] 9pnet_virtio: no channels available for device syz [ 524.277730][ T8468] netlink: 'syz.3.659': attribute type 1 has an invalid length. [ 524.278300][ T8468] netlink: 'syz.3.659': attribute type 2 has an invalid length. [ 524.591339][ T8474] CacheFiles: No cache directory specified [ 526.022529][ T5604] Bluetooth: hci5: command tx timeout [ 526.701081][ T8489] usb usb7: check_ctrlrecip: process 8489 (syz.4.662) requesting ep 01 but needs 81 [ 527.737838][ T8495] CacheFiles: Empty directory specified [ 527.740740][ T8495] CacheFiles: No cache directory specified [ 528.029381][ T8435] wlan0 speed is unknown, defaulting to 1000 [ 528.255228][ T8226] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.255677][ T8226] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.255873][ T8226] bridge_slave_0: entered allmulticast mode [ 528.268028][ T8226] bridge_slave_0: entered promiscuous mode [ 529.709383][ T8226] bridge0: port 2(bridge_slave_1) entered blocking state [ 529.725454][ T8226] bridge0: port 2(bridge_slave_1) entered disabled state [ 529.725735][ T8226] bridge_slave_1: entered allmulticast mode [ 529.727638][ T8226] bridge_slave_1: entered promiscuous mode [ 533.041980][ T8226] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.422658][ T8226] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 533.947740][ T8226] team0: Port device team_slave_0 added [ 537.574639][ T151] hsr_slave_0: left promiscuous mode [ 537.626320][ T151] hsr_slave_1: left promiscuous mode [ 537.639081][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 537.679187][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 537.887601][ T151] hsr_slave_0: left promiscuous mode [ 537.952254][ T151] hsr_slave_1: left promiscuous mode [ 538.042818][ T5586] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 538.077903][ T5586] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 538.102165][ T5586] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 538.107885][ T5586] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 538.110485][ T5586] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 538.119091][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 538.119122][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 538.249171][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 538.250277][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 538.622884][ T151] veth1_macvtap: left promiscuous mode [ 538.623178][ T151] veth0_macvtap: left promiscuous mode [ 538.623377][ T151] veth1_vlan: left promiscuous mode [ 538.623490][ T151] veth0_vlan: left promiscuous mode [ 540.387380][ T5586] Bluetooth: hci0: command tx timeout [ 540.848468][ T37] audit: type=1800 audit(1787949172.313:11): pid=8557 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.3.674" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 542.894887][ T5586] Bluetooth: hci0: command tx timeout [ 543.970416][ T5824] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 544.555860][ T5824] usb 5-1: device descriptor read/64, error -71 [ 544.975109][ T5586] Bluetooth: hci0: command tx timeout [ 545.276708][ T5824] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 546.034565][ T5824] usb 5-1: device descriptor read/64, error -71 [ 546.296244][ T5824] usb usb5-port1: attempt power cycle [ 546.311913][ T151] team0 (unregistering): Port device team_slave_1 removed [ 546.645244][ T151] team0 (unregistering): Port device team_slave_0 removed [ 547.055043][ T5586] Bluetooth: hci0: command tx timeout [ 553.090728][ T151] team0 (unregistering): Port device team_slave_1 removed [ 553.226353][ T151] team0 (unregistering): Port device team_slave_0 removed [ 553.417904][ T8577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.679'. [ 553.419162][ T8576] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 553.419205][ T8576] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 553.419264][ T8576] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 553.519145][ T5604] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 553.578760][ T5604] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 553.591891][ T5604] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 553.629448][ T5604] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 553.633325][ T8226] team0: Port device team_slave_1 added [ 553.646253][ T5604] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 555.168340][ T5247] 8021q: adding VLAN 0 to HW filter on device eth5 [ 555.711206][ T5586] Bluetooth: hci6: command tx timeout [ 557.671407][ T8592] wlan0 speed is unknown, defaulting to 1000 [ 558.101619][ T5586] Bluetooth: hci6: command tx timeout [ 559.793538][ T5247] 8021q: adding VLAN 0 to HW filter on device eth6 [ 559.813583][ T8669] team0: Device xfrm0 is of different type [ 559.937879][ T8540] wlan0 speed is unknown, defaulting to 1000 [ 559.937954][ T8666] tipc: Started in network mode [ 559.937982][ T8666] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 559.950541][ T8666] tipc: Enabled bearer , priority 0 [ 560.145052][ T37] audit: type=1800 audit(1787949191.603:12): pid=8674 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.693" name="syztnl1" dev="sda1" ino=2047 res=0 errno=0 [ 560.213760][ T5586] Bluetooth: hci6: command tx timeout [ 560.268503][ T8435] bridge0: port 1(bridge_slave_0) entered blocking state [ 560.268916][ T8435] bridge0: port 1(bridge_slave_0) entered disabled state [ 560.269122][ T8435] bridge_slave_0: entered allmulticast mode [ 560.272711][ T8435] bridge_slave_0: entered promiscuous mode [ 560.343053][ T8435] bridge0: port 2(bridge_slave_1) entered blocking state [ 560.343270][ T8435] bridge0: port 2(bridge_slave_1) entered disabled state [ 560.343503][ T8435] bridge_slave_1: entered allmulticast mode [ 560.346037][ T8435] bridge_slave_1: entered promiscuous mode [ 560.518260][ T8678] fuse: Bad value for 'fd' [ 560.716726][ T8435] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 560.751423][ T8435] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 561.049559][ T8435] team0: Port device team_slave_0 added [ 561.070324][ T8684] netlink: 'syz.4.695': attribute type 1 has an invalid length. [ 561.078222][ T8684] netlink: 'syz.4.695': attribute type 2 has an invalid length. [ 561.112345][ T9] tipc: Node number set to 11578026 [ 561.142153][ T8435] team0: Port device team_slave_1 added [ 561.994496][ T8690] usb usb7: check_ctrlrecip: process 8690 (syz.3.696) requesting ep 01 but needs 81 [ 562.143030][ T8684] 9pnet_virtio: no channels available for device syz [ 562.254600][ T5586] Bluetooth: hci6: command tx timeout [ 562.704144][ T8435] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 562.711968][ T8435] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 562.712003][ T8435] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 562.821400][ T8435] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 562.828573][ T8435] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 562.828604][ T8435] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 562.977193][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.977507][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.146592][ T8592] bridge0: port 1(bridge_slave_0) entered blocking state [ 563.157142][ T8592] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.157731][ T8592] bridge_slave_0: entered allmulticast mode [ 563.160290][ T8592] bridge_slave_0: entered promiscuous mode [ 563.911582][ T5247] 8021q: adding VLAN 0 to HW filter on device eth7 [ 564.081851][ T8592] bridge0: port 2(bridge_slave_1) entered blocking state [ 564.082309][ T8592] bridge0: port 2(bridge_slave_1) entered disabled state [ 564.082521][ T8592] bridge_slave_1: entered allmulticast mode [ 564.087748][ T8592] bridge_slave_1: entered promiscuous mode [ 564.120369][ T8435] hsr_slave_0: entered promiscuous mode [ 564.122729][ T8435] hsr_slave_1: entered promiscuous mode [ 564.149670][ T8727] netlink: 'syz.4.702': attribute type 1 has an invalid length. [ 564.157938][ T8727] netlink: 756 bytes leftover after parsing attributes in process `syz.4.702'. [ 564.184753][ T8435] debugfs: 'hsr0' already exists in 'hsr' [ 564.191288][ T8435] Cannot create hsr debugfs directory [ 564.354418][ T8592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 567.996288][ T8592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 568.041242][ T8728] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 573.865757][ T8592] team0: Port device team_slave_0 added [ 573.986111][ T8592] team0: Port device team_slave_1 added [ 574.625883][ T8540] bridge0: port 1(bridge_slave_0) entered blocking state [ 574.633669][ T8540] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.633893][ T8540] bridge_slave_0: entered allmulticast mode [ 574.720766][ T8540] bridge_slave_0: entered promiscuous mode [ 574.748286][ T8592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 574.755689][ T8592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 574.755708][ T8592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 574.922544][ T8540] bridge0: port 2(bridge_slave_1) entered blocking state [ 574.933726][ T8540] bridge0: port 2(bridge_slave_1) entered disabled state [ 574.933948][ T8540] bridge_slave_1: entered allmulticast mode [ 574.980451][ T8540] bridge_slave_1: entered promiscuous mode [ 574.999400][ T8592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.007967][ T8592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.007999][ T8592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 576.518083][ T8794] usb usb7: check_ctrlrecip: process 8794 (syz.4.710) requesting ep 01 but needs 81 [ 576.621144][ T8540] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 577.120940][ T151] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.238823][ T8540] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 577.514118][ T8592] hsr_slave_0: entered promiscuous mode [ 577.543407][ T8592] hsr_slave_1: entered promiscuous mode [ 577.556919][ T8592] debugfs: 'hsr0' already exists in 'hsr' [ 577.560361][ T8592] Cannot create hsr debugfs directory [ 577.847206][ T8540] team0: Port device team_slave_0 added [ 578.349542][ T5604] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 578.373119][ T151] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.061718][ T5604] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 579.091891][ T5604] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 579.100844][ T5604] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 579.102368][ T5604] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 579.326685][ T8540] team0: Port device team_slave_1 added [ 580.084282][ T8817] usb usb7: check_ctrlrecip: process 8817 (syz.3.713) requesting ep 01 but needs 81 [ 580.614771][ T8540] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 580.614856][ T8540] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.614880][ T8540] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 580.697479][ T8540] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 580.697593][ T8540] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 580.697619][ T8540] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 581.833083][ T5586] Bluetooth: hci2: command tx timeout [ 583.856434][ T5604] Bluetooth: hci2: command tx timeout [ 585.117248][ T151] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 585.490258][ T8841] 9p: Bad value for 'wfdno' [ 586.009635][ T5604] Bluetooth: hci2: command tx timeout [ 588.067634][ T5604] Bluetooth: hci2: command tx timeout [ 588.760687][ T151] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.021387][ T8540] hsr_slave_0: entered promiscuous mode [ 589.035510][ T8540] hsr_slave_1: entered promiscuous mode [ 589.045569][ T8540] debugfs: 'hsr0' already exists in 'hsr' [ 589.051789][ T8540] Cannot create hsr debugfs directory [ 590.362626][ T5247] 8021q: adding VLAN 0 to HW filter on device eth8 [ 592.685915][ T8805] wlan0 speed is unknown, defaulting to 1000 [ 593.950626][ T8892] usb usb7: check_ctrlrecip: process 8892 (syz.3.726) requesting ep 01 but needs 81 [ 595.624558][ T8897] usb usb7: check_ctrlrecip: process 8897 (syz.3.727) requesting ep 01 but needs 81 [ 599.318982][ T5586] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 599.368106][ T5586] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 599.381886][ T5586] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 599.407148][ T5586] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 599.410554][ T5586] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 600.035005][ T151] bridge_slave_1: left allmulticast mode [ 600.035127][ T151] bridge_slave_1: left promiscuous mode [ 600.035378][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.203312][ T151] bridge_slave_0: left allmulticast mode [ 600.378117][ T151] bridge_slave_0: left promiscuous mode [ 600.443929][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 601.310249][ T5586] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 601.382826][ T5586] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 601.424052][ T5586] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 601.504617][ T5586] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 601.567782][ T4901] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 601.702611][ T5604] Bluetooth: hci3: command tx timeout [ 602.846534][ T151] bridge_slave_1: left allmulticast mode [ 602.852975][ T151] bridge_slave_1: left promiscuous mode [ 602.853247][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.259150][ T151] bridge_slave_0: left allmulticast mode [ 603.270045][ T151] bridge_slave_0: left promiscuous mode [ 603.270233][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.580791][ T151] bridge_slave_1: left allmulticast mode [ 603.583843][ T151] bridge_slave_1: left promiscuous mode [ 603.584013][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.774556][ T4901] Bluetooth: hci3: command tx timeout [ 604.294441][ T151] bridge_slave_0: left allmulticast mode [ 604.295472][ T151] bridge_slave_0: left promiscuous mode [ 604.296677][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 604.335431][ T4901] Bluetooth: hci0: command tx timeout [ 605.518127][ T151] bridge_slave_1: left allmulticast mode [ 605.518520][ T151] bridge_slave_1: left promiscuous mode [ 605.522800][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.855823][ T4901] Bluetooth: hci3: command tx timeout [ 605.875591][ T151] bridge_slave_0: left allmulticast mode [ 605.875786][ T151] bridge_slave_0: left promiscuous mode [ 605.876020][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.381577][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 606.535673][ T4901] Bluetooth: hci0: command tx timeout [ 606.719002][ T8946] usb usb7: check_ctrlrecip: process 8946 (syz.3.737) requesting ep 01 but needs 81 [ 607.526356][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 607.585957][ T151] bond0 (unregistering): Released all slaves [ 608.283543][ T4901] Bluetooth: hci3: command tx timeout [ 608.435338][ T151] bond0 (unregistering): Released all slaves [ 608.574980][ T4901] Bluetooth: hci0: command tx timeout [ 610.605914][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 610.654497][ T4901] Bluetooth: hci0: command tx timeout [ 610.675592][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 610.696822][ T151] bond0 (unregistering): Released all slaves [ 610.966216][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 611.085331][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 611.147110][ T151] bond0 (unregistering): Released all slaves [ 611.376636][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 611.475443][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 611.879148][ T151] bond0 (unregistering): Released all slaves [ 615.193227][ T5604] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 615.210805][ T5604] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 615.251749][ T5604] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 615.306703][ T5604] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 615.309392][ T5604] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 615.823018][ T8981] jffs2: notice: (8981) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 615.838964][ T8981] overlayfs: failed to resolve './file1': -2 [ 615.883912][ T8592] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 615.969861][ T8592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 615.978145][ T151] tipc: Disabling bearer [ 616.093157][ T151] tipc: Left network mode [ 617.510670][ T4901] Bluetooth: hci1: command tx timeout [ 619.106027][ T8805] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.113810][ T8805] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.114016][ T8805] bridge_slave_0: entered allmulticast mode [ 619.140507][ T8805] bridge_slave_0: entered promiscuous mode [ 619.161822][ T8805] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.169698][ T8805] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.169919][ T8805] bridge_slave_1: entered allmulticast mode [ 619.396411][ T8805] bridge_slave_1: entered promiscuous mode [ 619.536038][ T4901] Bluetooth: hci1: command tx timeout [ 620.284590][ T5318] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 620.338662][ T5247] 8021q: adding VLAN 0 to HW filter on device eth9 [ 620.339748][ T8912] wlan0 speed is unknown, defaulting to 1000 [ 620.392632][ T8805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 620.456114][ T5318] usb 4-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 620.474134][ T5318] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 620.485469][ T5318] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.599266][ T5318] cxacru 4-1:1.0: usbatm_usb_probe: bind failed: -19! [ 620.606060][ T8805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 620.641238][ T8923] wlan0 speed is unknown, defaulting to 1000 [ 620.689623][ T8974] wlan0 speed is unknown, defaulting to 1000 [ 620.745034][ T5599] usb 4-1: USB disconnect, device number 8 [ 620.792870][ T8805] team0: Port device team_slave_0 added [ 621.008180][ T8805] team0: Port device team_slave_1 added [ 621.182372][ T8805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 621.182611][ T8805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 621.182635][ T8805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 621.213882][ T8805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 621.213899][ T8805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 621.213922][ T8805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 621.614383][ T4901] Bluetooth: hci1: command tx timeout [ 621.802986][ T8805] hsr_slave_0: entered promiscuous mode [ 621.836616][ T8805] hsr_slave_1: entered promiscuous mode [ 621.895653][ T8805] debugfs: 'hsr0' already exists in 'hsr' [ 621.895771][ T8805] Cannot create hsr debugfs directory [ 624.058581][ T9054] usb usb7: check_ctrlrecip: process 9054 (syz.3.750) requesting ep 01 but needs 81 [ 624.265757][ T4901] Bluetooth: hci1: command tx timeout [ 624.364592][ T151] hsr_slave_0: left promiscuous mode [ 624.407415][ T151] hsr_slave_1: left promiscuous mode [ 624.408590][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 624.408615][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 624.540959][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.541022][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.587881][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 624.588132][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 624.615593][ T9061] jffs2: notice: (9061) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 624.622051][ T9061] overlayfs: failed to resolve './file1': -2 [ 624.748676][ T151] hsr_slave_0: left promiscuous mode [ 624.795964][ T151] hsr_slave_1: left promiscuous mode [ 624.797309][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 624.818578][ T9068] fuse: Bad value for 'fd' [ 624.836853][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 624.944653][ T151] hsr_slave_0: left promiscuous mode [ 624.965603][ T151] hsr_slave_1: left promiscuous mode [ 624.966882][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 625.017487][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 625.136844][ T151] veth1_macvtap: left promiscuous mode [ 625.142735][ T151] veth0_macvtap: left promiscuous mode [ 625.142882][ T151] veth1_vlan: left promiscuous mode [ 625.143009][ T151] veth0_vlan: left promiscuous mode [ 625.881291][ T151] team0 (unregistering): Port device team_slave_1 removed [ 625.925749][ T151] team0 (unregistering): Port device team_slave_0 removed [ 626.088076][ T9074] 9p: Bad value for 'wfdno' [ 633.086509][ T151] team0 (unregistering): Port device team_slave_1 removed [ 633.155161][ T151] team0 (unregistering): Port device team_slave_0 removed [ 634.435659][ T151] team0 (unregistering): Port device team_slave_1 removed [ 634.487067][ T151] team0 (unregistering): Port device team_slave_0 removed [ 634.494728][ C0] BUG: sleeping function called from invalid context at net/core/sock.c:3829 [ 634.494751][ C0] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 16, name: ktimers/0 [ 634.494771][ C0] preempt_count: 0, expected: 0 [ 634.494781][ C0] RCU nest depth: 2, expected: 0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 634.494803][ C0] locks held by ktimers/0/16: 4, last CPU#0: [ 634.494882][ C0] #0: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 634.495083][ C0] #1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 [ 634.495149][ C0] #2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_core+0x33/0x2b0 [ 634.495316][ C0] #3: ffff88803a558358 (sk_lock-AF_X25){+.+.}-{0:0}, at: x25_kill_by_neigh+0x134/0x2a0 [ 634.497965][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 634.497994][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 634.498013][ C0] Call Trace: [ 634.498052][ C0] [ 634.498069][ C0] dump_stack_lvl+0xe8/0x150 [ 634.498215][ C0] __might_resched+0x31b/0x470 [ 634.498270][ C0] lock_sock_nested+0x56/0x130 [ 634.498361][ C0] x25_kill_by_neigh+0x134/0x2a0 [ 634.498398][ C0] ? x25_kill_by_neigh+0x2b/0x2a0 [ 634.498566][ C0] x25_lapb_receive_frame+0x1b0/0xfb0 [ 634.498601][ C0] ? netif_receive_skb_core+0x33/0x2b0 [ 634.498634][ C0] ? netif_receive_skb_core+0x33/0x2b0 [ 634.498667][ C0] ? __pfx_x25_lapb_receive_frame+0x10/0x10 [ 634.498695][ C0] netif_receive_skb_core+0x2a6/0x2b0 [ 634.498737][ C0] lapbeth_napi_poll+0x45/0x90 [ 634.498857][ C0] __napi_poll+0xae/0x550 [ 634.498928][ C0] net_rx_action+0x621/0xd70 [ 634.498967][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 634.499001][ C0] ? sched_balance_domains+0x770/0x880 [ 634.499047][ C0] handle_softirqs+0x1da/0x6d0 [ 634.499089][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 634.499119][ C0] run_ktimerd+0x6a/0x100 [ 634.499153][ C0] smpboot_thread_fn+0x565/0xa70 [ 634.499187][ C0] ? smpboot_thread_fn+0x4e/0xa70 [ 634.499230][ C0] kthread+0x38b/0x470 [ 634.499254][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 634.499288][ C0] ? __pfx_kthread+0x10/0x10 [ 634.499314][ C0] ret_from_fork+0x514/0xb70 [ 634.499356][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 634.499380][ C0] ? __switch_to+0xc89/0x1420 [ 634.499419][ C0] ? __pfx_kthread+0x10/0x10 [ 634.499444][ C0] ret_from_fork_asm+0x1a/0x30 [ 634.499529][ C0] [ 635.406394][ T151] team0 (unregistering): Port device team_slave_1 removed [ 635.445425][ T151] team0 (unregistering): Port device team_slave_0 removed [ 635.641284][ T6661] bridge0: port 3(syz_tun) entered disabled state [ 635.737095][ T6661] syz_tun (unregistering): left allmulticast mode [ 635.737136][ T6661] syz_tun (unregistering): left promiscuous mode [ 635.737200][ T6661] bridge0: port 3(syz_tun) entered disabled state [ 636.035881][ T5247] 8021q: adding VLAN 0 to HW filter on device eth10 [ 637.570085][ T5247] 8021q: adding VLAN 0 to HW filter on device eth11 [ 639.250482][ T5247] 8021q: adding VLAN 0 to HW filter on device eth12 [ 641.362710][ T151] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.709924][ T151] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.050904][ T151] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.308408][ T151] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.120595][ T5247] 8021q: adding VLAN 0 to HW filter on device eth13 [ 643.626639][ T5247] 8021q: adding VLAN 0 to HW filter on device eth14 [ 644.135116][ T5247] 8021q: adding VLAN 0 to HW filter on device eth15