last executing test programs: 4.915333359s ago: executing program 1 (id=47): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000700)={0x44, &(0x7f0000000380)={0x20, 0xd, 0x8, "16decd5a7e620cf1"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 3.592150633s ago: executing program 2 (id=55): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="012026bd7020fbdbdf2510000000080003", @ANYRES32=r3, @ANYBLOB="08000600", @ANYRES32=r4], 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000040) 3.250515533s ago: executing program 2 (id=58): socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='autofs\x00', 0x201000c, &(0x7f0000000040)) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x8) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0), 0x2440, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r1, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x80000000}}, './file0\x00'}) 3.123323234s ago: executing program 2 (id=59): syz_usb_connect(0x3, 0x46, &(0x7f0000000200)={{0x12, 0x1, 0x10, 0x8f, 0xcb, 0x20, 0x40, 0x1bc7, 0x3000, 0x699a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0x2, 0xd, 0xa0, 0x7, "", [{{0x9, 0x4, 0x24, 0x1, 0x0, 0x2, 0x2, 0x5, 0x9, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x6, 0x6, 0x9}, {0x6, 0x24, 0x1a, 0x7, 0x1e}, [@call_mgmt={0x5, 0x24, 0x1, 0x2, 0x7}]}]}}]}}]}}, 0x0) 2.809489378s ago: executing program 1 (id=61): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x1a}, @ptr={0x70742a85, 0x80002, &(0x7f00000003c0)=""/235, 0xeb, 0x1, 0x31}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 2.61632118s ago: executing program 1 (id=62): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x11a, 0x9, 0x0, 0x0) 2.378665408s ago: executing program 1 (id=63): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002180)=ANY=[@ANYBLOB="b8000000290001000000000000080000ac1414bb000000000000000000000000fc00000000000000000000000000000000000000100000000200200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000ea44000000000000000000000000000000000000000000000000010000000000000009000000000000000a00ff800000000000000000000000000100000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x2404c831}, 0x0) 2.241268464s ago: executing program 1 (id=64): syz_usb_connect(0x3, 0x46, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000005b1710720500cbc9bb000203010902340001fb0000000904ca010338e880060905012a1000060002090500000002f803070905061000041c0d090705c1"], 0x0) 1.72831394s ago: executing program 2 (id=70): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x1a}, @ptr={0x70742a85, 0x80002, &(0x7f00000003c0)=""/235, 0xeb, 0x1, 0x31}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 1.433889164s ago: executing program 3 (id=72): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002180)=ANY=[@ANYBLOB="b8000000290001000000000000080000ac1414bb000000000000000000000000fc00000000000000000000000000000000000000100000000200200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000ea44000000000000000000000000000000000000000000000000010000000000000009000000000000000a00ff800000000000000000000000000100000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x2404c831}, 0x0) 1.412260043s ago: executing program 2 (id=73): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x27c}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x200000000000005e) sendto$inet(r1, &(0x7f0000000380)='j', 0x1, 0x24024095, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='bic', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) sendto$inet(r1, &(0x7f0000000080)='<', 0xffffffffffffffef, 0x4805, 0x0, 0xfe8d) 1.070364743s ago: executing program 3 (id=75): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="012026bd7020fbdbdf251000000008000300", @ANYRES32=r2, @ANYBLOB="08000600", @ANYRES32=r3], 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000040) 1.051244748s ago: executing program 0 (id=76): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x80000) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 814.713199ms ago: executing program 0 (id=77): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000280)=[@reply_sg={0x40486312, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@flat=@weak_handle={0x77682a85, 0x10a, 0x3}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0x22}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x33}}, &(0x7f0000000a00)={0x0, 0x18, 0x40}}}], 0x0, 0x0, 0x0}) 793.852522ms ago: executing program 3 (id=78): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x44840}, 0x0) 711.347534ms ago: executing program 1 (id=79): syz_usb_connect(0x3, 0x3b, &(0x7f0000000200)={{0x12, 0x1, 0x10, 0x8f, 0xcb, 0x20, 0x40, 0x1bc7, 0x3000, 0x699a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x29, 0x1, 0x2, 0xd, 0xa0, 0x7, "", [{{0x9, 0x4, 0x24, 0x1, 0x0, 0x2, 0x2, 0x5, 0x9, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x2, 0x7}}]}}]}}]}}, 0x0) 655.301461ms ago: executing program 0 (id=80): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000500)=ANY=[@ANYBLOB="6b0ee0b3d41b1b", @ANYRES16]) 654.889845ms ago: executing program 3 (id=81): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x0, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xb}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x1058, 0x0, 0x30, 0x0, 0x0, 0x78, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x1a}, @ptr={0x70742a85, 0x80002, &(0x7f00000003c0)=""/235, 0xeb, 0x1, 0x31}, @ptr={0x70742a85, 0x1, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x28, 0x50}}, 0x400}], 0x0, 0x0, 0x0}) 540.114106ms ago: executing program 0 (id=82): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x11a, 0x9, 0x0, 0x0) 450.665856ms ago: executing program 3 (id=83): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002180)=ANY=[@ANYBLOB="b8000000290001000000000000080000ac1414bb000000000000000000000000fc00000000000000000000000000000000000000100000000200200000000000", @ANYRES32=0x0, @ANYBLOB="000000000000ea44000000000000000000000000000000000000000000000000010000000000000009000000000000000a00ff80000000000000000000000000010000000000000002"], 0xb8}, 0x1, 0x0, 0x0, 0x2404c831}, 0x0) 292.074949ms ago: executing program 3 (id=84): socket$kcm(0x10, 0x2, 0x0) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) syz_io_uring_setup(0x10f, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x7fffffff, 0x2) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) sendmmsg(r1, 0x0, 0x0, 0x4000001) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000040)={0x123}, 0x10, 0x0) landlock_restrict_self(r2, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) 290.525444ms ago: executing program 0 (id=85): r0 = syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, 0x0) preadv(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f0000000040)=""/208, 0xd0}], 0x1, 0x3, 0x1) pread64(r0, 0x0, 0xfffffe89, 0x20000000005) 10.683351ms ago: executing program 0 (id=86): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000000c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="012026bd7020fbdbdf251000000008000300", @ANYRES32=r2, @ANYBLOB="08000600", @ANYRES32=r3], 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x20000040) 0s ago: executing program 2 (id=87): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x20048800) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.40' (ED25519) to the list of known hosts. [ 90.667311][ T5597] cgroup: Unknown subsys name 'net' [ 90.908950][ T5597] cgroup: Unknown subsys name 'cpuset' [ 90.963819][ T5597] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.075553][ T10] cfg80211: failed to load regulatory.db [ 93.131269][ T5597] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.936332][ T4925] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.941650][ T4925] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.950678][ T4925] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.960717][ T4925] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.985081][ T4925] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.151431][ T4925] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.194631][ T5621] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.197626][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.200949][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.221030][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.237345][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.239735][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.268947][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.290788][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.296151][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.309297][ T4925] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.314375][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.335429][ T4925] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.340185][ T4925] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.342196][ T5624] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 99.004534][ T5612] Bluetooth: hci0: command tx timeout [ 99.389064][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.390548][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.390796][ T5611] bridge_slave_0: entered allmulticast mode [ 99.395281][ T5611] bridge_slave_0: entered promiscuous mode [ 99.403569][ T5625] Bluetooth: hci2: command tx timeout [ 99.404060][ T5612] Bluetooth: hci1: command tx timeout [ 99.484494][ T5612] Bluetooth: hci3: command tx timeout [ 99.492229][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.492578][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.492926][ T5611] bridge_slave_1: entered allmulticast mode [ 99.505152][ T5611] bridge_slave_1: entered promiscuous mode [ 99.604642][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.604875][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.605079][ T5617] bridge_slave_0: entered allmulticast mode [ 99.607559][ T5617] bridge_slave_0: entered promiscuous mode [ 99.668945][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.669240][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.669978][ T5617] bridge_slave_1: entered allmulticast mode [ 99.672442][ T5617] bridge_slave_1: entered promiscuous mode [ 99.718104][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.780737][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.920458][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.958095][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.958528][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.959125][ T5616] bridge_slave_0: entered allmulticast mode [ 99.962931][ T5616] bridge_slave_0: entered promiscuous mode [ 99.998811][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.021068][ T5611] team0: Port device team_slave_0 added [ 100.021557][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.021912][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.022455][ T5616] bridge_slave_1: entered allmulticast mode [ 100.030544][ T5616] bridge_slave_1: entered promiscuous mode [ 100.099619][ T5611] team0: Port device team_slave_1 added [ 100.197565][ T5617] team0: Port device team_slave_0 added [ 100.198010][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.198349][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.198626][ T5615] bridge_slave_0: entered allmulticast mode [ 100.230339][ T5615] bridge_slave_0: entered promiscuous mode [ 100.274259][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.277867][ T5617] team0: Port device team_slave_1 added [ 100.279113][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.279379][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.279589][ T5615] bridge_slave_1: entered allmulticast mode [ 100.282026][ T5615] bridge_slave_1: entered promiscuous mode [ 100.306608][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.306652][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.306728][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.360794][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.414117][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.414130][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.414151][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.535512][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.535526][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.535546][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.551675][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.594184][ T5616] team0: Port device team_slave_0 added [ 100.604331][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.604343][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.604364][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.608972][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.634472][ T5616] team0: Port device team_slave_1 added [ 100.797120][ T5615] team0: Port device team_slave_0 added [ 100.811092][ T5611] hsr_slave_0: entered promiscuous mode [ 100.812882][ T5611] hsr_slave_1: entered promiscuous mode [ 100.826493][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.826506][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.826526][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.883767][ T5615] team0: Port device team_slave_1 added [ 100.885576][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.885588][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.885609][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.083422][ T5612] Bluetooth: hci0: command tx timeout [ 101.261845][ T5617] hsr_slave_0: entered promiscuous mode [ 101.266394][ T5617] hsr_slave_1: entered promiscuous mode [ 101.280556][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 101.280644][ T5617] Cannot create hsr debugfs directory [ 101.333247][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.333263][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.333285][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.402402][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.402416][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.402437][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.484339][ T5612] Bluetooth: hci1: command tx timeout [ 101.484374][ T5612] Bluetooth: hci2: command tx timeout [ 101.564817][ T5612] Bluetooth: hci3: command tx timeout [ 101.576919][ T5616] hsr_slave_0: entered promiscuous mode [ 101.578482][ T5616] hsr_slave_1: entered promiscuous mode [ 101.579806][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 101.579835][ T5616] Cannot create hsr debugfs directory [ 101.797997][ T5615] hsr_slave_0: entered promiscuous mode [ 101.799572][ T5615] hsr_slave_1: entered promiscuous mode [ 101.800824][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 101.800853][ T5615] Cannot create hsr debugfs directory [ 102.551819][ T5611] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.586886][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.602275][ T5611] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.642004][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.654534][ T5611] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.702203][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 102.729491][ T5611] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.762020][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 102.909396][ T5616] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 102.938971][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 102.957035][ T5616] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 102.979514][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 102.981761][ T5616] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.017451][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.058030][ T5616] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.098709][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.173324][ T5612] Bluetooth: hci0: command tx timeout [ 103.259233][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 103.298794][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.325648][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 103.370290][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.375682][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 103.431351][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.468138][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 103.508416][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.563290][ T5625] Bluetooth: hci1: command tx timeout [ 103.563425][ T5612] Bluetooth: hci2: command tx timeout [ 103.643292][ T5612] Bluetooth: hci3: command tx timeout [ 103.704841][ T5617] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 103.747680][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.761874][ T5617] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 103.799181][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.812378][ T5617] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 103.847621][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.870710][ T5617] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 103.900375][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.989473][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.118937][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.155987][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.180883][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.181091][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.282494][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.282739][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.368941][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.427638][ T1229] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.427825][ T1229] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.485173][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.511400][ T1229] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.511546][ T1229] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.652054][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.705019][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.742215][ T3302] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.742480][ T3302] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.838803][ T3302] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.838920][ T3302] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.955421][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.020434][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.022017][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.115202][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.115369][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.243775][ T5612] Bluetooth: hci0: command tx timeout [ 105.644519][ T5625] Bluetooth: hci1: command tx timeout [ 105.644570][ T5612] Bluetooth: hci2: command tx timeout [ 105.723746][ T5612] Bluetooth: hci3: command tx timeout [ 106.055136][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.527289][ T5611] veth0_vlan: entered promiscuous mode [ 106.562595][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.612593][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.631322][ T5611] veth1_vlan: entered promiscuous mode [ 106.836667][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 106.927588][ T5611] veth0_macvtap: entered promiscuous mode [ 106.941396][ T5616] veth0_vlan: entered promiscuous mode [ 106.984967][ T5611] veth1_macvtap: entered promiscuous mode [ 107.026007][ T5615] veth0_vlan: entered promiscuous mode [ 107.045373][ T5616] veth1_vlan: entered promiscuous mode [ 107.115861][ T5615] veth1_vlan: entered promiscuous mode [ 107.132750][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.177030][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.215114][ T5617] veth0_vlan: entered promiscuous mode [ 107.252294][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.271454][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.299197][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.318831][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 107.322244][ T5617] veth1_vlan: entered promiscuous mode [ 107.410690][ T5616] veth0_macvtap: entered promiscuous mode [ 107.475313][ T5616] veth1_macvtap: entered promiscuous mode [ 107.537621][ T5615] veth0_macvtap: entered promiscuous mode [ 107.667033][ T5615] veth1_macvtap: entered promiscuous mode [ 107.785033][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.834753][ T5617] veth0_macvtap: entered promiscuous mode [ 107.855321][ T1237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.855339][ T1237] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.927939][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.940671][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 107.970951][ T5617] veth1_macvtap: entered promiscuous mode [ 108.003926][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.007482][ T1527] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.051889][ T1527] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.070227][ T1527] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.086931][ T1527] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.122275][ T1527] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.166441][ T1527] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.176277][ T1237] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.176331][ T1237] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.225318][ T1527] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.266015][ T1527] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.492409][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.658699][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.903593][ T68] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.903684][ T68] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.903744][ T68] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.903782][ T68] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.372724][ T1428] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.372746][ T1428] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.590463][ T1527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.590484][ T1527] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.769739][ T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.769762][ T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.142518][ T1428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.142541][ T1428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.299218][ T1237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.299240][ T1237] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.826261][ T1237] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.826291][ T1237] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.987684][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 111.434423][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 111.527118][ T10] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 111.527150][ T10] usb 4-1: config 0 has no interface number 0 [ 111.527200][ T10] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 111.527230][ T10] usb 4-1: config 0 interface 85 has no altsetting 0 [ 111.589163][ T10] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 111.589197][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.589219][ T10] usb 4-1: Product: syz [ 111.589235][ T10] usb 4-1: Manufacturer: syz [ 111.589252][ T10] usb 4-1: SerialNumber: syz [ 111.705686][ T10] usb 4-1: config 0 descriptor?? [ 112.414569][ T10] appletouch 4-1:0.85: Geyser mode initialized. [ 112.592974][ T5784] syz.1.12 (5784) used greatest stack depth: 17248 bytes left [ 112.622001][ T10] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input5 [ 112.819608][ C0] appletouch 4-1:0.85: atp_complete: usb_submit_urb failed with result -1 [ 113.126967][ T32] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 113.314300][ T32] usb 3-1: config 2 has an invalid interface number: 36 but max is 0 [ 113.314341][ T32] usb 3-1: config 2 has no interface number 0 [ 113.314375][ T32] usb 3-1: config 2 interface 36 has no altsetting 0 [ 113.369833][ T32] usb 3-1: New USB device found, idVendor=1bc7, idProduct=3000, bcdDevice=69.9a [ 113.369868][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.369890][ T32] usb 3-1: Product: syz [ 113.369907][ T32] usb 3-1: Manufacturer: syz [ 113.369924][ T32] usb 3-1: SerialNumber: syz [ 113.422019][ C0] appletouch 4-1:0.85: atp_complete: usb_submit_urb failed with result -1 [ 113.831039][ T10] usb 4-1: USB disconnect, device number 2 [ 114.215337][ T32] usb 3-1: USB disconnect, device number 2 [ 115.120495][ T10] appletouch 4-1:0.85: input: appletouch disconnected [ 115.553252][ T5800] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 115.614378][ T5623] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 115.634670][ T5835] No control pipe specified [ 115.723683][ T5800] usb 1-1: Using ep0 maxpacket: 32 [ 115.729533][ T5800] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 115.729564][ T5800] usb 1-1: config 0 has no interface number 0 [ 115.729610][ T5800] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 115.729637][ T5800] usb 1-1: config 0 interface 85 has no altsetting 0 [ 115.732626][ T5800] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 115.732657][ T5800] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.732680][ T5800] usb 1-1: Product: syz [ 115.732696][ T5800] usb 1-1: Manufacturer: syz [ 115.732711][ T5800] usb 1-1: SerialNumber: syz [ 115.776454][ T5623] usb 2-1: Using ep0 maxpacket: 16 [ 115.829796][ T5623] usb 2-1: config 251 has an invalid interface number: 202 but max is 0 [ 115.829826][ T5623] usb 2-1: config 251 has no interface number 0 [ 115.829874][ T5623] usb 2-1: config 251 interface 202 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 16 [ 115.829901][ T5623] usb 2-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 115.829924][ T5623] usb 2-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 115.829953][ T5623] usb 2-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 115.829981][ T5623] usb 2-1: config 251 interface 202 altsetting 1 has a duplicate endpoint with address 0x81, skipping [ 115.830006][ T5623] usb 2-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 115.830045][ T5623] usb 2-1: config 251 interface 202 has no altsetting 0 [ 115.931550][ T5623] usb 2-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 115.931643][ T5623] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 115.931698][ T5623] usb 2-1: Product: syz [ 115.931741][ T5623] usb 2-1: SerialNumber: syz [ 116.042053][ T5833] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 116.096611][ T5800] usb 1-1: config 0 descriptor?? [ 116.339276][ T5623] cxacru 2-1:251.202: usbatm_usb_probe: bind failed: -19! [ 116.534678][ T5800] appletouch 1-1:0.85: Geyser mode initialized. [ 116.558098][ T5623] usb 2-1: USB disconnect, device number 2 [ 116.618150][ T5800] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.85/input/input6 [ 116.805261][ T5806] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 117.025892][ T5806] usb 4-1: config 2 has an invalid interface number: 36 but max is 0 [ 117.025921][ T5806] usb 4-1: config 2 has no interface number 0 [ 117.025962][ T5806] usb 4-1: config 2 interface 36 has no altsetting 0 [ 117.029556][ T5806] usb 4-1: New USB device found, idVendor=1bc7, idProduct=3000, bcdDevice=69.9a [ 117.029588][ T5806] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.029610][ T5806] usb 4-1: Product: syz [ 117.029626][ T5806] usb 4-1: Manufacturer: syz [ 117.029641][ T5806] usb 4-1: SerialNumber: syz [ 117.031487][ T5800] usb 1-1: USB disconnect, device number 2 [ 117.341812][ T5800] appletouch 1-1:0.85: input: appletouch disconnected [ 117.563253][ T5806] usb 4-1: USB disconnect, device number 3 [ 117.682471][ T5856] No control pipe specified [ 118.321326][ T5868] Zero length message leads to an empty skb [ 118.663222][ T5800] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 118.799179][ T5878] binder: BINDER_SET_CONTEXT_MGR already set [ 118.799195][ T5878] binder: 5877:5878 ioctl 4018620d 200000000040 returned -16 [ 118.819906][ T5800] usb 2-1: Using ep0 maxpacket: 32 [ 118.836639][ T5800] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 118.836666][ T5800] usb 2-1: config 0 has no interface number 0 [ 118.836707][ T5800] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 118.836735][ T5800] usb 2-1: config 0 interface 85 has no altsetting 0 [ 118.841422][ T5800] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 118.841452][ T5800] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.841473][ T5800] usb 2-1: Product: syz [ 118.841486][ T5800] usb 2-1: Manufacturer: syz [ 118.841499][ T5800] usb 2-1: SerialNumber: syz [ 118.845373][ T10] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 119.036902][ T5800] usb 2-1: config 0 descriptor?? [ 119.044814][ T10] usb 4-1: device descriptor read/64, error -71 [ 119.333645][ T10] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 119.453007][ T5887] netlink: 36 bytes leftover after parsing attributes in process `syz.2.54'. [ 119.454393][ T5800] appletouch 2-1:0.85: Geyser mode initialized. [ 119.457369][ T5800] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input7 [ 119.495555][ T10] usb 4-1: device descriptor read/64, error -71 [ 119.603855][ T10] usb usb4-port1: attempt power cycle [ 119.737188][ T5800] usb 2-1: USB disconnect, device number 3 [ 119.769180][ T5889] netlink: 8 bytes leftover after parsing attributes in process `syz.2.55'. [ 119.911989][ T5800] appletouch 2-1:0.85: input: appletouch disconnected [ 119.959356][ T5895] No control pipe specified [ 119.973279][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 119.994041][ T10] usb 4-1: device descriptor read/8, error -71 [ 120.263294][ T10] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 120.280935][ T9] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 120.288371][ T10] usb 4-1: device descriptor read/8, error -71 [ 120.404139][ T10] usb usb4-port1: unable to enumerate USB device [ 120.452920][ T9] usb 3-1: config 2 has an invalid interface number: 36 but max is 0 [ 120.452952][ T9] usb 3-1: config 2 has no interface number 0 [ 120.452987][ T9] usb 3-1: config 2 interface 36 has no altsetting 0 [ 120.458373][ T9] usb 3-1: New USB device found, idVendor=1bc7, idProduct=3000, bcdDevice=69.9a [ 120.458406][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.458429][ T9] usb 3-1: Product: syz [ 120.458444][ T9] usb 3-1: Manufacturer: syz [ 120.458460][ T9] usb 3-1: SerialNumber: syz [ 120.790288][ T5905] netlink: 36 bytes leftover after parsing attributes in process `syz.1.63'. [ 120.854942][ T9] usb 3-1: USB disconnect, device number 3 [ 121.239432][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 121.383373][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 121.387619][ T10] usb 2-1: config 251 has an invalid interface number: 202 but max is 0 [ 121.387658][ T10] usb 2-1: config 251 has no interface number 0 [ 121.387708][ T10] usb 2-1: config 251 interface 202 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 16 [ 121.387736][ T10] usb 2-1: config 251 interface 202 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 121.387760][ T10] usb 2-1: config 251 interface 202 altsetting 1 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 121.387790][ T10] usb 2-1: config 251 interface 202 altsetting 1 has an endpoint descriptor with address 0xC1, changing to 0x81 [ 121.387816][ T10] usb 2-1: config 251 interface 202 altsetting 1 has a duplicate endpoint with address 0x81, skipping [ 121.387841][ T10] usb 2-1: config 251 interface 202 altsetting 1 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 121.387870][ T10] usb 2-1: config 251 interface 202 has no altsetting 0 [ 121.391443][ T10] usb 2-1: New USB device found, idVendor=0572, idProduct=cb00, bcdDevice=bb.c9 [ 121.391475][ T10] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 121.391497][ T10] usb 2-1: Product: syz [ 121.391512][ T10] usb 2-1: SerialNumber: syz [ 121.541630][ T5907] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.802044][ T10] cxacru 2-1:251.202: usbatm_usb_probe: bind failed: -19! [ 121.830373][ T10] usb 2-1: USB disconnect, device number 4 [ 121.881910][ T5924] netlink: 36 bytes leftover after parsing attributes in process `syz.3.72'. [ 122.766397][ T5945] netlink: 36 bytes leftover after parsing attributes in process `syz.3.83'. [ 122.809970][ T10] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 122.958494][ T10] usb 2-1: config 2 has an invalid interface number: 36 but max is 0 [ 122.958526][ T10] usb 2-1: config 2 has no interface number 0 [ 122.958560][ T10] usb 2-1: config 2 interface 36 has no altsetting 0 [ 122.987193][ T10] usb 2-1: New USB device found, idVendor=1bc7, idProduct=3000, bcdDevice=69.9a [ 122.987217][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.987232][ T10] usb 2-1: Product: syz [ 122.987242][ T10] usb 2-1: Manufacturer: syz [ 122.987253][ T10] usb 2-1: SerialNumber: syz [ 123.230989][ T0] ------------[ cut here ]------------ [ 123.231002][ T0] rq->clock_update_flags < RQCF_ACT_SKIP [ 123.231014][ T0] WARNING: kernel/sched/sched.h:1792 at update_curr_idle+0x1cf/0x260, CPU#1: swapper/1/0 [ 123.231057][ T0] Modules linked in: [ 123.231093][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.231114][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 123.231129][ T0] RIP: 0010:update_curr_idle+0x1cf/0x260 [ 123.231157][ T0] Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 3a 98 97 00 48 8b 3b 4c 89 f6 4c 89 fa 5b 41 5c 41 5d 41 5e 41 5f 5d e9 52 38 01 00 90 <0f> 0b 90 e9 01 ff ff ff 90 0f 0b 90 e9 d3 fe ff ff 48 c7 c1 40 4c [ 123.231172][ T0] RSP: 0018:ffffc900001e7bf8 EFLAGS: 00010097 [ 123.231186][ T0] RAX: 0000000000000000 RBX: ffff8880b873ba40 RCX: 0000000000000002 [ 123.231198][ T0] RDX: ffff88803614dd00 RSI: ffffffff8dbdec30 RDI: ffffffff8bcc4d80 [ 123.231211][ T0] RBP: ffffc900001e7e30 R08: ffff8880b873c91f R09: 0000000000000000 [ 123.231223][ T0] R10: ffff8880b873c910 R11: ffffffff819a0020 R12: dffffc0000000000 [ 123.231235][ T0] R13: ffffffff8dc14a58 R14: ffff88801e295d00 R15: ffff8880b873c620 [ 123.231249][ T0] FS: 0000000000000000(0000) GS:ffff888125b6b000(0000) knlGS:0000000000000000 [ 123.231263][ T0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.231274][ T0] CR2: 00007f3314d3dac0 CR3: 0000000041cca000 CR4: 00000000003526f0 [ 123.231290][ T0] Call Trace: [ 123.231301][ T0] [ 123.231312][ T0] put_prev_task_idle+0xd/0x20 [ 123.231338][ T0] __schedule+0x3da0/0x5550 [ 123.231382][ T0] ? __pfx___schedule+0x10/0x10 [ 123.231400][ T0] ? lockdep_hardirqs_on+0x7a/0x110 [ 123.231431][ T0] ? tick_nohz_idle_exit+0x2a6/0x370 [ 123.231459][ T0] schedule_idle+0x51/0x90 [ 123.231479][ T0] do_idle+0x4a6/0x540 [ 123.231506][ T0] ? __pfx_do_idle+0x10/0x10 [ 123.231533][ T0] ? do_idle+0x10/0x540 [ 123.231560][ T0] cpu_startup_entry+0x43/0x60 [ 123.231585][ T0] start_secondary+0x101/0x110 [ 123.231613][ T0] common_startup_64+0x13e/0x157 [ 123.231654][ T0] [ 123.231662][ T0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 123.231674][ T0] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 123.231694][ T0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 123.231703][ T0] Call Trace: [ 123.231710][ T0] [ 123.231717][ T0] vpanic+0x56c/0xa60 [ 123.231744][ T0] ? __pfx__printk+0x10/0x10 [ 123.231762][ T0] ? __pfx_vpanic+0x10/0x10 [ 123.231786][ T0] ? is_bpf_text_address+0x292/0x2b0 [ 123.231812][ T0] ? is_bpf_text_address+0x26/0x2b0 [ 123.231844][ T0] panic+0xc5/0xd0 [ 123.231869][ T0] ? __pfx_panic+0x10/0x10 [ 123.231902][ T0] ? common_startup_64+0x13e/0x157 [ 123.231933][ T0] __warn+0x315/0x4c0 [ 123.231957][ T0] ? update_curr_idle+0x1cf/0x260 [ 123.231985][ T0] ? update_curr_idle+0x1cf/0x260 [ 123.232012][ T0] __report_bug+0x339/0x540 [ 123.232040][ T0] ? update_curr_idle+0x1cf/0x260 [ 123.232072][ T0] ? __pfx___report_bug+0x10/0x10 [ 123.232102][ T0] ? pick_task_fair+0x21a/0x1410 [ 123.232134][ T0] ? update_curr_idle+0x1cf/0x260 [ 123.232161][ T0] report_bug+0x16a/0x220 [ 123.232184][ T0] ? update_curr_idle+0x1cf/0x260 [ 123.232208][ T0] ? update_curr_idle+0x1d1/0x260 [ 123.232234][ T0] handle_bug+0x9c/0x200 [ 123.232260][ T0] exc_invalid_op+0x1a/0x50 [ 123.232285][ T0] asm_exc_invalid_op+0x1a/0x20 [ 123.232303][ T0] RIP: 0010:update_curr_idle+0x1cf/0x260 [ 123.232329][ T0] Code: e8 03 42 80 3c 20 00 74 08 48 89 df e8 3a 98 97 00 48 8b 3b 4c 89 f6 4c 89 fa 5b 41 5c 41 5d 41 5e 41 5f 5d e9 52 38 01 00 90 <0f> 0b 90 e9 01 ff ff ff 90 0f 0b 90 e9 d3 fe ff ff 48 c7 c1 40 4c [ 123.232343][ T0] RSP: 0018:ffffc900001e7bf8 EFLAGS: 00010097 [ 123.232358][ T0] RAX: 0000000000000000 RBX: ffff8880b873ba40 RCX: 0000000000000002 [ 123.232369][ T0] RDX: ffff88803614dd00 RSI: ffffffff8dbdec30 RDI: ffffffff8bcc4d80 [ 123.232382][ T0] RBP: ffffc900001e7e30 R08: ffff8880b873c91f R09: 0000000000000000 [ 123.232394][ T0] R10: ffff8880b873c910 R11: ffffffff819a0020 R12: dffffc0000000000 [ 123.232407][ T0] R13: ffffffff8dc14a58 R14: ffff88801e295d00 R15: ffff8880b873c620 [ 123.232424][ T0] ? __pfx_put_prev_task_idle+0x10/0x10 [ 123.232457][ T0] ? update_curr_idle+0xab/0x260 [ 123.232486][ T0] put_prev_task_idle+0xd/0x20 [ 123.232511][ T0] __schedule+0x3da0/0x5550 [ 123.232552][ T0] ? __pfx___schedule+0x10/0x10 [ 123.232570][ T0] ? lockdep_hardirqs_on+0x7a/0x110 [ 123.232599][ T0] ? tick_nohz_idle_exit+0x2a6/0x370 [ 123.232632][ T0] schedule_idle+0x51/0x90 [ 123.232653][ T0] do_idle+0x4a6/0x540 [ 123.232679][ T0] ? __pfx_do_idle+0x10/0x10 [ 123.232705][ T0] ? do_idle+0x10/0x540 [ 123.232733][ T0] cpu_startup_entry+0x43/0x60 [ 123.232758][ T0] start_secondary+0x101/0x110 [ 123.232778][ T0] common_startup_64+0x13e/0x157 [ 123.232817][ T0] [ 124.336255][ T0] Shutting down cpus with NMI [ 124.336483][ T0] Kernel Offset: disabled