last executing test programs: 26.592883359s ago: executing program 1 (id=81): r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904000001020d0000052406000105240000000d240f0100000400000000000306241a00000008241c0600070d000905810300020000120904010000020d00000904010102020d00000905820200020000000905030240"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000180)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x11, 0x9, 0x0, 0x14, 0x604, 0x823c, 0xc, 0x400, 0xfffd, 0x4, 0xe1, 0x7}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000340)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 22.76081138s ago: executing program 1 (id=92): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0xfffffffb) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_usb_disconnect(0xffffffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='cdg', 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r1, &(0x7f0000000400)="89b70020040000e81403caa94cbe4d523c80fa81a9c0af", 0x17, 0x40890, 0x0, 0x0) 19.687126783s ago: executing program 1 (id=100): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000297ff8208582005109bc10102030109021200010100800009048f0000bf575a00"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/platform/drivers/dummy_hcd/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='dummy_hcd.0\x00', 0xb) close(r1) 17.670922891s ago: executing program 1 (id=113): creat(&(0x7f0000000080)='./bus\x00', 0x84) rename(&(0x7f0000000440)='./bus\x00', &(0x7f00000003c0)='./file1\x00') syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x40, &(0x7f00000000c0), 0xff, 0x4df, &(0x7f0000010a80)="$eJzs3c9rHFUcAPDv7Cb9GZuotdraarSKwR9Jk/6wBw8qCoIKgh7qMSZprd020kRoS9AoUs8F7+JR8OjJmxdRD+IfoOBRCkWD0FQUIrM7k2R/Jdsm6TbJ5wPbfW/2zcx7M+9l37y3Mw1g0+pN/0kiuiLi14jorkSrE/RW3mZnpkZuzEyNJDE39+afSTnd9ZmpkTxpvt7OLNJXiCh8msTzSf1+Jy5eOjNcKo2dz+IDk2ffH5i4eOmZ02eHT42dGjs3dPz4kcODzx4bOlq1XoNN1dneYFlaruv7Phzfv/eVt6+8PnLiyjs/fp1ua8+ByudZOba0sPmIG3W5eDViui5Zb3rU/porq/3s8ZZ2tH7ctSicdLQxI9yUYkSkp6uz3P67oxgLJ687Xv6krZkD1lT63bS1+cfTc8AGlkS7cwC0R/5Fn17/5q/47zZ1Pu4A115YuOifnZkamZ0fz+iIQra8cw333xsRJ6b/+SJ9Rc14CgDAWij3bZ6u6f+VFWJP+b0y17Erm0PpiYi7I+KeiLg3InZHxH0R5bT3R8QDlZXnulvcf29NvL7/U7jaMM+rJO3/Pbeo7zc7M1U9HFaInmL5rTLH0ROdycnTpbFD2THpi86taXxwiX1891LzaaXF/b/0leahJgNXOyoL5jcyOjw5vFoH4drHEfs6qsqfHf9kfiYgrQF7I2LfzW16Vx44/eRX+5slalT+vC+8rFWYZ5r7MuKJyvmfjpry55Im85NpHT82dHRgW5TGDg3ktaLeT79cfqPZ/ldU/lWQnv8d1fW/JkX330llvrYzSqWx8xM3v4/Lv33W9Jpm+fLP1/95af3fkrxVnrP++d3KsgvDk5PnByO2JK+V41lj2Rbp8qGFdS9k8Tx9Wv6+g43qf6H8Ny6y8/9gRKSV+EDEroci4uEs749ExKMRcXCJ8v/w4mPvLVH+JJJo6/kfjcbtP9OTLJ6vv4VA8cz33zabt2/t/B8pz673ZUvKf/+W0WoGV3j4AAAAYF0oRERXJIX+Sri3KwqF/v7Kb/h3x45CaXxi8qmT4x+cG63cI9ATnYV8pKt70XjoYJL//r0SH8rGivPPD2fjxp8Xt5fj/SPjpdE2lx02u53V7T/y9p/6o9ju3AFrrvk82hK3BgAbQm37L7QpH8Dt18rvaFwLwMbUoP0veobGv9W3CtU/5wJYxzoahIDNoVGr/6gmXtf/b/SULWDdqW//vzd4ZB2wEen1w+al/cPmpf3DprSS+/pvPZDfLLBk4jyLDdNsa/kO/80SyB8Ps5b72h4LS6JQDnRF07V2tOto5GPVSybubmWDEfHNivNTXIVypS2meklxuQKuMNDqf4YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwZ/s/AAD//16M4Cg=") r0 = creat(&(0x7f0000000380)='./bus\x00', 0x0) io_setup(0x202, 0x0) write$FUSE_BMAP(r0, &(0x7f00000026c0)={0x18, 0x7b3620c31cc0b28a}, 0x18) mount(&(0x7f0000000280)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x5000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x139) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x19, 0x5, "ef359f413bb93852f7d6a4ae5c70f20ff8ee09e737ff0edf1139c2eb4b68c660e677df7019051caafa00afaaf755a314a10400", "036c47c6780820d1cbf7966d61fdcf335263bd9bffbcc2542ded71038259ca171ce1a323ef54ec32d71e14ef3dc177e9b48b00", "f28359738e229a4c66810000000000d300e6d602000000000000522100000001", [0x8, 0x100]}) rename(&(0x7f0000000000)='./file2\x00', &(0x7f0000000140)='./file1\x00') fsync(r1) 15.291072517s ago: executing program 1 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/rndis.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/rndis.usb0/host_addr\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='48:8f:5a:00:00:12\x00', 0x12) 12.151020552s ago: executing program 1 (id=128): syz_open_dev$usbmon(&(0x7f0000000000), 0x5dc0, 0x48502) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0', 0xb) 11.877630978s ago: executing program 32 (id=128): syz_open_dev$usbmon(&(0x7f0000000000), 0x5dc0, 0x48502) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0', 0xb) 7.032445643s ago: executing program 3 (id=149): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r5 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r6, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 5.164028917s ago: executing program 3 (id=156): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x0, 0x8}) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) 5.099908939s ago: executing program 3 (id=157): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x4890) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.910001904s ago: executing program 0 (id=160): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0xfffffffb) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_usb_disconnect(0xffffffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='cdg', 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r1, &(0x7f0000000400)="89b70020040000e81403caa94cbe4d523c80fa81a9c0af", 0x17, 0x40890, 0x0, 0x0) 4.521642233s ago: executing program 3 (id=162): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000180)=0x400000001, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x5, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r1, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000340)=0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000001180)={0x9, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x7, 0x0, 0x7fffffff}, 0x0, 0x0) 3.742684831s ago: executing program 3 (id=163): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r5 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r5, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r6, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 3.151051316s ago: executing program 0 (id=164): mkdirat(0xffffffffffffff9c, &(0x7f00000000a0)='./dev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./dev\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') 2.933120501s ago: executing program 0 (id=165): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0xfffffffffffffffc, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_submit(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x400, r3, 0x0, 0x0, 0x8000000000}]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.623800488s ago: executing program 0 (id=166): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x24, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x40}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}, @TCA_CODEL_LIMIT={0x8, 0x2, 0x8}, @TCA_CODEL_ECN={0x8, 0x4, 0x1}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x240048e4}, 0x40) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 2.501410881s ago: executing program 2 (id=168): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) 1.927763064s ago: executing program 2 (id=169): syz_usb_connect$uac1(0x2, 0xaa, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b240404020904"], 0x0) 654.994355ms ago: executing program 0 (id=170): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000180)=0x400000001, 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x5, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r1, &(0x7f0000000140)={0x18, 0x2, {0xfffe, @loopback}}, 0x1e) connect$pptp(r1, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000340)=0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000001180)={0x9, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x7, 0x0, 0x7fffffff}, 0x0, 0x0) 654.727725ms ago: executing program 3 (id=171): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0xfffffffb) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) syz_usb_disconnect(0xffffffffffffffff) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000180)='cdg', 0x3) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r1, &(0x7f0000000400)="89b70020040000e81403caa94cbe4d523c80fa81a9c0af", 0x17, 0x40890, 0x0, 0x0) 591.386976ms ago: executing program 0 (id=172): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000297ff8208582005109bc10102030109021200010100800009048f0000bf575a00"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mysys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/bus/platform/drivers/dummy_hcd/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='dummy_hcd.0\x00', 0xb) 480.402059ms ago: executing program 2 (id=173): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x4004) ioctl$sock_SIOCBRDELBR(r0, 0x89a2, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) io_setup(0x80, 0x0) io_submit(0x0, 0x0, 0x0) fstatfs(0xffffffffffffffff, &(0x7f0000000140)=""/231) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_0\x00', 0x10) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x401eb94) sendmsg$NFT_MSG_GETSET(0xffffffffffffffff, 0x0, 0x40004) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000041c0)={&(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x2080000, 0x2030000c, 0x0, 0xc, 0x0, 0x56, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000000240)=0x3) fcntl$setsig(r2, 0xa, 0x12) dup2(r2, r3) 150.737987ms ago: executing program 2 (id=174): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}], 0x1, 0x20080058) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) 105.903468ms ago: executing program 2 (id=175): mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_sys/bus/pci/devices/0000:00:01.0/vendor\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./my_sys/bus/pci/drivers/dwc3-pci/new_id\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='8086 7000\x00', 0xa) 0s ago: executing program 2 (id=176): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.165' (ED25519) to the list of known hosts. [ 73.705336][ T5755] cgroup: Unknown subsys name 'net' [ 73.838117][ T5755] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.263928][ T5755] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.179909][ T5775] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.180489][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.188543][ T5775] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.204695][ T5779] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.212637][ T5779] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.220375][ T5780] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.228660][ T5780] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.236633][ T5780] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.244535][ T5780] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.251730][ T5779] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.252383][ T5780] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 77.266718][ T5780] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.268215][ T5778] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.282927][ T5778] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.290574][ T5778] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.298869][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.306304][ T5778] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.313770][ T5778] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.323901][ T5780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.325921][ T5778] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 77.339028][ T5083] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.346767][ T5083] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 77.354229][ T5083] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.362027][ T5778] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.702303][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 77.794697][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 77.880393][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.888383][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.895864][ T5767] bridge_slave_0: entered allmulticast mode [ 77.903306][ T5767] bridge_slave_0: entered promiscuous mode [ 77.920546][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 77.938029][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.945259][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.952942][ T5767] bridge_slave_1: entered allmulticast mode [ 77.959627][ T5767] bridge_slave_1: entered promiscuous mode [ 78.010457][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.023664][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.095845][ T5767] team0: Port device team_slave_0 added [ 78.109104][ T5767] team0: Port device team_slave_1 added [ 78.120248][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.127789][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.135691][ T5770] bridge_slave_0: entered allmulticast mode [ 78.142602][ T5770] bridge_slave_0: entered promiscuous mode [ 78.150025][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.157286][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.164526][ T5770] bridge_slave_1: entered allmulticast mode [ 78.171217][ T5770] bridge_slave_1: entered promiscuous mode [ 78.189332][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 78.245794][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.255910][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.263126][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.289069][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.317824][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.325238][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.332730][ T5771] bridge_slave_0: entered allmulticast mode [ 78.339439][ T5771] bridge_slave_0: entered promiscuous mode [ 78.348435][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.366734][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.375799][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.402172][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.423379][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.430619][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.437869][ T5771] bridge_slave_1: entered allmulticast mode [ 78.445180][ T5771] bridge_slave_1: entered promiscuous mode [ 78.478756][ T5770] team0: Port device team_slave_0 added [ 78.508706][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.525594][ T5770] team0: Port device team_slave_1 added [ 78.557184][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.564254][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.590772][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.604460][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.634086][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.641148][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.667325][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.705235][ T5771] team0: Port device team_slave_0 added [ 78.750093][ T5767] hsr_slave_0: entered promiscuous mode [ 78.756409][ T5767] hsr_slave_1: entered promiscuous mode [ 78.766813][ T5771] team0: Port device team_slave_1 added [ 78.773429][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.780543][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.791329][ T5768] bridge_slave_0: entered allmulticast mode [ 78.798324][ T5768] bridge_slave_0: entered promiscuous mode [ 78.807724][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.815103][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.822670][ T5768] bridge_slave_1: entered allmulticast mode [ 78.829379][ T5768] bridge_slave_1: entered promiscuous mode [ 78.884426][ T5770] hsr_slave_0: entered promiscuous mode [ 78.891049][ T5770] hsr_slave_1: entered promiscuous mode [ 78.897668][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.905575][ T5770] Cannot create hsr debugfs directory [ 78.934646][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.955396][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.964835][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.991467][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.009517][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.044191][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.051180][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.079564][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.102342][ T5768] team0: Port device team_slave_0 added [ 79.134703][ T5768] team0: Port device team_slave_1 added [ 79.196959][ T5771] hsr_slave_0: entered promiscuous mode [ 79.206521][ T5771] hsr_slave_1: entered promiscuous mode [ 79.212739][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.220286][ T5771] Cannot create hsr debugfs directory [ 79.253784][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.260767][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.287266][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.332781][ T5774] Bluetooth: hci1: command tx timeout [ 79.345486][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.352690][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.378804][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.411791][ T5774] Bluetooth: hci2: command tx timeout [ 79.417410][ T5774] Bluetooth: hci3: command tx timeout [ 79.423311][ T5778] Bluetooth: hci0: command tx timeout [ 79.533674][ T5768] hsr_slave_0: entered promiscuous mode [ 79.542299][ T5768] hsr_slave_1: entered promiscuous mode [ 79.548360][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.556083][ T5768] Cannot create hsr debugfs directory [ 79.669381][ T5770] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.680548][ T5770] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.705214][ T5770] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.715559][ T5770] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.779122][ T5767] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.815265][ T5767] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.840905][ T5767] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.850238][ T5767] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.947720][ T5771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.974477][ T5771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.987300][ T5771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.017649][ T5771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.074723][ T5768] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.084924][ T5768] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.110523][ T5768] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.119847][ T5768] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.140518][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.169182][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.215250][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.225009][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.248220][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.255632][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.286927][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.294225][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.304818][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.311992][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.349197][ T228] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.356366][ T228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.448390][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.495451][ T5767] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 80.522269][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.539348][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.587625][ T2925] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.594831][ T2925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.635742][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.650422][ T1305] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.657624][ T1305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.686589][ T228] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.693807][ T228] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.739634][ T228] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.746826][ T228] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.864598][ T5768] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 80.936441][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.987535][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.125879][ T5770] veth0_vlan: entered promiscuous mode [ 81.148419][ T5767] veth0_vlan: entered promiscuous mode [ 81.180488][ T5767] veth1_vlan: entered promiscuous mode [ 81.210908][ T5770] veth1_vlan: entered promiscuous mode [ 81.294472][ T5770] veth0_macvtap: entered promiscuous mode [ 81.319150][ T5767] veth0_macvtap: entered promiscuous mode [ 81.328508][ T5770] veth1_macvtap: entered promiscuous mode [ 81.346638][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.357588][ T5767] veth1_macvtap: entered promiscuous mode [ 81.368664][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.407163][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.415802][ T5774] Bluetooth: hci1: command tx timeout [ 81.440943][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.454855][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.465898][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.476471][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.500050][ T5770] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.502021][ T5777] Bluetooth: hci0: command tx timeout [ 81.511009][ T5774] Bluetooth: hci3: command tx timeout [ 81.516849][ T5777] Bluetooth: hci2: command tx timeout [ 81.525749][ T5770] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.538135][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.550370][ T5767] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.559395][ T5767] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.568356][ T5767] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.580952][ T5767] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.609999][ T5770] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.621640][ T5770] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.630391][ T5770] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.641640][ T5770] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.686180][ T5768] veth0_vlan: entered promiscuous mode [ 81.703267][ T5771] veth0_vlan: entered promiscuous mode [ 81.728292][ T5768] veth1_vlan: entered promiscuous mode [ 81.751176][ T5771] veth1_vlan: entered promiscuous mode [ 81.847422][ T5768] veth0_macvtap: entered promiscuous mode [ 81.858420][ T5768] veth1_macvtap: entered promiscuous mode [ 81.882680][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.891201][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.896592][ T5771] veth0_macvtap: entered promiscuous mode [ 81.935151][ T5771] veth1_macvtap: entered promiscuous mode [ 81.965571][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.982343][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.996598][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.012988][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.024496][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.032472][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.042456][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.053622][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.065188][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.083481][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.095379][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.105358][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.115838][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.128200][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.138212][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.148187][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.159382][ T5768] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.168907][ T5768] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.177988][ T5768] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.187820][ T5768] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.240877][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.258159][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.268027][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.278505][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.289064][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.300430][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.312852][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.360177][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.375644][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.390380][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.405234][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.415669][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.430677][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.445176][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.470421][ T5771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.484386][ T5771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.494708][ T5771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.503891][ T5771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.697865][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.709671][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.806440][ T5844] syz.3.5[5844]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 82.836206][ T2925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.849143][ T5844] loop3: detected capacity change from 0 to 512 [ 82.858651][ T2925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.877924][ T5844] ======================================================= [ 82.877924][ T5844] WARNING: The mand mount option has been deprecated and [ 82.877924][ T5844] and is ignored by this kernel. Remove the mand [ 82.877924][ T5844] option from the mount to silence this warning. [ 82.877924][ T5844] ======================================================= [ 82.942753][ T2925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.950623][ T2925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.955571][ T5844] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 83.041946][ T228] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.055915][ T5844] EXT4-fs error (device loop3): ext4_get_branch:178: inode #11: block 4294967295: comm syz.3.5: invalid block [ 83.069382][ T228] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.102392][ T5844] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.5: invalid indirect mapped block 4294967295 (level 1) [ 83.128754][ T5844] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.5: invalid indirect mapped block 4294967295 (level 1) [ 83.138006][ T5850] loop2: detected capacity change from 0 to 512 [ 83.153978][ T5844] EXT4-fs (loop3): 2 truncates cleaned up [ 83.182795][ T5850] EXT4-fs: inline encryption not supported [ 83.196831][ T5844] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 83.252130][ T5850] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 83.303402][ T5850] EXT4-fs error (device loop2): ext4_iget_extra_inode:4739: inode #15: comm syz.2.7: corrupted in-inode xattr: e_value size too large [ 83.329237][ T5850] EXT4-fs error (device loop2): ext4_orphan_get:1409: comm syz.2.7: couldn't read orphan inode 15 (err -117) [ 83.360425][ T5844] EXT4-fs (loop3): shut down requested (1) [ 83.370830][ T5850] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 83.453319][ T5853] syzkaller0: entered promiscuous mode [ 83.459946][ T5853] syzkaller0: entered allmulticast mode [ 83.479607][ T5853] netlink: 1028 bytes leftover after parsing attributes in process `syz.0.1'. [ 83.493605][ T5777] Bluetooth: hci1: command tx timeout [ 83.532896][ T5853] Zero length message leads to an empty skb [ 83.548752][ T5767] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.568044][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.577744][ T5777] Bluetooth: hci3: command tx timeout [ 83.577797][ T5777] Bluetooth: hci0: command tx timeout [ 83.581727][ T5777] Bluetooth: hci2: command tx timeout [ 83.991617][ T5864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11'. [ 84.388377][ T5872] loop2: detected capacity change from 0 to 512 [ 84.438950][ T5872] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 84.626961][ T5767] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.233495][ T5885] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 85.274000][ T5885] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 85.410912][ T5891] netlink: 4 bytes leftover after parsing attributes in process `syz.3.24'. [ 85.571708][ T5777] Bluetooth: hci1: command tx timeout [ 85.652615][ T5777] Bluetooth: hci2: command tx timeout [ 85.658163][ T5777] Bluetooth: hci0: command tx timeout [ 85.666969][ T5893] loop2: detected capacity change from 0 to 512 [ 85.671902][ T5777] Bluetooth: hci3: command tx timeout [ 85.681510][ T5893] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 85.985798][ T5900] loop1: detected capacity change from 0 to 256 [ 86.004156][ T5898] loop3: detected capacity change from 0 to 512 [ 86.028067][ T5898] EXT4-fs: Ignoring removed nomblk_io_submit option [ 86.066688][ T5898] EXT4-fs: Ignoring removed mblk_io_submit option [ 86.118983][ T5898] EXT4-fs (loop3): Cannot turn on journaled quota: type 0: error -2 [ 86.171005][ T5898] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -2 [ 86.276302][ T5898] EXT4-fs (loop3): 1 truncate cleaned up [ 86.325158][ T5898] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 86.450509][ T5898] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-000000000000. [ 86.538007][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.782992][ T5912] tipc: Enabling of bearer rejected, failed to enable media [ 87.548529][ T5922] syz.1.32 uses obsolete (PF_INET,SOCK_PACKET) [ 88.388163][ T5927] loop1: detected capacity change from 0 to 4096 [ 88.503596][ T5930] loop0: detected capacity change from 0 to 512 [ 88.593608][ T5927] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.616334][ T5930] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2855: Unable to expand inode 17. Delete some EAs or run e2fsck. [ 88.636851][ T5936] syzkaller1: entered promiscuous mode [ 88.642892][ T5936] syzkaller1: entered allmulticast mode [ 88.727186][ T5930] EXT4-fs (loop0): 1 truncate cleaned up [ 88.758472][ T5930] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 88.826507][ T5768] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.943285][ T5771] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.036989][ T5938] syzkaller0: entered promiscuous mode [ 89.077540][ T5938] syzkaller0: entered allmulticast mode [ 89.165568][ T5947] tipc: Enabling of bearer rejected, failed to enable media [ 89.917422][ T5970] loop3: detected capacity change from 0 to 128 [ 90.158757][ T5974] loop3: detected capacity change from 0 to 1024 [ 90.192555][ T5974] journal_path: Lookup failure for './file0' [ 90.198742][ T5974] EXT4-fs: error: could not find journal device path [ 90.384208][ T5982] loop3: detected capacity change from 0 to 512 [ 90.445216][ T5982] EXT4-fs (loop3): 1 truncate cleaned up [ 90.460942][ T5982] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.673263][ T5966] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.682740][ T5966] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.722703][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 91.254253][ T5966] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 91.285435][ T5966] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 91.589952][ T5966] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.599130][ T5966] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.609935][ T5966] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.619143][ T5966] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 91.711920][ T5990] tipc: Enabling of bearer rejected, failed to enable media [ 91.723098][ T6004] @0Ù: renamed from bond_slave_1 (while UP) [ 91.738844][ T6006] netlink: 132 bytes leftover after parsing attributes in process `syz.3.58'. [ 91.867591][ T6014] netlink: 188 bytes leftover after parsing attributes in process `syz.0.59'. [ 91.969129][ T6018] syzkaller0: entered promiscuous mode [ 91.990454][ T6018] syzkaller0: entered allmulticast mode [ 92.154923][ T6027] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.380417][ T23] cfg80211: failed to load regulatory.db [ 92.627886][ T6038] loop1: detected capacity change from 0 to 512 [ 92.710297][ T6038] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 93.227041][ T6033] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.234840][ T6033] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.841965][ T6033] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.883271][ T6033] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.328308][ T6033] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.338043][ T6033] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.347103][ T6033] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.356058][ T6033] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.497263][ T6044] bond_slave_0: entered promiscuous mode [ 94.503310][ T6044] @0Ù: entered promiscuous mode [ 94.532204][ T6044] vlan2: entered promiscuous mode [ 94.537395][ T6044] bond0: entered promiscuous mode [ 94.586079][ T6062] loop3: detected capacity change from 0 to 256 [ 94.617724][ T6052] tipc: Enabling of bearer rejected, failed to enable media [ 94.856050][ T6065] loop3: detected capacity change from 0 to 256 [ 94.868632][ T6065] exfat: Deprecated parameter 'utf8' [ 94.955618][ T6065] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xffade8b4, utbl_chksum : 0xe619d30d) [ 94.957350][ T27] audit: type=1800 audit(1784941446.103:2): pid=6068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.75" name="host_addr" dev="configfs" ino=7637 res=0 errno=0 [ 95.962525][ T6083] loop2: detected capacity change from 0 to 4096 [ 95.977558][ T6083] EXT4-fs: inline encryption not supported [ 96.005517][ T6083] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 96.025155][ T6083] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a800e018, mo2=0002] [ 96.041800][ T6083] System zones: 0-5 [ 96.053812][ T6083] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 96.271304][ T5757] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 96.561915][ T5757] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 96.880853][ T5757] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 97.003603][ T5757] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 97.024481][ T5757] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 97.036376][ T5757] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.039516][ T5767] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.044999][ T5757] usb 2-1: Product: syz [ 97.058113][ T5757] usb 2-1: Manufacturer: syz [ 97.063072][ T5757] usb 2-1: SerialNumber: syz [ 97.105402][ T6081] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 97.358282][ T6081] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 97.467677][ T6099] tipc: Enabling of bearer rejected, failed to enable media [ 97.932520][ T6112] loop2: detected capacity change from 0 to 512 [ 97.949649][ T6112] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 97.992480][ T6081] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 98.012357][ T6112] EXT4-fs (loop2): 1 truncate cleaned up [ 98.019619][ T6112] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 98.067298][ T6112] overlayfs: upper fs needs to support d_type. [ 98.129697][ T6072] process 'syz.0.77' launched './file0' with NULL argv: empty string added [ 98.192896][ T6114] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 98.210214][ T5757] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 98.217463][ T5757] cdc_ncm 2-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 98.225326][ T5757] cdc_ncm 2-1:1.0: setting rx_max = 2048 [ 98.343227][ T5767] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 98.455929][ T5757] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 98.506028][ T6118] loop0: detected capacity change from 0 to 512 [ 98.541717][ T5757] usb 2-1: USB disconnect, device number 2 [ 98.564792][ T6118] FAT-fs (loop0): Directory bread(block 199916) failed [ 98.587030][ T6118] FAT-fs (loop0): Directory bread(block 199917) failed [ 98.595211][ T5757] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 98.641495][ T6118] FAT-fs (loop0): Directory bread(block 199918) failed [ 98.670320][ T6118] FAT-fs (loop0): Directory bread(block 199919) failed [ 98.679592][ T6118] FAT-fs (loop0): Directory bread(block 199920) failed [ 98.686755][ T6118] FAT-fs (loop0): Directory bread(block 199921) failed [ 98.699754][ T6118] FAT-fs (loop0): Directory bread(block 199922) failed [ 98.707279][ T6118] FAT-fs (loop0): Directory bread(block 199923) failed [ 99.624212][ T6120] loop2: detected capacity change from 0 to 16 [ 99.663657][ T6120] erofs: (device loop2): erofs_fc_fill_super: rootino(nid 36) is not a directory(i_mode 23300) [ 99.743162][ T6133] loop3: detected capacity change from 0 to 512 [ 99.752318][ T6133] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 99.772093][ T5781] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 100.090435][ T27] audit: type=1800 audit(1784941451.243:3): pid=6140 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.94" name="out_ports" dev="configfs" ino=7788 res=0 errno=0 [ 100.677023][ T6156] loop0: detected capacity change from 0 to 2048 [ 100.750557][ T6156] Alternate GPT is invalid, using primary GPT. [ 100.774760][ T6156] loop0: p2 p3 p7 [ 100.779538][ T6130] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.787303][ T6130] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.237128][ T6173] loop0: detected capacity change from 0 to 512 [ 101.249662][ T5781] udevd[5781]: inotify_add_watch(7, /dev/loop0p3, 10) failed: No such file or directory [ 101.268523][ T5769] udevd[5769]: inotify_add_watch(7, /dev/loop0p2, 10) failed: No such file or directory [ 101.268954][ T5783] udevd[5783]: inotify_add_watch(7, /dev/loop0p7, 10) failed: No such file or directory [ 101.854364][ T6130] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 101.908418][ T6130] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 102.425435][ T6130] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.434832][ T6130] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.447031][ T6130] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.459313][ T6130] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 102.615657][ T6155] tipc: Enabling of bearer rejected, failed to enable media [ 102.919413][ T6194] capability: warning: `syz.2.103' uses deprecated v2 capabilities in a way that may be insecure [ 102.961507][ T6011] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 103.181673][ T6011] usb 2-1: Using ep0 maxpacket: 8 [ 103.193246][ T6011] usb 2-1: config 1 has an invalid interface number: 143 but max is 0 [ 103.210717][ T6199] loop2: detected capacity change from 0 to 1024 [ 103.219434][ T6011] usb 2-1: config 1 has no interface number 0 [ 103.233433][ T6011] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 103.253211][ T6199] EXT4-fs: Ignoring removed nomblk_io_submit option [ 103.256265][ T6011] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 103.274817][ T6199] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 103.312157][ T6011] usb 2-1: Product: syz [ 103.316396][ T6011] usb 2-1: Manufacturer: syz [ 103.321030][ T6011] usb 2-1: SerialNumber: syz [ 103.357345][ T6199] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 103.513518][ T6011] viperboard 2-1:1.143: version 0.00 found at bus 002 address 003 [ 103.586482][ T6011] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 103.609707][ T6186] dummy_hcd dummy_hcd.0: remove, state 4 [ 103.615657][ T6011] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 103.649322][ T6186] usb usb1: USB disconnect, device number 1 [ 103.733075][ T6186] dummy_hcd dummy_hcd.0: stopped [ 103.738104][ T6186] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 103.779650][ T6212] dummy_hcd dummy_hcd.0: USB Host+Gadget Emulator, driver 02 May 2005 [ 103.794618][ T6212] dummy_hcd dummy_hcd.0: Dummy host controller [ 103.842831][ T6212] dummy_hcd dummy_hcd.0: new USB bus registered, assigned bus number 1 [ 103.855334][ T6212] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.06 [ 103.865288][ T6212] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 103.875413][ T6212] usb usb1: Product: Dummy host controller [ 103.882460][ T6212] usb usb1: Manufacturer: Linux syzkaller dummy_hcd [ 103.905210][ T6212] usb usb1: SerialNumber: dummy_hcd.0 [ 103.932747][ T6215] tipc: Started in network mode [ 103.940378][ T6212] hub 1-0:1.0: USB hub found [ 103.949827][ T6212] hub 1-0:1.0: 1 port detected [ 103.951516][ T6215] tipc: Node identity daaf36a9d0a1, cluster identity 4711 [ 103.971809][ T6215] tipc: Enabled bearer , priority 0 [ 103.996140][ T6215] tipc: Resetting bearer [ 104.007003][ T6011] usb 2-1: USB disconnect, device number 3 [ 104.045134][ T6214] tipc: Disabling bearer [ 104.357700][ T6220] loop0: detected capacity change from 0 to 4096 [ 104.365438][ T6220] EXT4-fs: inline encryption not supported [ 104.402445][ T6220] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 104.422730][ T6220] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a800e018, mo2=0002] [ 104.443498][ T6220] System zones: 0-5 [ 104.489608][ T6220] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.802328][ T6225] loop1: detected capacity change from 0 to 512 [ 105.801454][ T27] audit: type=1804 audit(1784941456.083:4): pid=6199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.106" name="/newroot/25/file1/file1" dev="loop2" ino=15 res=1 errno=0 [ 105.844182][ T27] audit: type=1804 audit(1784941456.153:5): pid=6199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.106" name="/newroot/25/file1/file1" dev="loop2" ino=15 res=1 errno=0 [ 105.897816][ T6225] EXT4-fs error (device loop1): ext4_orphan_get:1404: inode #15: comm syz.1.113: inode has both inline data and extents flags [ 105.899407][ T5767] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 105.917276][ T6225] EXT4-fs error (device loop1): ext4_orphan_get:1409: comm syz.1.113: couldn't read orphan inode 15 (err -117) [ 105.974705][ T6225] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 106.037765][ T5771] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.206914][ T6235] netlink: 20 bytes leftover after parsing attributes in process `syz.3.114'. [ 106.226164][ T6235] binder: 6230:6235 ioctl c0306201 0 returned -14 [ 106.325638][ T6225] loop1: detected capacity change from 512 to 0 [ 106.463061][ T6237] syz.1.113: attempt to access beyond end of device [ 106.463061][ T6237] loop1: rw=12288, sector=72, nr_sectors = 2 limit=0 [ 106.802946][ T6237] EXT4-fs error (device loop1): __ext4_find_entry:1685: inode #2: comm syz.1.113: reading directory lblock 0 [ 106.814979][ T6237] syz.1.113: attempt to access beyond end of device [ 106.814979][ T6237] loop1: rw=14337, sector=2, nr_sectors = 2 limit=0 [ 106.828511][ T6237] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 106.837038][ T6237] EXT4-fs (loop1): I/O error while writing superblock [ 106.946160][ T6242] binder: 6241:6242 ioctl c0306201 200000000080 returned -14 [ 106.958458][ T6242] binder: 6241:6242 ioctl c0306201 2000000003c0 returned -14 [ 106.975927][ T5768] syz-executor: attempt to access beyond end of device [ 106.975927][ T5768] loop1: rw=12288, sector=72, nr_sectors = 2 limit=0 [ 107.031458][ T5768] EXT4-fs warning (device loop1): htree_dirblock_to_tree:1083: inode #2: lblock 0: comm syz-executor: error -5 reading directory block [ 107.061838][ T5768] syz-executor: attempt to access beyond end of device [ 107.061838][ T5768] loop1: rw=524288, sector=12, nr_sectors = 2 limit=0 [ 107.101930][ T5768] syz-executor: attempt to access beyond end of device [ 107.101930][ T5768] loop1: rw=524288, sector=14, nr_sectors = 2 limit=0 [ 107.131698][ T5768] syz-executor: attempt to access beyond end of device [ 107.131698][ T5768] loop1: rw=524288, sector=16, nr_sectors = 2 limit=0 [ 107.161468][ T5768] syz-executor: attempt to access beyond end of device [ 107.161468][ T5768] loop1: rw=524288, sector=18, nr_sectors = 2 limit=0 [ 107.191455][ T5768] syz-executor: attempt to access beyond end of device [ 107.191455][ T5768] loop1: rw=524288, sector=20, nr_sectors = 2 limit=0 [ 107.231573][ T5768] syz-executor: attempt to access beyond end of device [ 107.231573][ T5768] loop1: rw=524288, sector=22, nr_sectors = 2 limit=0 [ 107.265691][ T5768] syz-executor: attempt to access beyond end of device [ 107.265691][ T5768] loop1: rw=524288, sector=24, nr_sectors = 2 limit=0 [ 107.295701][ T5768] EXT4-fs error (device loop1): ext4_get_inode_loc:4634: inode #2: block 5: comm syz-executor: unable to read itable block [ 107.329130][ T5768] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.348140][ T5768] EXT4-fs (loop1): I/O error while writing superblock [ 107.365395][ T5768] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5939: IO failure [ 107.389315][ T5768] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.411437][ T5768] EXT4-fs (loop1): I/O error while writing superblock [ 107.425669][ T5768] EXT4-fs error (device loop1): ext4_dirty_inode:6143: inode #2: comm syz-executor: mark_inode_dirty error [ 107.455308][ T5768] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.470384][ T5768] EXT4-fs (loop1): I/O error while writing superblock [ 107.500862][ T1305] EXT4-fs error (device loop1): __ext4_get_inode_loc_noinmem:4619: inode #2: block 5: comm kworker/u4:6: unable to read itable block [ 107.525643][ T1305] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.598486][ T6256] loop3: detected capacity change from 0 to 512 [ 107.606231][ T6256] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 107.692751][ T1305] EXT4-fs (loop1): I/O error while writing superblock [ 107.734303][ T1305] EXT4-fs error (device loop1): __ext4_get_inode_loc_noinmem:4619: inode #18: block 9: comm kworker/u4:6: unable to read itable block [ 107.815235][ T1305] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.863203][ T1305] EXT4-fs (loop1): I/O error while writing superblock [ 107.909567][ T5768] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.947474][ T5768] Buffer I/O error on dev loop1, logical block 1, lost sync page write [ 107.992149][ T5768] EXT4-fs (loop1): I/O error while writing superblock [ 109.095086][ T6268] loop3: detected capacity change from 0 to 1024 [ 109.113904][ T6268] EXT4-fs: Ignoring removed nomblk_io_submit option [ 109.122556][ T6268] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 109.134262][ T6268] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 109.145485][ T6268] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 109.160763][ T6268] System zones: 0-1, 3-36 [ 109.214333][ T6268] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 109.353020][ T5770] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 110.512651][ T6287] binder: 6285:6287 ioctl c0306201 200000000080 returned -14 [ 110.538631][ T6287] binder: 6285:6287 ioctl c0306201 2000000003c0 returned -14 [ 111.842388][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 111.852881][ T5778] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 111.860950][ T5778] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 111.870917][ T5778] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 111.879769][ T5778] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 111.887683][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 112.060634][ T6311] loop0: detected capacity change from 0 to 512 [ 112.067931][ T6295] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.075471][ T6295] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.105726][ T6311] EXT4-fs (loop0): 1 truncate cleaned up [ 112.112960][ T6311] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.506475][ T6295] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 112.545570][ T6295] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 112.836025][ T6295] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.845300][ T6295] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.854652][ T6295] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.863737][ T6295] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.026129][ T6295] syz.2.134 (6295) used greatest stack depth: 20368 bytes left [ 113.971737][ T5777] Bluetooth: hci0: command tx timeout [ 114.461005][ T6311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.476860][ T6311] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.500296][ T6311] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 114.910680][ T6306] chnl_net:caif_netlink_parms(): no params data found [ 114.960435][ T6344] syzkaller0: entered promiscuous mode [ 114.969339][ T6344] syzkaller0: entered allmulticast mode [ 114.993496][ T6344] tipc: Started in network mode [ 114.998628][ T6344] tipc: Node identity c27d24547d2e, cluster identity 4711 [ 115.006519][ T6344] tipc: Enabled bearer , priority 0 [ 115.042020][ T6344] tipc: Resetting bearer [ 115.049997][ T6306] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.058948][ T6306] bridge0: port 1(bridge_slave_0) entered disabled state [ 115.066523][ T6306] bridge_slave_0: entered allmulticast mode [ 115.081244][ T6306] bridge_slave_0: entered promiscuous mode [ 115.089693][ T6306] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.098819][ T6306] bridge0: port 2(bridge_slave_1) entered disabled state [ 115.106149][ T6306] bridge_slave_1: entered allmulticast mode [ 115.122956][ T6306] bridge_slave_1: entered promiscuous mode [ 115.147373][ T6343] tipc: Resetting bearer [ 115.177427][ T5771] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 115.177912][ T6343] tipc: Disabling bearer [ 115.251234][ T6306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.266810][ T6306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 115.361028][ T6306] team0: Port device team_slave_0 added [ 115.383572][ T6306] team0: Port device team_slave_1 added [ 115.581887][ T6358] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 116.051642][ T5777] Bluetooth: hci0: command tx timeout [ 117.021187][ T6306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 117.029460][ T6306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 117.055947][ T6306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 117.072345][ T6306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 117.079319][ T6306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 117.110294][ T6306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 117.149589][ T6376] syzkaller0: entered promiscuous mode [ 117.156514][ T6376] syzkaller0: entered allmulticast mode [ 117.307767][ T6306] hsr_slave_0: entered promiscuous mode [ 117.329544][ T6306] hsr_slave_1: entered promiscuous mode [ 117.338132][ T6306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 117.349506][ T6306] Cannot create hsr debugfs directory [ 117.473846][ T6383] syzkaller0: entered promiscuous mode [ 117.479368][ T6383] syzkaller0: entered allmulticast mode [ 117.504391][ T6383] tipc: Enabled bearer , priority 0 [ 117.564463][ T6383] tipc: Resetting bearer [ 117.596583][ T6382] tipc: Resetting bearer [ 117.640957][ T6382] tipc: Disabling bearer [ 118.176708][ T5777] Bluetooth: hci0: command tx timeout [ 119.332213][ T6306] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 119.360659][ T6306] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 119.402648][ T6306] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 119.561373][ C0] sched: RT throttling activated [ 120.221524][ T5777] Bluetooth: hci0: command tx timeout [ 120.735807][ T5813] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 120.955565][ T5813] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 120.966039][ T5813] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 120.979303][ T5813] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 120.988702][ T5813] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 120.996802][ T5813] usb 3-1: Product: syz [ 121.001302][ T5813] usb 3-1: Manufacturer: syz [ 121.006330][ T5813] usb 3-1: SerialNumber: syz [ 121.261091][ T5813] usb 3-1: 0:2 : does not exist [ 121.270785][ T5813] usb 3-1: unit 9 not found! [ 121.461628][ T6306] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 121.471249][ T5813] usb 3-1: USB disconnect, device number 2 [ 121.684196][ T6306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 121.705875][ T6306] 8021q: adding VLAN 0 to HW filter on device team0 [ 121.727415][ T2925] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.735309][ T2925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.776287][ T2925] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.783522][ T2925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.837028][ T6306] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 122.041754][ T6007] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 122.080708][ T6306] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 122.263376][ T6007] usb 1-1: Using ep0 maxpacket: 8 [ 122.273729][ T6007] usb 1-1: config 1 has an invalid interface number: 143 but max is 0 [ 122.291648][ T6007] usb 1-1: config 1 has no interface number 0 [ 122.302188][ T6007] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 122.322500][ T6007] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.330521][ T6007] usb 1-1: Product: syz [ 122.361671][ T6007] usb 1-1: Manufacturer: syz [ 122.367115][ T6007] usb 1-1: SerialNumber: syz [ 122.504140][ T6007] viperboard 1-1:1.143: version 0.00 found at bus 001 address 002 [ 122.509947][ T6306] veth0_vlan: entered promiscuous mode [ 122.527670][ T6306] veth1_vlan: entered promiscuous mode [ 122.550486][ T6007] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 122.572897][ T6007] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 122.599912][ T6306] veth0_macvtap: entered promiscuous mode [ 122.629379][ T6441] dummy_hcd dummy_hcd.0: remove, state 1 [ 122.647067][ T6306] veth1_macvtap: entered promiscuous mode [ 122.663198][ T6441] usb usb1: USB disconnect, device number 1 [ 122.669153][ T6441] usb 1-1: USB disconnect, device number 2 [ 122.687499][ T6306] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 122.723596][ T6306] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 122.748110][ T6306] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.765140][ T6306] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.784281][ T6306] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.801110][ T6306] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.836633][ T6441] dummy_hcd dummy_hcd.0: stopped [ 122.876880][ T6441] dummy_hcd dummy_hcd.0: USB bus 1 deregistered [ 122.920624][ T6440] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 122.932393][ T6440] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 122.936038][ T6306] ieee80211 phy12: Selected rate control algorithm 'minstrel_ht' [ 122.940846][ T6440] CPU: 1 PID: 6440 Comm: syz.0.172 Not tainted syzkaller #0 [ 122.940865][ T6440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 122.965926][ T6440] RIP: 0010:set_link_state+0x27/0x11d0 [ 122.971424][ T6440] Code: 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 50 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 90 79 cd fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 5b f1 25 fb 4d 8b 26 4c 89 74 24 10 [ 122.991054][ T6440] RSP: 0018:ffffc900033d7b00 EFLAGS: 00010046 [ 122.997142][ T6440] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88802c853c00 [ 123.005132][ T6440] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 123.013123][ T6440] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 123.021112][ T6440] R10: dffffc0000000000 R11: fffff5200067af4c R12: 0000000000000a06 [ 123.029105][ T6440] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 123.037130][ T6440] FS: 000055557a785500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 123.046077][ T6440] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.052680][ T6440] CR2: 0000001b2d31fff8 CR3: 0000000066fdb000 CR4: 00000000003506e0 [ 123.060673][ T6440] Call Trace: [ 123.063965][ T6440] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 123.066907][ T6440] ? gadget_unbind_driver+0xb5/0x3e0 [ 123.072206][ T6440] ? cancel_work_sync+0x20/0x20 [ 123.074733][ T1305] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.077053][ T6440] ? mutex_lock_nested+0x20/0x20 [ 123.077078][ T6440] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 123.077100][ T6440] dummy_pullup+0xc1/0x120 [ 123.077123][ T6440] ? dummy_set_selfpowered+0x150/0x150 [ 123.077145][ T6440] usb_gadget_disconnect_locked+0x120/0x440 [ 123.077166][ T6440] gadget_unbind_driver+0xc2/0x3e0 [ 123.111493][ T2925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 123.111543][ T6440] ? gadget_bind_driver+0x770/0x770 [ 123.129828][ T6440] device_release_driver_internal+0x408/0x6f0 [ 123.130715][ T1305] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.135919][ T6440] driver_detach+0x1f3/0x2d0 [ 123.135945][ T6440] bus_remove_driver+0x221/0x2f0 [ 123.135966][ T6440] usb_gadget_unregister_driver+0x4e/0x70 [ 123.135987][ T6440] raw_release+0xda/0x260 [ 123.145735][ T2925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 123.147821][ T6440] ? raw_open+0x520/0x520 [ 123.174440][ T6440] __fput+0x221/0x940 [ 123.178450][ T6440] task_work_run+0x1d4/0x260 [ 123.183066][ T6440] ? task_work_cancel+0x220/0x220 [ 123.188113][ T6440] ? exit_to_user_mode_loop+0x3b/0x110 [ 123.193600][ T6440] exit_to_user_mode_loop+0xe6/0x110 [ 123.198921][ T6440] exit_to_user_mode_prepare+0xee/0x180 [ 123.204485][ T6440] syscall_exit_to_user_mode+0x1a/0x50 [ 123.209965][ T6440] do_syscall_64+0x61/0xb0 [ 123.214397][ T6440] ? clear_bhb_loop+0x40/0x90 [ 123.219095][ T6440] ? clear_bhb_loop+0x40/0x90 [ 123.223785][ T6440] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 123.229701][ T6440] RIP: 0033:0x7ff3aaf9de99 [ 123.234135][ T6440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.253882][ T6440] RSP: 002b:00007ffc3a620f68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 123.262337][ T6440] RAX: 0000000000000000 RBX: 00007ff3ab227da0 RCX: 00007ff3aaf9de99 [ 123.270298][ T6440] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 123.278263][ T6440] RBP: 00007ff3ab227da0 R08: 0000000000000006 R09: 0000000000000000 [ 123.286481][ T6440] R10: 00000000003fb9b0 R11: 0000000000000246 R12: 000000000001ead2 [ 123.294438][ T6440] R13: 00007ff3ab225fac R14: 000000000001df14 R15: 00007ffc3a621070 [ 123.302406][ T6440] [ 123.305426][ T6440] Modules linked in: [ 123.309311][ T6440] ---[ end trace 0000000000000000 ]--- [ 123.314760][ T6440] RIP: 0010:set_link_state+0x27/0x11d0 [ 123.320281][ T6440] Code: 0f 1f 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 50 49 89 fe 48 bb 00 00 00 00 00 fc ff df e8 90 79 cd fa 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 5b f1 25 fb 4d 8b 26 4c 89 74 24 10 [ 123.339927][ T6440] RSP: 0018:ffffc900033d7b00 EFLAGS: 00010046 [ 123.345995][ T6440] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88802c853c00 [ 123.353984][ T6440] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 123.361948][ T6440] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 123.369922][ T6440] R10: dffffc0000000000 R11: fffff5200067af4c R12: 0000000000000a06 [ 123.377882][ T6440] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 123.385846][ T6440] FS: 000055557a785500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 123.394772][ T6440] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 123.401344][ T6440] CR2: 0000001b2d31fff8 CR3: 0000000066fdb000 CR4: 00000000003506e0 [ 123.409321][ T6440] Kernel panic - not syncing: Fatal exception [ 123.415505][ T6440] Kernel Offset: disabled [ 123.419820][ T6440] Rebooting in 86400 seconds..