last executing test programs: 8.339678535s ago: executing program 2 (id=60): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0xb, 0x2000000058831, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x248}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x6}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) syz_usb_control_io$uac3(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r3 = syz_clone(0x84334200, 0x0, 0xfffffffffffffc34, 0x0, 0x0, 0x0) ptrace(0x10, r3) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000040), 0x66e142, 0x0) ioctl$PTP_SYS_OFFSET(r4, 0xc0403d15, 0x0) ptrace$getregset(0x4205, r3, 0x200, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0x70}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x54) syz_usb_control_io$uac1(r1, 0x0, 0x0) 6.650835806s ago: executing program 3 (id=64): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x34, r1, 0x5, 0x0, 0xfffffffe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0xc, 0x49, [0xfac0d, 0xfac00]}]]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x28f, 0xfff, 0xa}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000000)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000340)={0x3, r4, 0xfffffffa, 0x4, 0xb, 0x1fd, 0x1}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000001880)={0x2, r6, 0xfff, 0x10005, 0x2, 0x900, 0x2}) 5.725523604s ago: executing program 3 (id=65): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000000c0)={0xffffffff, 0x0, 0x40, 0xbbd7, 0x85, "10120dfe0ef7f0019f0000c90a0080002a0008"}) 5.281557361s ago: executing program 3 (id=68): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x6a5, 0x0, 0x6e}]}) 4.73187641s ago: executing program 1 (id=70): socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x40}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe708, 0x42, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x20f5, 0x4003bfff, 0x2b9}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 4.675926239s ago: executing program 2 (id=71): r0 = syz_open_dev$MSR(&(0x7f00000003c0), 0xa, 0x0) preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000340)=""/109, 0x6d}], 0x1, 0x8000000, 0x68) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e1c, @multicast1}, 0x10) (async) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)={0x50, r3, 0x1, 0x70bd25, 0x2, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x5}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0xc082}, 0x24004080) (async) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) 4.575369592s ago: executing program 0 (id=72): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0xcd20}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4044081}, 0x0) 4.352376474s ago: executing program 3 (id=73): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f0102030109022d00010000000009040000032eb47d000905f9ffffff00000009050f47f0"], 0x0) syz_usb_ep_read(r0, 0xf, 0x0, 0x0) r1 = eventfd2(0x0, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c0016800800b6008847"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) read(r1, &(0x7f0000000280)=""/249, 0xf9) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESDEC, @ANYBLOB=',rootmode=0000000000000000004', @ANYRESDEC=0x0]) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x189882, 0x61) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000240)="a77704725bebf554", 0x8}], 0x1) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0x8, r3, r3) syz_usb_connect$uac3(0x2, 0x86, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100300000010820582054000010203010902740003010f6003080b0002010130000904000000010130000a2401050a00e58a000009040100000102300009040101010102300006240201000709050109100090060f0a2525040000000a040009040200ffff023000090402010101023000090506", @ANYRESDEC], &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f00000002c0)) ioctl$PPPIOCSACTIVE(r4, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) ioctl$PPPIOCSFLAGS1(r4, 0x40047459, &(0x7f00000003c0)=0x2000) setrlimit(0x40000000000008, &(0x7f0000000000)) r5 = add_key$keyring(&(0x7f0000000100), &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r5) socket$packet(0x11, 0x2, 0x300) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e3, &(0x7f0000000000)) 4.225852155s ago: executing program 0 (id=74): write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}}, {0xa, 0x0, 0x0, @mcast2={0xff, 0x5}}}}, 0x48) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x5, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x25cd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000004, 0x402, 0xbbf, 0x4a732f64, 0x1, 0x1c0, 0xd, 0x0, 0x2a3, 0x4, 0x1, 0x2, 0xc3, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x0, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x40, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x4, 0x809, 0x4, 0xa7, 0x1000, 0x0, 0x200b398, 0x400080, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x2, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x80004, 0x46, 0xf1, 0x4, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x9, 0x80000004, 0x6, 0x43b, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xffffeffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x8, 0x400, 0x6, 0xffff0000, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x7, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x9, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0xd, 0x7, 0x10010, 0x101, 0xdd81, 0x2, 0x7f, 0x9d27, 0x10000, 0x1, 0x100, 0x2, 0x6, 0x7ffd, 0x5, 0x7, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0x9, 0x1005, 0x1, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0xd, 0xfffffff7, 0x8, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x1, 0x26e, 0x6, 0xc, 0x4, 0xfffffff9, 0x9, 0x5d9, 0x463f, 0x4, 0xb0, 0x6, 0x6, 0x14000, 0x1, 0x9]}, 0x45c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0xac}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000240)={'veth1_to_batadv\x00', &(0x7f0000000300)=@ethtool_perm_addr={0x4b}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.121483198s ago: executing program 2 (id=75): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000080)) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0x7fff}, {0x400000b1, 0x0, 0x8}]}) 4.025881862s ago: executing program 1 (id=76): connect$inet(0xffffffffffffffff, 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x4080, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x8000000000000000, 0x80) splice(r0, &(0x7f0000000040)=0x5, r1, &(0x7f0000000140)=0xc6d, 0xff, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x401, 0x0, 0x0, {0x92258420943190a, 0x0, 0x2}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x2}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x40091}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYRES8=r0], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x40c0080) 3.692840059s ago: executing program 1 (id=77): openat$sysfs(0xffffff9c, 0x0, 0x1, 0x0) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0xffb2) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_256={{0x304}, "00e1ffffff00", "5985e81ad0d9585bc175cbecd3f55eb699e3ee0bc206f3ba527c85bde06fbf19", '\x00', '\x00\x00\x00\f\x00'}, 0x38) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x275a, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x4, &(0x7f00000000c0)=@gcm_128={{0x304}, "cdbef90c18b633a0", "fa07b3a2d40586d364f360be6df53598", "7eb00b44", "e598980949a58c71"}, 0x28) openat(0xffffffffffffff9c, 0x0, 0x81, 0x82) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='dir0/per_cpu/cpu0/trace_pipe\x00', 0x0, 0x0) ppoll(&(0x7f0000000180)=[{r2, 0x540}, {0xffffffffffffffff, 0x108}], 0x2, 0x0, 0x0, 0x0) 3.125401513s ago: executing program 2 (id=78): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xa2902, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) (fail_nth: 4) 2.74782543s ago: executing program 2 (id=79): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="54000004", @ANYRES16=r3, @ANYBLOB="01002bbd70010000006003000000400001802c000400140001002d004e217f00000100000000000000001400020002004e226401010200000000000000000d0001007564703a73797a3000000000"], 0x54}, 0x1, 0x300}, 0x8000) socket$nl_audit(0x10, 0x3, 0x9) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0xb1}]}, 0x10) write$bt_hci(r4, &(0x7f0000000040)=ANY=[], 0x6) socket(0x840000000002, 0x3, 0x100) socket$netlink(0x10, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x800, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) close(r7) ioctl$SIOCSIFHWADDR(r7, 0x8b23, &(0x7f0000000000)={'wlan1\x00', @random="0011002000"}) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x7c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}, @GTPA_FAMILY={0x5, 0xd, 0x26}, @GTPA_FAMILY={0x5, 0xd, 0x2a}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_O_TEI={0x8, 0x9, 0x1}, @GTPA_MS_ADDR6={0x14, 0xc, @private2={0xfc, 0x2, '\x00', 0x1}}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r7}, @GTPA_MS_ADDR6={0x14, 0xc, @mcast1}]}, 0x7c}, 0x1, 0x0, 0x0, 0x44}, 0x850) syz_ublk_setup_queues(r5, r6, &(0x7f0000000180)={0x0, 0x2, 0x0, 0xfffffffe, 0x257}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcf7a, 0x20000, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3948, 0xa000, 0x1, 0x248}}], 0x1, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) 2.644034507s ago: executing program 0 (id=80): mknod(&(0x7f00000048c0)='./file0\x00', 0x2, 0xffffffff) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='mountinfo\x00') read$FUSE(r1, &(0x7f0000002e80)={0x2020}, 0x2020) 2.565438213s ago: executing program 1 (id=81): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x6a5, 0x0, 0x6e}]}) 2.30165895s ago: executing program 0 (id=82): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0xcd20}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4044081}, 0x0) 2.200805607s ago: executing program 0 (id=83): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x10000, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x1000, 0x10000, &(0x7f0000ff0000/0x10000)=nil, 0x0, r2}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000340)={0x1000, 0x10000}) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x1, 0x4, 0x1000, 0x3f, &(0x7f0000ff0000/0x1000)=nil}) close(r2) 1.750087592s ago: executing program 1 (id=84): syz_open_dev$tty20(0xc, 0x4, 0x0) 1.179996467s ago: executing program 1 (id=85): r0 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000300)=[0x0, 0x0]}) syz_usb_connect(0x2, 0x48, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x36, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x2, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a}}]}}]}}]}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x14, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}}, 0x14}}, 0x25c782929a2a6532) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={0x0, 0xb}, &(0x7f0000000040)=0x8) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0x3}}, @sndinfo={0x20, 0x84, 0x2, {0x3, 0xb, 0xffff7ffe, 0xff}}], 0x38, 0x4014}, 0x2c0408d0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0x178, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x148, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x5c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @broadcast}}}]}, @CTA_EXPECT_NAT_TUPLE={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x14, 0x4, @remote}}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x84, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x11}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, @CTA_EXPECT_NAT={0x1c, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x10, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0xfffffffd}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r4, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r0, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, r1, 0x0, '\x00', 0x1ffffffffffffd64, 0x3f}) syz_open_dev$tty20(0xc, 0x4, 0x0) write$uinput_user_dev(r2, &(0x7f0000001fc0)={'syz1\x00', {0x8, 0x1000, 0x27, 0x2}, 0x48, [0xfffffc00, 0x3, 0x3ff, 0x7ff, 0x1ff, 0x6, 0xb, 0x8, 0x0, 0x566b, 0x537, 0x8000, 0x8, 0x8, 0x6, 0x9, 0xfffff206, 0x3, 0x7, 0x2610, 0x9, 0x1, 0x1971, 0xc0000000, 0xfffffff8, 0x3, 0x2, 0x80, 0xc, 0x2, 0x1000, 0xd8, 0x20, 0x101, 0x442, 0x4, 0x5, 0xc, 0x7c2e, 0x7, 0x536, 0x0, 0x2, 0x80000000, 0x2, 0xd2, 0xf45, 0x7ff, 0x0, 0x4, 0x200, 0x9, 0x4, 0xfffffeff, 0x5, 0x3, 0xfffffffc, 0x8, 0x0, 0x9936, 0xd7e9, 0xed7e, 0x8, 0x7ff], [0x101, 0xffffff81, 0x8, 0xbe62, 0x8ca8, 0x1, 0xfffff0fa, 0x9, 0xffff, 0x0, 0x7, 0x8b, 0x9, 0x1000, 0x5, 0xffffffff, 0x81, 0x5, 0x14, 0x7, 0x5cd6, 0x3, 0x7e, 0x2, 0x80000001, 0x2, 0x6, 0xcee9, 0x7, 0x4, 0x0, 0xe6, 0x9, 0xd091, 0x1, 0x80000000, 0x2, 0x400, 0x800, 0x2, 0xd8, 0x101, 0xb, 0x3, 0x5, 0xbc47, 0xc, 0x2c, 0x4147, 0x4, 0x80000001, 0x6, 0x0, 0x4, 0x5, 0xa, 0x8, 0x6, 0x2, 0x30, 0x6, 0x1, 0x6, 0x3], [0xfffffffa, 0xac, 0xc96538e0, 0x2, 0x7, 0x17, 0x7ff, 0x5, 0x4, 0x1, 0x81, 0x1, 0x4e3, 0x8, 0x5, 0x5, 0x4, 0x7, 0xfffffffd, 0x10001, 0x1, 0x5, 0x364, 0x9, 0x1, 0xffff423f, 0x2, 0x8, 0x10, 0x7ff, 0xe, 0x9, 0xd604, 0xa8, 0x6, 0x7, 0x7, 0x2, 0xece9, 0x80000000, 0x1, 0x9, 0xfa7, 0x6, 0x1b, 0x401, 0x4737, 0x0, 0x8, 0xc, 0x101, 0x2, 0xfffffffe, 0x100, 0xff, 0xd5, 0x80000001, 0x5, 0x520, 0x9, 0x6, 0x238, 0x9, 0x9], [0x0, 0x5, 0x3, 0x80000001, 0xb6, 0x0, 0x8, 0x8001, 0x2b, 0x3, 0x5, 0xfffffff8, 0x7, 0x9, 0x4cf4, 0xffffffff, 0x51, 0x9, 0x9, 0x1000, 0x101, 0xe5d2, 0xf330, 0x2, 0x7, 0x0, 0xa, 0x9, 0x7, 0x8, 0x2, 0x0, 0x2b, 0xd437, 0x3ff, 0xf06, 0x8, 0x8001, 0x4000, 0x3, 0x6, 0x51a, 0x14, 0xff, 0x4, 0x9, 0x7, 0x0, 0xb, 0x0, 0x7f, 0xaf, 0x5, 0x4, 0x5b, 0x5, 0x2, 0xffff, 0xf, 0x889c, 0x6, 0x400, 0x3, 0xa7]}, 0x45c) 1.063560315s ago: executing program 3 (id=86): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0x2, 0x1ff, 0x8}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000240)={0x2, 0x5, 0x40003}) r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0xe, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000080)={0x1, @pix={0x0, 0x0, 0x47524247, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x4d5e, 0x4) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r4, &(0x7f0000002fc0)="5e000d001b71ecab36c7f263c06bddc65b99fb63499dd5c8ef68", 0x1a, 0x8054, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r4, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000340)={0x6, 0x2, 0x800}) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r5, 0x29, 0xc8, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 965.281599ms ago: executing program 0 (id=87): ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r0 = socket$netlink(0x10, 0x3, 0x10) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@mcast2, @in=@broadcast}}, {{@in6=@private2}, 0x0, @in=@multicast2}}, &(0x7f0000000600)=0xe8) sendmsg$nl_generic(r0, &(0x7f0000000980)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000f40)={0x4b0, 0x38, 0x300, 0x70bd2a, 0x25dfdbfd, {0xd}, [@typed={0x5, 0x6f, 0x0, 0x0, @str='\x00'}, @typed={0x4, 0x42}, @typed={0x8, 0xa5, 0x0, 0x0, @pid}, @generic="31b8bbb682a36d5c29d56618c9f84d9edb221b41518fbe1c7c354bedfa9894e95bb168d6b6b4356bb8a424ae0a08928154f1ebd34de67428bcabecb8ec1b11f0bd71912fef5535dc98c3a9e2bea78815d9bdb3fcbb9dca4a0acfade0a9dd6e8a2f51744511a47df7abbd01e0c50a195d9617f7d703f3bc737c4b25eb1659b1a34dbbd5057447ce6fffe511a1dcfab4511b5f1944ffe4c53628e005607efe767206120cbcef0e", @typed={0x8, 0xd7, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x2f}}, @nested={0xdc, 0x169, 0x0, 0x1, [@nested={0x4, 0xdc}, @typed={0xd1, 0x135, 0x0, 0x0, @binary="6e7a3e60a5de036da390ef20d3df78511d08b5a707bef10e2a50802fe8b6eefd57fefee5bf4a818de73221d2a4180977e637ece8fd29f02b1e3cb16347270cfe7169949bd82670ba792d6b0e0fcb5266d6c9356d533d3ff63eb320b6b0cde0686ead9afc7034eb8d95607d3100aea5f28d571d4faf5c8a14fb6ea8472160000d756e4faa45a0d3c2ab81c71cdd85c2b11b51ec22d1f3a49773fd8d602c89d31735889fc717ba8aa24a394d5399d5dce960dbaaaa621cb5ce76a88182e825d3b38e0b5c3e7ec406f54285c2b20b"}]}, @generic="91368e6a03d2b2d6f721f334a5683fcb87394a738e9834449afe75c8bc0cc57ab2899accf7618619f130c6ba1c8c995100a5521ac7aac9d0a6464f6e86434202a28956f120af2da6059d6ed4c374f305b2e2e6a4a5fa938bcbabee6f4e67313d33a7f60c56bf0413398a8e030e5461df86c6f969ae4c2394befba5506e73c3c208fe2413af7d61c3f835b3f80d90bcb37cad81b8f5325d68bdb5920e6d11fc2d4c95de2c34fa8ace50b7d8cf6b977f54e4a1f2d2104d40c8fe03273d722590bd981fb70797b019dc805f1d833a6aab34d3954a82f63d6cc3ad44ba2058c48753e8fd14f33320765ccff87aeb1d57b861637c2edc6145846fefc897fa94", @generic="78f1b2c41c28e2dd8ffc2201baa4d94962e0de958f66178fab0973e4ac2227c0ac87a6e3786ac21ef4e9aafe976d9134bf01d38eb461d391bf5195c7a819b69b05e35ba681fe40ed4be54567408e9bd7c474c28e5d05da884512067af1ec7fd0736a6f84ca3ae6cef710f4c493793c72195cdff810baaf5b3a08e96c2855790100000000000000158bc73ac43eb5878f20f87e1a6c52f78e2f937778603f144cb8dd50d5d2e5fe0278071bd49245fc5c1bb36a928411f4ca63395656a8debb38d13e12680d49df008af0b19c42f3508908e0e84ffad1d92b77dac6e333bab9c985617b125f0312870c84ba4c98471266a28d7fe3d3be6d51378409ac0245da60fb50cc82a89575d8c468968620d2baf4f2b25e7799d664f45f913afe9a18f25d57be4aae2d350ac5fdc9692a508977a52c72a8e6251b87d085c0a883d7996b760f5c04155557926ce8c99de3d798ea562bc6ab3eb8a9663f979c", @generic="8f4edc418c976402bbccb7242aea8fbd2ae3dc8719a3923eafe4c6c219ac9ba23ee6663e07bc65dc0049dbd3441461f58bbb5937a9cfaa3bde94360c9b3a0dfd99944d9397c5740c724007d870d81e026b7738ee1ae507d9dfb3f5827d50d5f133ac28c7546dcf2e90f183a7349a3a01fc69e4eb8b50beb0167f2e0fbf98ef638debdcbdb604257c09dcf4b0b09040d085ddc01b54ec67153887fb228ee1e782e3be9aef"]}, 0x4b0}, 0x1, 0x0, 0x0, 0x4000880}, 0x44800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x4, @thr={0x0, 0x0}}, &(0x7f0000000340)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r0) mq_notify(0xffffffffffffffff, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000280)={0x300, 'veth0_vlan\x00', {}, 0x9}) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000001d14ffff"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000b40)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r6, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x6}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000200)={0x28, 0x6, r6, 0x0, &(0x7f0000343000/0xf000)=nil, 0xf000, 0x8000004004000004}) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240), 0x20400) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r7, 0xc0105303, &(0x7f0000000280)={0x0, 0x5, 0xeb}) ioctl$IOMMU_IOAS_COPY(r5, 0x3b83, &(0x7f0000000140)={0x28, 0x5, r6, r6, 0xffff, 0x20000000000539, 0x3ffd}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000040)={0x28, 0x6, r6, 0x0, &(0x7f000034a000/0x3000)=nil, 0x3000, 0x9}) write$binfmt_misc(r2, &(0x7f0000000000), 0x6) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f0000000140)={{0x0, 0x2, 0x8000000000000001, 0x9, 0x1, 0x7fff, 0xc57c, 0x2, 0x3, 0x314c93b3, 0x8, 0x0, 0x0, 0x8, 0x8}, 0x28, [0x0, 0x0, 0x0, 0x0, 0x0]}) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x20000000) 344.208685ms ago: executing program 2 (id=88): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000004c0)={0x1c, 0x0, 0x7}) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x6e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) write(r3, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x8}, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0x7}]}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r6 = socket$inet_sctp(0x2, 0x1, 0x84) r7 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f00000000c0)={0x6, 0x8000, 0x401, 0x2, r8}, &(0x7f0000000180)=0x10) ioctl$SIOCSIFHWADDR(r5, 0x89b0, &(0x7f0000000040)={'macvlan0\x00', @random="18faff000020"}) 0s ago: executing program 3 (id=89): syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x44, r0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac02}]}]}, 0x44}}, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x18, r4, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e06f40908"], 0xa) kernel console output (not intermixed with test programs): [ 92.927943][ T824] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.1.136' (ED25519) to the list of known hosts. [ 99.751524][ T5583] cgroup: Unknown subsys name 'net' [ 99.993420][ T5583] cgroup: Unknown subsys name 'cpuset' [ 100.048269][ T5583] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 102.176720][ T5583] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 104.814085][ T4910] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 104.829895][ T4910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 104.854807][ T5606] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 104.854867][ T4910] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 104.873581][ T5607] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 104.875038][ T5610] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 104.881390][ T4910] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 104.883642][ T5607] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 104.898659][ T5607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 104.899502][ T5607] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 104.899955][ T5607] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 104.900909][ T5607] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 104.902132][ T5607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 104.904101][ T4910] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 104.908794][ T5607] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 104.914596][ T4910] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 104.915516][ T4910] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 104.921245][ T4910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 104.926600][ T5601] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 104.928566][ T5601] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 106.999183][ T5604] Bluetooth: hci2: command tx timeout [ 106.999401][ T5602] Bluetooth: hci3: command tx timeout [ 107.077374][ T5602] Bluetooth: hci0: command tx timeout [ 107.088506][ T5602] Bluetooth: hci1: command tx timeout [ 107.378296][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.379624][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.379869][ T5599] bridge_slave_0: entered allmulticast mode [ 107.382172][ T5599] bridge_slave_0: entered promiscuous mode [ 107.445706][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.446000][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.446195][ T5599] bridge_slave_1: entered allmulticast mode [ 107.449172][ T5599] bridge_slave_1: entered promiscuous mode [ 107.485757][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.486111][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.486650][ T5597] bridge_slave_0: entered allmulticast mode [ 107.490070][ T5597] bridge_slave_0: entered promiscuous mode [ 107.558626][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.558831][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.559540][ T5597] bridge_slave_1: entered allmulticast mode [ 107.561970][ T5597] bridge_slave_1: entered promiscuous mode [ 107.585809][ T5598] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.586125][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.586786][ T5598] bridge_slave_0: entered allmulticast mode [ 107.592833][ T5598] bridge_slave_0: entered promiscuous mode [ 107.646407][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.646875][ T5598] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.647968][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.648224][ T5598] bridge_slave_1: entered allmulticast mode [ 107.651779][ T5598] bridge_slave_1: entered promiscuous mode [ 107.654865][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.655200][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.655463][ T5596] bridge_slave_0: entered allmulticast mode [ 107.660140][ T5596] bridge_slave_0: entered promiscuous mode [ 107.740637][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.741050][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.741330][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.741505][ T5596] bridge_slave_1: entered allmulticast mode [ 107.743633][ T5596] bridge_slave_1: entered promiscuous mode [ 107.792896][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.850027][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.855056][ T5598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.930624][ T5598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.934512][ T5599] team0: Port device team_slave_0 added [ 107.945458][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 107.987025][ T5599] team0: Port device team_slave_1 added [ 107.994857][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 107.999051][ T5597] team0: Port device team_slave_0 added [ 108.064916][ T5597] team0: Port device team_slave_1 added [ 108.070647][ T5598] team0: Port device team_slave_0 added [ 108.130887][ T5598] team0: Port device team_slave_1 added [ 108.132713][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.132723][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.132739][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.151094][ T5596] team0: Port device team_slave_0 added [ 108.206852][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.206869][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.206894][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 108.218671][ T5596] team0: Port device team_slave_1 added [ 108.221160][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.221174][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.221198][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.296785][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.296802][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.296826][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 108.302331][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.302346][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.302372][ T5598] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.353937][ T5598] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.353954][ T5598] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.353979][ T5598] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 108.363777][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 108.363794][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.363818][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 108.421504][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 108.421520][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 108.421545][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 108.506941][ T5599] hsr_slave_0: entered promiscuous mode [ 108.509980][ T5599] hsr_slave_1: entered promiscuous mode [ 108.579142][ T5597] hsr_slave_0: entered promiscuous mode [ 108.580557][ T5597] hsr_slave_1: entered promiscuous mode [ 108.581810][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 108.581889][ T5597] Cannot create hsr debugfs directory [ 108.632519][ T5598] hsr_slave_0: entered promiscuous mode [ 108.633948][ T5598] hsr_slave_1: entered promiscuous mode [ 108.635281][ T5598] debugfs: 'hsr0' already exists in 'hsr' [ 108.635306][ T5598] Cannot create hsr debugfs directory [ 108.695686][ T5596] hsr_slave_0: entered promiscuous mode [ 108.697157][ T5596] hsr_slave_1: entered promiscuous mode [ 108.699961][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 108.699985][ T5596] Cannot create hsr debugfs directory [ 109.077520][ T5604] Bluetooth: hci2: command tx timeout [ 109.077630][ T5602] Bluetooth: hci3: command tx timeout [ 109.157850][ T5604] Bluetooth: hci0: command tx timeout [ 109.157947][ T5602] Bluetooth: hci1: command tx timeout [ 109.860257][ T5599] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 109.899189][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 109.905598][ T5599] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 109.931223][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 109.946396][ T5599] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 109.986070][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.011437][ T5599] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 110.044072][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.153920][ T5598] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 110.195173][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.211786][ T5598] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 110.258930][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 110.266205][ T5598] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 110.296063][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.325566][ T5598] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 110.353785][ T5598] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.521352][ T5597] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 110.562914][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.595060][ T5597] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 110.621287][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 110.635801][ T5597] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 110.674083][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 110.722355][ T5597] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 110.762931][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 110.900420][ T5596] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 110.943429][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 110.961608][ T5596] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 111.004058][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.010642][ T5596] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 111.044908][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 111.060177][ T5596] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 111.104022][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 111.169197][ T5602] Bluetooth: hci3: command tx timeout [ 111.169248][ T5602] Bluetooth: hci2: command tx timeout [ 111.238764][ T5604] Bluetooth: hci0: command tx timeout [ 111.240230][ T5602] Bluetooth: hci1: command tx timeout [ 111.261309][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.371828][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.397059][ T5598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.458155][ T1182] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.458460][ T1182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.520980][ T1182] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.521317][ T1182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.578765][ T5598] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.631014][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.636436][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.636592][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.690209][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.690341][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.775693][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.822728][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.847036][ T1182] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.854536][ T1182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.908915][ T1182] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.909039][ T1182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 112.078546][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 112.198446][ T3323] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.198638][ T3323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 112.280942][ T3347] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.286462][ T3347] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.237411][ T5602] Bluetooth: hci2: command tx timeout [ 113.237447][ T5602] Bluetooth: hci3: command tx timeout [ 113.269302][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.318565][ T5604] Bluetooth: hci1: command tx timeout [ 113.331248][ T5604] Bluetooth: hci0: command tx timeout [ 113.544710][ T5598] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 113.889825][ T5599] veth0_vlan: entered promiscuous mode [ 113.922003][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.044256][ T5599] veth1_vlan: entered promiscuous mode [ 114.111352][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.113454][ T5598] veth0_vlan: entered promiscuous mode [ 114.185620][ T5598] veth1_vlan: entered promiscuous mode [ 114.292805][ T5599] veth0_macvtap: entered promiscuous mode [ 114.315288][ T5597] veth0_vlan: entered promiscuous mode [ 114.335815][ T5599] veth1_macvtap: entered promiscuous mode [ 114.401598][ T5597] veth1_vlan: entered promiscuous mode [ 114.433023][ T5596] veth0_vlan: entered promiscuous mode [ 114.446110][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.458595][ T5598] veth0_macvtap: entered promiscuous mode [ 114.486962][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.493207][ T5598] veth1_macvtap: entered promiscuous mode [ 114.514625][ T5596] veth1_vlan: entered promiscuous mode [ 114.546932][ T1243] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.562926][ T1243] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.569736][ T1243] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.586902][ T1243] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.627126][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.721217][ T5597] veth0_macvtap: entered promiscuous mode [ 114.741118][ T5598] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.830537][ T5597] veth1_macvtap: entered promiscuous mode [ 114.918496][ T3347] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.984942][ T3347] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.017151][ T3347] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.033264][ T3347] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.041186][ T5596] veth0_macvtap: entered promiscuous mode [ 115.202062][ T5596] veth1_macvtap: entered promiscuous mode [ 115.216174][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.390843][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.541791][ T1182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.541817][ T1182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.625346][ T34] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.666889][ T34] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.680444][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 115.684367][ T34] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.711588][ T34] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.733945][ T1243] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.733968][ T1243] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.753064][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 115.848546][ T34] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.851923][ T34] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.852013][ T34] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.852049][ T34] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.907479][ T1243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.907504][ T1243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.189028][ T1243] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.189051][ T1243] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.633505][ T3347] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.633527][ T3347] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.697976][ T1182] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.697999][ T1182] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.149863][ T3347] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.149883][ T3347] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.345882][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.345904][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.156774][ T5759] xt_l2tp: unknown flags: 8b [ 118.235859][ T5758] openvswitch: netlink: Key type 212 is out of range max 32 [ 118.425245][ T5758] veth1_to_bond: entered allmulticast mode [ 118.472672][ T5758] veth1_to_bond: entered promiscuous mode [ 118.485421][ T5762] FAULT_INJECTION: forcing a failure. [ 118.485421][ T5762] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 118.485458][ T5762] CPU: 1 UID: 0 PID: 5762 Comm: syz.1.2 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 118.485481][ T5762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 118.485492][ T5762] Call Trace: [ 118.485500][ T5762] [ 118.485508][ T5762] dump_stack_lvl+0xe8/0x150 [ 118.485538][ T5762] should_fail_ex+0x467/0x600 [ 118.485567][ T5762] _copy_from_user+0x2d/0xb0 [ 118.485586][ T5762] ___sys_sendmsg+0x1c6/0x360 [ 118.485617][ T5762] ? __lock_acquire+0x6df/0x2e40 [ 118.485641][ T5762] ? __pfx____sys_sendmsg+0x10/0x10 [ 118.485698][ T5762] ? __fget_files+0x2a/0x420 [ 118.485717][ T5762] ? __fget_files+0x3a8/0x420 [ 118.485746][ T5762] __x64_sys_sendmsg+0x1b7/0x290 [ 118.485776][ T5762] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 118.485822][ T5762] do_syscall_64+0x17b/0x530 [ 118.485841][ T5762] ? irqentry_exit+0x10f/0x8f0 [ 118.485859][ T5762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.485878][ T5762] ? clear_bhb_loop+0x40/0x90 [ 118.485901][ T5762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 118.485919][ T5762] RIP: 0033:0x7fdb7328de99 [ 118.485937][ T5762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 118.485953][ T5762] RSP: 002b:00007fdb714e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 118.485975][ T5762] RAX: ffffffffffffffda RBX: 00007fdb73515fa0 RCX: 00007fdb7328de99 [ 118.485988][ T5762] RDX: 000000000000c810 RSI: 0000200000000000 RDI: 0000000000000003 [ 118.486000][ T5762] RBP: 00007fdb714e6090 R08: 0000000000000000 R09: 0000000000000000 [ 118.486012][ T5762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 118.486023][ T5762] R13: 00007fdb73516038 R14: 00007fdb73515fa0 R15: 00007ffe2366bde8 [ 118.486052][ T5762] [ 118.532169][ T5758] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3'. [ 118.986799][ T5756] veth1_to_bond: left promiscuous mode [ 118.989894][ T5756] veth1_to_bond: left allmulticast mode [ 119.144381][ T5767] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 119.549318][ T5779] netlink: 'syz.3.8': attribute type 21 has an invalid length. [ 119.549345][ T5779] netlink: 128 bytes leftover after parsing attributes in process `syz.3.8'. [ 119.593057][ T5779] netlink: 'syz.3.8': attribute type 4 has an invalid length. [ 119.593085][ T5779] netlink: 'syz.3.8': attribute type 5 has an invalid length. [ 119.593117][ T5779] netlink: 3 bytes leftover after parsing attributes in process `syz.3.8'. [ 120.279862][ T5793] fuse: Bad value for 'fd' [ 120.729260][ T5802] Zero length message leads to an empty skb [ 121.498426][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 121.719500][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 121.776660][ T9] usb 2-1: config 4 has an invalid interface number: 9 but max is 0 [ 121.776692][ T9] usb 2-1: config 4 has no interface number 0 [ 121.776779][ T9] usb 2-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 121.776805][ T9] usb 2-1: config 4 interface 9 altsetting 2 bulk endpoint 0x84 has invalid maxpacket 64 [ 121.776829][ T9] usb 2-1: config 4 interface 9 has no altsetting 0 [ 121.833677][ T9] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 121.833709][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.833730][ T9] usb 2-1: Product: syz [ 121.833746][ T9] usb 2-1: Manufacturer: syz [ 121.833761][ T9] usb 2-1: SerialNumber: syz [ 122.103509][ T5802] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 122.103884][ T5802] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 122.244447][ T9] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 122.488626][ T5747] usb 2-1: USB disconnect, device number 2 [ 122.498141][ T1182] usb 2-1: Failed to submit usb control message: -71 [ 122.498192][ T1182] usb 2-1: unable to send the bmi data to the device: -71 [ 122.498210][ T1182] usb 2-1: unable to get target info from device [ 122.498226][ T1182] usb 2-1: could not get target info (-71) [ 122.498448][ T1182] usb 2-1: could not probe fw (-71) [ 122.556635][ T5801] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 122.908644][ T5831] fuse: Bad value for 'fd' [ 123.028532][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 123.222639][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 123.225224][ T9] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 123.225253][ T9] usb 3-1: config 0 has no interface number 0 [ 123.261704][ T9] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 123.261736][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 123.261753][ T9] usb 3-1: Product: syz [ 123.261764][ T9] usb 3-1: Manufacturer: syz [ 123.261776][ T9] usb 3-1: SerialNumber: syz [ 123.365482][ T9] usb 3-1: config 0 descriptor?? [ 123.396876][ T9] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 124.024147][ T9] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 124.073833][ T9] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 124.401409][ T5848] netlink: 'syz.0.27': attribute type 10 has an invalid length. [ 124.412361][ T5848] veth0_macvtap: entered allmulticast mode [ 124.916999][ T5853] unsupported nla_type 133 [ 124.931615][ T5853] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.28'. [ 125.314362][ T5859] fuse: Unknown parameter '' [ 125.440340][ T5747] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 125.638247][ T5747] usb 2-1: Using ep0 maxpacket: 8 [ 125.651755][ T5747] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 125.651817][ T5747] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 125.651844][ T5747] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 125.651871][ T5747] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 125.651901][ T5747] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 125.651927][ T5747] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 125.752177][ T5747] usb 2-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 125.752211][ T5747] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.752232][ T5747] usb 2-1: Product: syz [ 125.752248][ T5747] usb 2-1: Manufacturer: syz [ 125.752262][ T5747] usb 2-1: SerialNumber: syz [ 125.792643][ T5747] usb 2-1: config 0 descriptor?? [ 125.832740][ T5856] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 125.832964][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 125.869853][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 125.908936][ T5690] usb 3-1: USB disconnect, device number 2 [ 125.983518][ T5690] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 126.006753][ T5690] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 126.019615][ T5690] quatech2 3-1:0.51: device disconnected [ 126.077291][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 126.081260][ T9] usb 1-1: config 4 has an invalid interface number: 9 but max is 0 [ 126.081290][ T9] usb 1-1: config 4 has no interface number 0 [ 126.081339][ T9] usb 1-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 126.081365][ T9] usb 1-1: config 4 interface 9 altsetting 2 bulk endpoint 0x84 has invalid maxpacket 64 [ 126.081388][ T9] usb 1-1: config 4 interface 9 has no altsetting 0 [ 126.159898][ T9] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 126.159930][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.159949][ T9] usb 1-1: Product: syz [ 126.159964][ T9] usb 1-1: Manufacturer: syz [ 126.159977][ T9] usb 1-1: SerialNumber: syz [ 126.314579][ T5861] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 126.316855][ T5861] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 126.399865][ T5856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.400524][ T5856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.223028][ T5877] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 127.223076][ T5877] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 127.223097][ T5877] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 127.235973][ T39] audit: type=1800 audit(1785356776.922:2): pid=5877 uid=0 auid=4294967295 ses=4294967295 op=collect_data cause=failed comm="syz.2.36" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 127.566050][ C0] raw-gadget.2 gadget.0: ignoring, device is not running [ 127.566381][ T9] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 127.577858][ T3347] usb 1-1: Failed to submit usb control message: -32 [ 127.577894][ T3347] usb 1-1: unable to send the bmi data to the device: -32 [ 127.577910][ T3347] usb 1-1: unable to get target info from device [ 127.577924][ T3347] usb 1-1: could not get target info (-32) [ 127.578006][ T3347] usb 1-1: could not probe fw (-32) [ 127.705872][ T5860] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 127.731325][ T5587] usb 1-1: USB disconnect, device number 2 [ 127.808010][ T5747] rc_core: IR keymap rc-snapstream-firefly not found [ 127.808032][ T5747] Registered IR keymap rc-empty [ 127.945761][ T5747] rc rc0: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 128.008700][ T5747] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input5 [ 129.107096][ T5747] input: syz syz mouse as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input6 [ 129.422910][ T5747] usb 2-1: USB disconnect, device number 3 [ 129.423040][ C1] ati_remote 2-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 129.670369][ T4946] ati_remote 2-1:0.0: ati_remote_open: usb_submit_urb failed! [ 131.326967][ T5935] process 'syz.1.55' launched './file0' with NULL argv: empty string added [ 131.710978][ T5760] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 131.814836][ T5944] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.887387][ T5760] usb 4-1: Using ep0 maxpacket: 8 [ 131.890694][ T5760] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.890750][ T5760] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 131.890768][ T5760] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 131.890783][ T5760] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 131.890800][ T5760] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 131.890815][ T5760] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 131.893135][ T5760] usb 4-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 131.893162][ T5760] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.893175][ T5760] usb 4-1: Product: syz [ 131.893184][ T5760] usb 4-1: Manufacturer: syz [ 131.893192][ T5760] usb 4-1: SerialNumber: syz [ 131.905631][ T5760] usb 4-1: config 0 descriptor?? [ 132.021214][ T5937] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 132.077376][ T5824] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 132.228454][ T5824] usb 1-1: Using ep0 maxpacket: 16 [ 132.249317][ T5824] usb 1-1: config 4 has an invalid interface number: 9 but max is 0 [ 132.249345][ T5824] usb 1-1: config 4 has no interface number 0 [ 132.249391][ T5824] usb 1-1: config 4 interface 9 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 132.249416][ T5824] usb 1-1: config 4 interface 9 altsetting 2 bulk endpoint 0x84 has invalid maxpacket 64 [ 132.249437][ T5824] usb 1-1: config 4 interface 9 has no altsetting 0 [ 132.254387][ T5824] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=76.fe [ 132.254418][ T5824] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.254440][ T5824] usb 1-1: Product: syz [ 132.254455][ T5824] usb 1-1: Manufacturer: syz [ 132.254468][ T5824] usb 1-1: SerialNumber: syz [ 132.363667][ T5944] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 132.365142][ T5944] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 132.365146][ T5937] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.399937][ T5937] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.442595][ T5824] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 132.471215][ T32] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 132.600415][ T68] usb 1-1: Failed to submit usb control message: -71 [ 132.601095][ T68] usb 1-1: unable to send the bmi data to the device: -71 [ 132.601113][ T68] usb 1-1: unable to get target info from device [ 132.601125][ T68] usb 1-1: could not get target info (-71) [ 132.602133][ T68] usb 1-1: could not probe fw (-71) [ 132.605197][ T1868] usb 1-1: USB disconnect, device number 3 [ 132.684266][ T32] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 132.684326][ T32] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 132.684351][ T32] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 132.777963][ T32] usb 3-1: config 0 descriptor?? [ 132.819737][ T32] pwc: Askey VC010 type 2 USB webcam detected. [ 132.986408][ T32] pwc: send_video_command error -71 [ 132.986427][ T32] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 132.986539][ T32] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 133.012468][ T32] usb 3-1: USB disconnect, device number 3 [ 133.428746][ T5760] rc_core: IR keymap rc-snapstream-firefly not found [ 133.428769][ T5760] Registered IR keymap rc-empty [ 133.454995][ T5760] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 133.463478][ T5760] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input7 [ 133.511204][ T1868] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 133.656208][ T5760] input: syz syz mouse as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input8 [ 133.860167][ T1868] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 133.860225][ T1868] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 133.860360][ T1868] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.279269][ T1868] usb 3-1: config 0 descriptor?? [ 134.469046][ T5760] usb 4-1: USB disconnect, device number 2 [ 134.469130][ C0] ati_remote 4-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 134.528444][ T1868] pwc: Askey VC010 type 2 USB webcam detected. [ 134.756414][ T1868] pwc: recv_control_msg error -32 req 02 val 2b00 [ 134.778496][ T1868] pwc: recv_control_msg error -32 req 02 val 2700 [ 134.804843][ T1868] pwc: recv_control_msg error -32 req 02 val 2c00 [ 134.805622][ T1868] pwc: recv_control_msg error -32 req 04 val 1000 [ 134.807942][ T1868] pwc: recv_control_msg error -32 req 04 val 1300 [ 134.827788][ T1868] pwc: recv_control_msg error -32 req 04 val 1400 [ 134.835540][ T1868] pwc: recv_control_msg error -32 req 02 val 2000 [ 134.847795][ T1868] pwc: recv_control_msg error -32 req 02 val 2100 [ 134.860188][ T1868] pwc: recv_control_msg error -32 req 04 val 1500 [ 134.876748][ T1868] pwc: recv_control_msg error -32 req 02 val 2500 [ 134.895281][ T1868] pwc: recv_control_msg error -32 req 02 val 2400 [ 134.923331][ T1868] pwc: recv_control_msg error -32 req 02 val 2600 [ 134.941920][ T1868] pwc: recv_control_msg error -32 req 02 val 2900 [ 134.970475][ T1868] pwc: recv_control_msg error -71 req 02 val 2800 [ 134.975790][ T1868] pwc: recv_control_msg error -71 req 04 val 1100 [ 134.979893][ T1868] pwc: recv_control_msg error -71 req 04 val 1200 [ 135.066806][ T5888] ati_remote 4-1:0.0: ati_remote_open: usb_submit_urb failed! [ 135.326371][ T1868] pwc: Registered as video103. [ 135.338328][ T1868] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input9 [ 135.430540][ T5974] Bluetooth: MGMT ver 1.23 [ 135.625961][ T1868] usb 3-1: USB disconnect, device number 4 [ 136.555974][ T5690] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 136.717293][ T5690] usb 4-1: Using ep0 maxpacket: 8 [ 136.721413][ T5690] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.721472][ T5690] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 136.721522][ T5690] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 136.721549][ T5690] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 136.721645][ T5690] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 136.721672][ T5690] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 136.736621][ T5690] usb 4-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 136.736651][ T5690] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.736669][ T5690] usb 4-1: Product: syz [ 136.736683][ T5690] usb 4-1: Manufacturer: syz [ 136.736696][ T5690] usb 4-1: SerialNumber: syz [ 136.749719][ T5690] usb 4-1: config 0 descriptor?? [ 136.764266][ T5992] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 137.130057][ T5992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 137.139809][ T5992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.110578][ T32] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 138.268261][ T32] usb 3-1: Using ep0 maxpacket: 32 [ 138.272705][ T32] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 138.272733][ T32] usb 3-1: config 0 has no interface number 0 [ 138.272782][ T32] usb 3-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 138.272806][ T32] usb 3-1: config 0 interface 89 has no altsetting 0 [ 138.276617][ T32] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 138.276647][ T32] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.276668][ T32] usb 3-1: Product: syz [ 138.276679][ T32] usb 3-1: Manufacturer: syz [ 138.276687][ T32] usb 3-1: SerialNumber: syz [ 138.277437][ T5690] rc_core: IR keymap rc-snapstream-firefly not found [ 138.277453][ T5690] Registered IR keymap rc-empty [ 138.282549][ T5690] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 138.308507][ T5690] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input10 [ 138.396998][ T32] usb 3-1: config 0 descriptor?? [ 138.477416][ T32] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 138.477456][ T32] em28xx 3-1:0.89: Video interface 89 found: [ 138.686535][ T5690] input: syz syz mouse as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input11 [ 139.034029][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 139.043837][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 139.061053][ T5690] usb 4-1: USB disconnect, device number 3 [ 139.061136][ C0] ati_remote 4-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 139.125098][ T4946] ati_remote 4-1:0.0: ati_remote_open: usb_submit_urb failed! [ 139.517386][ T32] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 139.651370][ T6036] faux_driver vkms: [drm] Unknown color mode 262147; guessing buffer size. [ 139.671590][ T5747] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 139.704638][ T32] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 139.704671][ T32] em28xx 3-1:0.89: board has no eeprom [ 139.771490][ T6039] netlink: 16 bytes leftover after parsing attributes in process `syz.0.87'. [ 139.787835][ T32] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 139.787855][ T32] em28xx 3-1:0.89: analog set to bulk mode. [ 139.788046][ T5587] em28xx 3-1:0.89: Registering V4L2 extension [ 139.890435][ T32] usb 3-1: USB disconnect, device number 5 [ 139.948304][ T32] em28xx 3-1:0.89: Disconnecting em28xx [ 139.980341][ T5587] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 139.980368][ T5587] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 139.980381][ T5587] em28xx 3-1:0.89: No AC97 audio processor [ 140.222712][ T5587] usb 3-1: Decoder not found [ 140.222797][ T5587] em28xx 3-1:0.89: failed to create media graph [ 140.222869][ T5587] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 140.465192][ T5747] usb 2-1: unable to get BOS descriptor or descriptor too short [ 140.475443][ T5747] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 140.475482][ T5747] usb 2-1: can't read configurations, error -71 [ 140.509631][ T5587] INFO: trying to register non-static key. [ 140.509646][ T5587] The code is fine but needs lockdep annotation, or maybe [ 140.509654][ T5587] you didn't initialize this object before use? [ 140.509661][ T5587] turning off the locking correctness validator. [ 140.509675][ T5587] CPU: 1 UID: 0 PID: 5587 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 140.509700][ T5587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 140.509712][ T5587] Workqueue: events request_module_async [ 140.509739][ T5587] Call Trace: [ 140.509746][ T5587] [ 140.509754][ T5587] dump_stack_lvl+0xe8/0x150 [ 140.509782][ T5587] assign_lock_key+0x133/0x150 [ 140.509805][ T5587] register_lock_class+0xcc/0x2e0 [ 140.509838][ T5587] __lock_acquire+0xaf/0x2e40 [ 140.509857][ T5587] ? ret_from_fork_asm+0x1a/0x30 [ 140.509887][ T5587] ? stack_trace_save+0xa9/0x100 [ 140.509917][ T5587] ? __pfx_stack_trace_save+0x10/0x10 [ 140.509949][ T5587] lock_acquire+0x115/0x350 [ 140.509984][ T5587] ? __wake_up_common_lock+0x2f/0x1f0 [ 140.510016][ T5587] rt_spin_lock+0x83/0x400 [ 140.510041][ T5587] ? __wake_up_common_lock+0x2f/0x1f0 [ 140.510070][ T5587] ? __pfx_rt_spin_lock+0x10/0x10 [ 140.510102][ T5587] __wake_up_common_lock+0x2f/0x1f0 [ 140.510133][ T5587] __vb2_queue_cancel+0x2de/0xdc0 [ 140.510133][ T5587] __vb2_queue_cancel+0x2de/0xdc0 [ 140.510164][ T5587] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 140.510184][ T5587] ? lockdep_hardirqs_on+0x7a/0x110 [ 140.510203][ T5587] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 140.510237][ T5587] vb2_core_queue_release+0x2f/0x150 [ 140.510269][ T5587] vb2_video_unregister_device+0x15b/0x200 [ 140.510303][ T5587] em28xx_v4l2_init+0x1c60/0x3140 [ 140.510331][ T5587] em28xx_init_extension+0x120/0x1d0 [ 140.510363][ T5587] ? process_one_work+0x7fd/0x1480 [ 140.510385][ T5587] process_one_work+0xaaf/0x1480 [ 140.510413][ T5587] ? __pfx_process_one_work+0x10/0x10 [ 140.510432][ T5587] ? do_raw_spin_lock+0x12b/0x2f0 [ 140.510461][ T5587] ? assign_work+0x3cf/0x5d0 [ 140.510483][ T5587] worker_thread+0xb05/0x10d0 [ 140.510517][ T5587] ? __kthread_parkme+0x71/0x1f0 [ 140.510541][ T5587] kthread+0x388/0x470 [ 140.510584][ T5587] ? __pfx_worker_thread+0x10/0x10 [ 140.510603][ T5587] ? __pfx_kthread+0x10/0x10 [ 140.510629][ T5587] ret_from_fork+0x514/0xb70 [ 140.510654][ T5587] ? __pfx_ret_from_fork+0x10/0x10 [ 140.510679][ T5587] ? __switch_to+0xc89/0x1420 [ 140.510703][ T5587] ? __pfx_kthread+0x10/0x10 [ 140.510728][ T5587] ret_from_fork_asm+0x1a/0x30 [ 140.510759][ T5587] [ 140.639045][ T5587] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 140.639071][ T5587] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 140.639092][ T5587] CPU: 1 UID: 0 PID: 5587 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 140.639116][ T5587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 140.639130][ T5587] Workqueue: events request_module_async [ 140.639157][ T5587] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 140.639190][ T5587] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 140.639207][ T5587] RSP: 0018:ffffc90004b4f908 EFLAGS: 00010246 [ 140.639225][ T5587] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 140.639238][ T5587] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 140.639253][ T5587] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 140.639265][ T5587] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88803af89b14 [ 140.639281][ T5587] R13: ffff88803af89c28 R14: 0000000000000000 R15: 0000000000000000 [ 140.639295][ T5587] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 140.639311][ T5587] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 140.639325][ T5587] CR2: 000000110c438f62 CR3: 000000002da06000 CR4: 00000000003526f0 [ 140.639345][ T5587] Call Trace: [ 140.639353][ T5587] [ 140.639364][ T5587] __vb2_queue_cancel+0x2de/0xdc0 [ 140.639394][ T5587] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 140.639417][ T5587] ? lockdep_hardirqs_on+0x7a/0x110 [ 140.639434][ T5587] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 140.639463][ T5587] vb2_core_queue_release+0x2f/0x150 [ 140.639493][ T5587] vb2_video_unregister_device+0x15b/0x200 [ 140.639523][ T5587] em28xx_v4l2_init+0x1c60/0x3140 [ 140.639550][ T5587] em28xx_init_extension+0x120/0x1d0 [ 140.639582][ T5587] ? process_one_work+0x7fd/0x1480 [ 140.639600][ T5587] process_one_work+0xaaf/0x1480 [ 140.639627][ T5587] ? __pfx_process_one_work+0x10/0x10 [ 140.639645][ T5587] ? do_raw_spin_lock+0x12b/0x2f0 [ 140.639673][ T5587] ? assign_work+0x3cf/0x5d0 [ 140.639693][ T5587] worker_thread+0xb05/0x10d0 [ 140.639719][ T5587] ? __kthread_parkme+0x71/0x1f0 [ 140.639745][ T5587] kthread+0x388/0x470 [ 140.639771][ T5587] ? __pfx_worker_thread+0x10/0x10 [ 140.639791][ T5587] ? __pfx_kthread+0x10/0x10 [ 140.639817][ T5587] ret_from_fork+0x514/0xb70 [ 140.639844][ T5587] ? __pfx_ret_from_fork+0x10/0x10 [ 140.639877][ T5587] ? __switch_to+0xc89/0x1420 [ 140.639900][ T5587] ? __pfx_kthread+0x10/0x10 [ 140.639935][ T5587] ret_from_fork_asm+0x1a/0x30 [ 140.639968][ T5587] [ 140.639975][ T5587] Modules linked in: [ 140.639990][ T5587] ---[ end trace 0000000000000000 ]--- [ 140.640000][ T5587] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 140.640031][ T5587] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 140.640048][ T5587] RSP: 0018:ffffc90004b4f908 EFLAGS: 00010246 [ 140.640065][ T5587] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 140.640078][ T5587] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 140.640093][ T5587] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 140.640106][ T5587] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88803af89b14 [ 140.640121][ T5587] R13: ffff88803af89c28 R14: 0000000000000000 R15: 0000000000000000 [ 140.640135][ T5587] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 140.640152][ T5587] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 140.640167][ T5587] CR2: 000000110c438f62 CR3: 000000002da06000 CR4: 00000000003526f0 [ 140.640202][ T5587] Kernel panic - not syncing: Fatal exception [ 140.640507][ T5587] Kernel Offset: disabled