last executing test programs: 1m43.280001387s ago: executing program 2 (id=24): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0xc, 0x572, 0x1, 0x6, "ff000d00009a468e0cd912098d00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000100)={0xffff, 0xbd, 0x4d63, 0xf1f, 0x5b, "0900000000d794c1"}) 1m43.26050504s ago: executing program 2 (id=25): r0 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x41, 0x1ff) fcntl$setlease(r1, 0x400, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 1m43.148401607s ago: executing program 3 (id=27): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r0, 0x26, &(0x7f0000000040)={0x0, 0x2, 0x7fffffffffffffff, 0x9}) 1m43.085916418s ago: executing program 3 (id=28): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f00000005c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0x0, 0x0}) 1m43.008401538s ago: executing program 3 (id=29): unshare(0x24020400) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0) 1m42.908475842s ago: executing program 3 (id=30): syz_open_dev$usbmon(&(0x7f0000000900), 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 1m42.832236124s ago: executing program 3 (id=31): syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000001082059a0040000102030109026e0003810ab00f080b00020126309e0904000000010130000a24010d0a000700000009040100000102300009040101010102300009050109200104"], 0x0) 1m42.293346764s ago: executing program 2 (id=35): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000480)={{0xb000, 0x1ff8, 0x4, 0x9, 0xfd, 0xe4, 0x40, 0x7, 0x0, 0x2b, 0x16}, {0xeeee0000, 0x3000, 0x3, 0x0, 0x40, 0x5, 0x7d, 0x6, 0x5, 0x3, 0x3, 0xb5}, {0xeeef0000, 0x0, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa8, 0x4, 0x4}, {0xe000, 0xeeee0000, 0x9, 0x6, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0x10000, 0xdddd9000, 0x2, 0x3, 0x3, 0x9, 0xab, 0x80, 0x7, 0x2, 0xdb}, {0x5b002, 0x100000, 0x4, 0x7, 0xb1, 0x9, 0x21, 0x81, 0x80, 0xff, 0x1}, {0x3000, 0x8000000, 0x4, 0x6, 0x2, 0x5, 0x7, 0x9, 0x5, 0x81, 0x1, 0x70}, {0x70000, 0x25000, 0x9, 0x5, 0xf, 0x7, 0xc, 0x34, 0x7, 0xc, 0xb0, 0x9}, {0x10000, 0x1000}, {0x2000, 0x5}, 0x80000031, 0x0, 0x8000000, 0x2024, 0x8, 0x500, 0x3000, [0xf90000000000, 0x4, 0x80, 0xfff]}) 1m42.104204846s ago: executing program 2 (id=38): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@empty, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x9, 0x10000000, 0x1}, {0x0, 0x2, 0x7}, {0x40000, 0xffffffff, 0xae8}, 0x0, 0x3504, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x890) 1m41.966283781s ago: executing program 1 (id=41): pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x2020600) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000100)={{r0}, 0x0, 0x7, 0x8000000000000001}) 1m41.863361861s ago: executing program 2 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000380)={0x2, 0x0, [{0x80000008, 0x3ce6, 0x3, 0x1, 0xfe4, 0x80000001, 0x6}, {0xd, 0x5, 0x2, 0x9, 0x9, 0x9, 0x6229000}]}) 1m41.800273094s ago: executing program 1 (id=44): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x2, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000100)={[{0x88, 0x5, 0x9, 0x2, 0x4, 0x2, 0xe, 0x9d, 0x10, 0x6, 0x4, 0x2, 0x8}, {0x4, 0x6, 0xe, 0x7, 0x7, 0x3, 0x3, 0x2, 0x0, 0x5, 0x10, 0xf, 0x8000000000000001}, {0x806, 0x3, 0x8, 0xa, 0x2, 0x81, 0x8, 0x1, 0xde, 0x4, 0x23, 0x4, 0x7f000}], 0x1ff}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x8, 0x61, 0x200002000001, 0x1, 0x2004c8, 0x0, 0x0, 0x36ae, 0x5, 0x6, 0x3, 0x400000000, 0x6, 0xf73c], 0x80a0000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m41.603764389s ago: executing program 2 (id=45): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d00010000700609040005040300020009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000100)={0x4, 0x7, 0xdfd, 0x6}) 1m41.593373748s ago: executing program 1 (id=47): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x33, 0x0, &(0x7f00000001c0)) 1m41.464480174s ago: executing program 3 (id=49): syz_usb_connect$uac3(0x2, 0x80, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x8e4, 0x17f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x9, 0x20, 0xc, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0xf7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x1, 0xa, 0xfffffffe}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x2b0, 0x5, 0x5, 0xf8, {0xa, 0x25, 0x25, 0x1fd0, 0x7, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x6, 0x39, 0x23, {0xa, 0x25, 0x25, 0x453c, 0x2, 0x4}}}}}}}}]}}, 0x0) 1m41.464366775s ago: executing program 1 (id=50): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) ioctl$EVIOCGLED(r0, 0x40284504, &(0x7f00000000c0)=""/54) 1m41.378979412s ago: executing program 1 (id=53): r0 = signalfd4(0xffffffffffffffff, &(0x7f00000008c0), 0x8, 0x800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r0}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) signalfd4(r0, &(0x7f0000000080), 0x8, 0x0) 1m40.862035633s ago: executing program 0 (id=60): r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20004008, &(0x7f00000000c0)={0xa, 0x4e20, 0x8, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x7b36, 0x4) sendto$inet6(r0, &(0x7f0000000340)="8d", 0x1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001600)=[{{0x0, 0x0, 0x0}, 0x1}, {{&(0x7f0000000000)=@nfc_llcp, 0x80, &(0x7f0000001500)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001440)=""/169, 0xa9}], 0x2, &(0x7f0000001540)=""/156, 0x9c}, 0x4}], 0x2, 0x22043, 0x0) 1m40.804950993s ago: executing program 0 (id=61): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x0, 0xfffffffd}}, 0x10) sendmsg$tipc(r0, &(0x7f00000000c0)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8804}, 0x4) 1m40.700287317s ago: executing program 0 (id=62): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x1, 0x0) write(r0, &(0x7f0000000840)='8', 0x1) 1m40.681383696s ago: executing program 0 (id=63): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/lru_gen\x00', 0x2, 0x172) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r1, 0x0) write(r0, &(0x7f00000004c0)='+ ', 0x2) 1m40.546506986s ago: executing program 0 (id=64): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) lseek(r0, 0x289e0cb9, 0x2) 1m40.440520173s ago: executing program 0 (id=65): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) unlink(0x0) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000880)='tracefs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./tracing/events/enable\x00', 0x19) write(r0, &(0x7f0000000140)='1', 0x1) 1m40.440340957s ago: executing program 1 (id=66): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0xfffffffe) accept4$unix(r1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) 1m12.503123145s ago: executing program 32 (id=45): r0 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000106d043ac500000000000109022d00010000700609040005040300020009"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0xa, 0x62080) ioctl$HIDIOCGCOLLECTIONINFO(r1, 0xc0104811, &(0x7f0000000100)={0x4, 0x7, 0xdfd, 0x6}) 52.527189852s ago: executing program 33 (id=49): syz_usb_connect$uac3(0x2, 0x80, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x8e4, 0x17f, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x9, 0x20, 0xc, {0x8, 0xb, 0x0, 0x1, 0x1, 0x1, 0x30, 0xf7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x1, 0xa, 0xfffffffe}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x2b0, 0x5, 0x5, 0xf8, {0xa, 0x25, 0x25, 0x1fd0, 0x7, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x6, 0x39, 0x23, {0xa, 0x25, 0x25, 0x453c, 0x2, 0x4}}}}}}}}]}}, 0x0) 24.750256871s ago: executing program 34 (id=65): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xfc778000) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) unlink(0x0) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000880)='tracefs\x00', 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./tracing/events/enable\x00', 0x19) write(r0, &(0x7f0000000140)='1', 0x1) 0s ago: executing program 35 (id=66): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0xfffffffe) accept4$unix(r1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.104' (ED25519) to the list of known hosts. [ 63.947981][ T5598] cgroup: Unknown subsys name 'net' [ 64.070354][ T5598] cgroup: Unknown subsys name 'cpuset' [ 64.078739][ T5598] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 65.385640][ T5598] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.518691][ T5622] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.520221][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.521169][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.521763][ T5622] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.522444][ T5622] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.523262][ T5623] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.523491][ T5623] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 67.524160][ T5625] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.525332][ T5623] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.526227][ T5623] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.526554][ T5623] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 67.527571][ T5623] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.537421][ T5622] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.542351][ T5613] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.544398][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 67.552366][ T5626] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.559576][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.562709][ T5626] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 67.563218][ T5626] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 67.576203][ T5626] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.924584][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.925038][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.925126][ T5611] bridge_slave_0: entered allmulticast mode [ 68.926965][ T5611] bridge_slave_0: entered promiscuous mode [ 68.931453][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.931543][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.931882][ T5611] bridge_slave_1: entered allmulticast mode [ 68.933510][ T5611] bridge_slave_1: entered promiscuous mode [ 68.935442][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.935533][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.935631][ T5609] bridge_slave_0: entered allmulticast mode [ 68.937523][ T5609] bridge_slave_0: entered promiscuous mode [ 69.017819][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.017970][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.018041][ T5609] bridge_slave_1: entered allmulticast mode [ 69.018978][ T5609] bridge_slave_1: entered promiscuous mode [ 69.028536][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.028668][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.029023][ T5610] bridge_slave_0: entered allmulticast mode [ 69.030873][ T5610] bridge_slave_0: entered promiscuous mode [ 69.033634][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.033724][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.033825][ T5610] bridge_slave_1: entered allmulticast mode [ 69.035335][ T5610] bridge_slave_1: entered promiscuous mode [ 69.067260][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.105299][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.138158][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.151623][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.167280][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.168830][ T5611] team0: Port device team_slave_0 added [ 69.170827][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.171037][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.171160][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.171261][ T5608] bridge_slave_0: entered allmulticast mode [ 69.172642][ T5608] bridge_slave_0: entered promiscuous mode [ 69.205647][ T5611] team0: Port device team_slave_1 added [ 69.232192][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.232327][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.232417][ T5608] bridge_slave_1: entered allmulticast mode [ 69.233339][ T5608] bridge_slave_1: entered promiscuous mode [ 69.250109][ T5610] team0: Port device team_slave_0 added [ 69.266028][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.266038][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.266050][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.293394][ T5610] team0: Port device team_slave_1 added [ 69.293978][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.293988][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.294008][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.310383][ T5609] team0: Port device team_slave_0 added [ 69.313311][ T5609] team0: Port device team_slave_1 added [ 69.316012][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.355603][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.359927][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.359938][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.359958][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.420558][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.420571][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.420591][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.430989][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.431001][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.431021][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.450326][ T5608] team0: Port device team_slave_0 added [ 69.467449][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.467461][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.467481][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.478883][ T5608] team0: Port device team_slave_1 added [ 69.486980][ T5611] hsr_slave_0: entered promiscuous mode [ 69.488053][ T5611] hsr_slave_1: entered promiscuous mode [ 69.580087][ T5626] Bluetooth: hci1: command tx timeout [ 69.580234][ T5626] Bluetooth: hci0: command tx timeout [ 69.632755][ T5610] hsr_slave_0: entered promiscuous mode [ 69.633378][ T5610] hsr_slave_1: entered promiscuous mode [ 69.633758][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 69.633812][ T5610] Cannot create hsr debugfs directory [ 69.634620][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.634632][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.634671][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.659807][ T54] Bluetooth: hci2: command tx timeout [ 69.659984][ T54] Bluetooth: hci3: command tx timeout [ 69.679705][ T5609] hsr_slave_0: entered promiscuous mode [ 69.680678][ T5609] hsr_slave_1: entered promiscuous mode [ 69.681371][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 69.681387][ T5609] Cannot create hsr debugfs directory [ 69.682694][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.682705][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.682725][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.863825][ T5608] hsr_slave_0: entered promiscuous mode [ 69.864424][ T5608] hsr_slave_1: entered promiscuous mode [ 69.864800][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 69.864816][ T5608] Cannot create hsr debugfs directory [ 70.132804][ T5611] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.149535][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.164509][ T5611] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.176732][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.177507][ T5611] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.181822][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.206194][ T5611] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.212312][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.251999][ T5610] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.266310][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.267046][ T5610] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.270640][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.271216][ T5610] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.274957][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.325325][ T5610] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.334362][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.385518][ T5609] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.395606][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.404241][ T5609] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.413822][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.414650][ T5609] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.419065][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.437962][ T5609] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.441841][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.535535][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.564027][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.578755][ T5608] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.581103][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.582054][ T5608] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.584388][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.603464][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.603564][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.627757][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.627873][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.644051][ T5608] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.654869][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.666029][ T5608] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.668416][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.679128][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.746802][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.779176][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.779231][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.791965][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.809616][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.824180][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.824294][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.864900][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.864992][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.885718][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.885810][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.131498][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.171899][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.185157][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.185257][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.232288][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.232383][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.340527][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.340594][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.464027][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.599547][ T5611] veth0_vlan: entered promiscuous mode [ 71.610248][ T5611] veth1_vlan: entered promiscuous mode [ 71.656267][ T54] Bluetooth: hci1: command tx timeout [ 71.656731][ T5626] Bluetooth: hci0: command tx timeout [ 71.663151][ T5611] veth0_macvtap: entered promiscuous mode [ 71.686172][ T5611] veth1_macvtap: entered promiscuous mode [ 71.734765][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.737631][ T5626] Bluetooth: hci3: command tx timeout [ 71.737657][ T5626] Bluetooth: hci2: command tx timeout [ 71.771797][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.837988][ T1116] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.838373][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.838409][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.838440][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.966315][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.078168][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.078196][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.093851][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.171495][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.171514][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.183078][ T5610] veth0_vlan: entered promiscuous mode [ 72.222253][ T5610] veth1_vlan: entered promiscuous mode [ 72.302534][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.316831][ T5609] veth0_vlan: entered promiscuous mode [ 72.321441][ T5611] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.382351][ T5609] veth1_vlan: entered promiscuous mode [ 72.384929][ T5610] veth0_macvtap: entered promiscuous mode [ 72.431872][ T5610] veth1_macvtap: entered promiscuous mode [ 72.447546][ T5756] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 72.517745][ T5608] veth0_vlan: entered promiscuous mode [ 72.533355][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.535618][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.554898][ T5609] veth0_macvtap: entered promiscuous mode [ 72.562995][ T5608] veth1_vlan: entered promiscuous mode [ 72.571334][ T5609] veth1_macvtap: entered promiscuous mode [ 72.643514][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.684457][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.741317][ T5608] veth0_macvtap: entered promiscuous mode [ 72.751329][ T63] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.751626][ T63] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.765628][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.765646][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.786034][ T45] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.786075][ T45] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.814623][ T5608] veth1_macvtap: entered promiscuous mode [ 72.862409][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.862426][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.870451][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.907816][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.917685][ T63] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.923899][ T1097] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.923937][ T1097] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.923967][ T1097] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.982035][ T51] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.982078][ T51] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.982106][ T51] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.982123][ T51] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.083542][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.083563][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.270303][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.270323][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.441070][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.441089][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.615864][ T1116] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.615884][ T1116] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.738600][ T54] Bluetooth: hci0: command tx timeout [ 73.738633][ T54] Bluetooth: hci1: command tx timeout [ 73.817059][ T5626] Bluetooth: hci2: command tx timeout [ 73.817090][ T5626] Bluetooth: hci3: command tx timeout [ 74.140786][ T9] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 74.313797][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 74.313876][ T9] usb 3-1: New USB device found: idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 74.314895][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 74.322643][ T9] usb 3-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 74.322664][ T9] usb 3-1: Product: syz [ 74.322676][ T9] usb 3-1: Manufacturer: syz [ 74.409353][ T9] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (225a:e1d4) [ 74.409431][ T9] uvcvideo 3-1:1.0: No streaming interface found for terminal 32770. [ 74.577826][ T5706] usb 3-1: USB disconnect, device number 2 [ 74.886625][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 75.041579][ T10] usb 1-1: New USB device found: idVendor=0525, idProduct=a4a1, bcdDevice=0.40 [ 75.043022][ T10] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 75.043085][ T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 75.050640][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.050660][ T10] usb 1-1: Product: syz [ 75.050672][ T10] usb 1-1: Manufacturer: syz [ 75.050684][ T10] usb 1-1: SerialNumber: syz [ 75.077351][ T10] cdc_mbim 1-1:1.0: skipping garbage [ 75.077380][ T10] usb 1-1: selecting invalid altsetting 1 [ 75.299818][ T5814] Bluetooth: MGMT ver 1.23 [ 75.487835][ T10] cdc_mbim 1-1:1.0: failed GET_NTB_PARAMETERS [ 75.487921][ T10] cdc_mbim 1-1:1.0: bind() failure [ 75.542217][ T10] usb 1-1: USB disconnect, device number 2 [ 75.594657][ T5829] workqueue: work func _RNvXs8_NtCsbuTvttuFvbr_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCswPamI0U300_11rust_binder7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ enqueued on deprecated workqueue. Use system_{percpu|dfl}_wq instead. [ 75.642925][ T5829] syz.3.28 (5829) used greatest stack depth: 19248 bytes left [ 75.816420][ T5626] Bluetooth: hci0: command tx timeout [ 75.816465][ T54] Bluetooth: hci1: command tx timeout [ 75.898357][ T5626] Bluetooth: hci2: command tx timeout [ 75.898400][ T54] Bluetooth: hci3: command tx timeout [ 76.125840][ T27] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.275793][ T27] usb 4-1: Using ep0 maxpacket: 16 [ 76.278048][ T27] usb 4-1: New USB device found: idVendor=0582, idProduct=009a, bcdDevice=0.40 [ 76.279065][ T27] usb 4-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 76.279085][ T27] usb 4-1: config 129 has 2 interfaces, different from the descriptor's value: 3 [ 76.281327][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.281347][ T27] usb 4-1: Product: syz [ 76.281359][ T27] usb 4-1: Manufacturer: syz [ 76.281370][ T27] usb 4-1: SerialNumber: syz [ 76.621224][ T27] usb 4-1: Can't get UAC3 power state for id 10 [ 76.637051][ T27] usb 4-1: BAAD SPEAKERPHONE c_chmask mismatch [ 76.829283][ T27] snd-usb-audio 4-1:129.0: probe with driver snd-usb-audio failed with error -22 [ 76.853978][ T27] usb 4-1: USB disconnect, device number 2 [ 76.924479][ T5619] udevd[5619]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:129.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 77.326650][ T5706] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 77.445796][ T27] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 77.475787][ T5706] usb 3-1: Using ep0 maxpacket: 16 [ 77.476826][ T5706] usb 3-1: New USB device found: idVendor=046d, idProduct=c53a, bcdDevice=0.00 [ 77.479171][ T5706] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 77.479212][ T5706] usb 3-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 77.479234][ T5706] usb 3-1: config 0 interface 0 has no altsetting 0 [ 77.479262][ T5706] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.492565][ T5706] usb 3-1: config 0 descriptor?? [ 77.515423][ T5706] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 77.636524][ T27] usb 4-1: New USB device found: idVendor=08e4, idProduct=017f, bcdDevice=0.40 [ 77.639357][ T27] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 1023 [ 77.641728][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.641749][ T27] usb 4-1: Product: syz [ 77.641761][ T27] usb 4-1: Manufacturer: syz [ 77.641774][ T27] usb 4-1: SerialNumber: syz [ 77.996099][ T27] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 78.005172][ T27] usb 4-1: USB disconnect, device number 3 [ 78.055263][ T5864] udevd[5864]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 78.319930][ C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 83.494513][ T32] cfg80211: failed to load regulatory.db [ 104.477283][ T947] usb 3-1: USB disconnect, device number 3 [ 133.043438][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.044874][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 191.562378][ T5622] Bluetooth: hci1: command 0x0406 tx timeout [ 191.563090][ T5622] Bluetooth: hci2: command 0x0406 tx timeout [ 191.563695][ T5622] Bluetooth: hci0: command 0x0406 tx timeout [ 191.602582][ T5622] Bluetooth: hci3: command 0x0406 tx timeout [ 194.572059][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.573509][ T1315] ieee802154 phy1 wpan1: encryption failed: -22 [ 247.989189][ T34] INFO: task kworker/1:4:5614 blocked for more than 143 seconds. [ 247.989273][ T34] Not tainted syzkaller #0 [ 247.989346][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.989427][ T34] task:kworker/1:4 state:D stack:25320 pid:5614 tgid:5614 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 247.989662][ T34] Workqueue: events reg_todo [ 247.989966][ T34] Call Trace: [ 247.990080][ T34] [ 248.193856][ T34] __schedule+0x1b47/0x5c60 [ 248.194351][ T34] ? trace_event_buffer_commit+0x258/0x7a0 [ 248.379894][ T34] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 248.380654][ T34] ? __pfx___schedule+0x10/0x10 [ 248.381117][ T34] ? schedule+0x90/0x2b0 [ 248.381862][ T34] ? schedule+0x90/0x2b0 [ 248.382362][ T34] schedule+0x164/0x2b0 [ 248.382821][ T34] schedule_preempt_disabled+0x13/0x30 [ 248.383044][ T34] __mutex_lock+0x7c4/0x15a0 [ 248.383586][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 248.384059][ T34] ? reg_process_self_managed_hints+0x8d/0x160 [ 248.384636][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 248.384819][ T34] ? reg_process_self_managed_hint+0x1ab/0x4d0 [ 248.384918][ T34] ? __pfx_reg_process_self_managed_hint+0x10/0x10 [ 248.479917][ T34] ? reg_todo+0x8da/0xa40 [ 248.480686][ T34] reg_process_self_managed_hints+0x8d/0x160 [ 248.480969][ T34] reg_todo+0x8df/0xa40 [ 248.518571][ T34] ? process_scheduled_works+0x97a/0x1630 [ 248.518883][ T34] process_scheduled_works+0xc3d/0x1630 [ 248.562245][ T34] ? __pfx_process_scheduled_works+0x10/0x10 [ 248.562848][ T34] ? assign_work+0x3cf/0x5d0 [ 248.613445][ T34] worker_thread+0xa47/0xfb0 [ 248.705046][ T34] kthread+0x38b/0x480 [ 248.705324][ T34] ? __pfx_worker_thread+0x10/0x10 [ 248.705474][ T34] ? __pfx_kthread+0x10/0x10 [ 248.743058][ T34] ret_from_fork+0x514/0xb70 [ 248.743407][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 248.743753][ T34] ? __switch_to+0xc78/0x1410 [ 248.920603][ T34] ? __pfx_kthread+0x10/0x10 [ 248.921045][ T34] ret_from_fork_asm+0x1a/0x30 [ 248.997474][ T34] [ 248.997599][ T34] INFO: task kworker/1:5:5617 blocked for more than 144 seconds. [ 248.997647][ T34] Not tainted syzkaller #0 [ 248.997695][ T34] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 248.997747][ T34] task:kworker/1:5 state:D stack:25768 pid:5617 tgid:5617 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 248.997927][ T34] Workqueue: events_power_efficient crda_timeout_work [ 248.998153][ T34] Call Trace: [ 249.114234][ T34] [ 249.114636][ T34] __schedule+0x1b47/0x5c60 [ 249.114866][ T34] ? trace_event_buffer_commit+0x258/0x7a0 [ 249.148673][ T34] ? __pfx_trace_event_raw_event_lock+0x10/0x10 [ 249.149374][ T34] ? __pfx___schedule+0x10/0x10 [ 249.454594][ T34] ? schedule+0x90/0x2b0 [ 249.498879][ T34] ? schedule+0x90/0x2b0 [ 249.499567][ T34] schedule+0x164/0x2b0 [ 249.499996][ T34] schedule_preempt_disabled+0x13/0x30 [ 249.547249][ T34] __mutex_lock+0x7c4/0x15a0 [ 249.548178][ T34] ? __mutex_lock+0x5cd/0x15a0 [ 249.548492][ T34] ? crda_timeout_work+0x16/0x80 [ 249.548966][ T34] ? __pfx___mutex_lock+0x10/0x10 [ 249.550289][ T34] ? rcu_is_watching+0x16/0xb0 [ 249.550745][ T34] ? process_scheduled_works+0x97a/0x1630 [ 249.550869][ T34] crda_timeout_work+0x16/0x80 [ 249.551027][ T34] process_scheduled_works+0xc3d/0x1630 [ 249.810005][ T34] ? __pfx_process_scheduled_works+0x10/0x10 [ 249.810745][ T34] ? assign_work+0x3cf/0x5d0 [ 249.875290][ T34] worker_thread+0xa47/0xfb0 [ 249.897795][ T34] ? __kthread_parkme+0x71/0x1f0 [ 249.934165][ T34] kthread+0x38b/0x480 [ 249.934599][ T34] ? __pfx_worker_thread+0x10/0x10 [ 249.934812][ T34] ? __pfx_kthread+0x10/0x10 [ 249.935206][ T34] ret_from_fork+0x514/0xb70 [ 249.987128][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 249.987574][ T34] ? __switch_to+0xc78/0x1410 [ 249.988063][ T34] ? __pfx_kthread+0x10/0x10 [ 249.988658][ T34] ret_from_fork_asm+0x1a/0x30 [ 249.990030][ T34] [ 250.246337][ T34] [ 250.246337][ T34] Showing all locks held in the system: [ 250.246463][ T34] locks held by kworker/0:0/9: 2, last CPU#0: [ 250.246575][ T34] #0: ffff88807a735148 ((wq_completion)wg-crypt-wg0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.247447][ T34] #1: ffffc900000e7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.453065][ T34] locks held by kworker/u8:0/12: 4, last CPU#1: [ 250.453156][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.453857][ T34] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.454530][ T34] #2: ffff888068e40800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 250.553572][ T34] #3: ffff8880b853c1a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 250.554468][ T34] locks held by kworker/u8:1/13: 3, on CPU#1: [ 250.726453][ T34] #0: ffff8880262df948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.726872][ T34] #1: ffffc90000127c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.727323][ T34] #2: ffffffff90674ce0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 250.893444][ T34] locks held by khungtaskd/34: 1, last CPU#1: [ 250.893516][ T34] #0: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 250.894112][ T34] locks held by kworker/u8:2/45: 3, last CPU#1: [ 250.894228][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.963849][ T34] #1: ffffc90000b57c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 250.964403][ T34] #2: ffff888068c30800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 250.965216][ T34] locks held by kworker/u8:4/63: 5, last CPU#0: [ 251.105152][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.108943][ T34] #1: ffffc9000204fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.109715][ T34] #2: ffff88807a2e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 251.110205][ T34] #3: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 251.110636][ T34] #4: ffff8880b843c1a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 251.111333][ T34] locks held by kworker/u8:6/1013: 3, last CPU#0: [ 251.111468][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.112238][ T34] #1: ffffc9000526fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.112557][ T34] #2: ffff888032aac258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 251.113245][ T34] locks held by kworker/u8:7/1097: 3, last CPU#1: [ 251.113368][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.114192][ T34] #1: ffffc9000564fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.114479][ T34] #2: ffff888068990800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 251.115026][ T34] locks held by kworker/u8:8/1116: 3, last CPU#1: [ 251.115135][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.341283][ T34] #1: ffffc900056bfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.341866][ T34] #2: ffff888075e23258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 251.476628][ T34] locks held by syslogd/4958: 2, last CPU#1: [ 251.476704][ T34] #0: ffff88803536a7f0 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x1e3/0xd70 [ 251.477316][ T34] #1: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __might_fault+0xaf/0x130 [ 251.478203][ T34] locks held by dhcpcd/5271: 4, last CPU#0: [ 251.478360][ T34] #0: ffffffff8f238430 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 251.478654][ T34] #1: ffff88807f17a800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 251.479175][ T34] #2: ffff88807b71ccc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 251.621359][ T34] #3: ffffffff8f2af8d0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 251.622230][ T34] locks held by kworker/1:3/5342: 3, last CPU#1: [ 251.622391][ T34] #0: ffff88813fe09d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.762313][ T34] #1: ffffc900025a7c40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.762931][ T34] #2: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x1890 [ 251.763833][ T34] locks held by getty/5372: 2, on CPU#1: [ 251.763966][ T34] #0: ffff88803549c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 251.764233][ T34] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 251.764773][ T34] locks held by syz-executor/5608: 1, last CPU#1: [ 251.764886][ T34] #0: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 251.816740][ T34] locks held by kworker/1:4/5614: 4, on CPU#1: [ 251.816791][ T34] #0: ffff88813fe0ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.817224][ T34] #1: ffffc900050b7c40 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.817908][ T34] #2: ffffffff90674ce0 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0xa40 [ 251.818699][ T34] #3: ffff888068c30800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x8d/0x160 [ 251.988495][ T34] locks held by kworker/1:5/5617: 3, on CPU#1: [ 251.988599][ T34] #0: ffff88813fe09d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.989429][ T34] #1: ffffc90005127c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 251.996579][ T34] #2: ffffffff90674ce0 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x80 [ 252.058274][ T34] locks held by syz.0.65/5913: 7, on CPU#1: [ 252.058377][ T34] #0: ffff8880336e55f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 [ 252.059180][ T34] #1: ffff88801bb44460 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 252.106815][ T34] #2: ffffffff8f1cf820 (event_mutex){+.+.}-{4:4}, at: system_enable_write+0x258/0x350 [ 252.151977][ T34] #3: ffffffff8f1be2c0 (tracepoints_mutex){+.+.}-{4:4}, at: tracepoint_probe_register+0x3f/0x90 [ 252.152552][ T34] #4: ffffffff8efe7e30 (cpu_hotplug_lock){++++}-{0:0}, at: __static_call_update+0x9b/0x620 [ 252.187924][ T34] #5: ffffffff8f230300 (static_call_mutex){+.+.}-{4:4}, at: __static_call_update+0xa9/0x620 [ 252.188464][ T34] #6: ffffffff8effeee0 (text_mutex){+.+.}-{4:4}, at: arch_static_call_transform+0x2d/0xc0 [ 252.189277][ T34] locks held by kworker/u8:9/5917: 3, last CPU#0: [ 252.297569][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.298037][ T34] #1: ffffc900058efc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.298760][ T34] #2: ffff888033ede258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 252.383055][ T34] locks held by kworker/u8:11/5920: 3, last CPU#0: [ 252.383152][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.383931][ T34] #1: ffffc90005a5fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.384561][ T34] #2: ffff888033a76258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 [ 252.384945][ T34] locks held by kworker/u8:12/5921: 4, last CPU#0: [ 252.385030][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.662923][ T34] #1: ffffc90005a6fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.663319][ T34] #2: ffff88807a180800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 252.663788][ T34] #3: ffff8880b843c1a0 (&rq->__lock){-.-.}-{2:2}, at: ieee80211_rx_napi+0xd1/0x3d0 [ 252.774861][ T34] locks held by kworker/u8:13/5922: 3, last CPU#0: [ 252.774953][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.989106][ T34] #1: ffffc90005a8fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 252.989427][ T34] #2: ffff888068a80800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 252.990001][ T34] locks held by kworker/u8:14/5923: 4, last CPU#1: [ 252.990113][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.112018][ T34] #1: ffffc9000592fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.112643][ T34] #2: ffff888068cc0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 253.113540][ T34] #3: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 253.113812][ T34] locks held by kworker/u8:15/5924: 3, last CPU#1: [ 253.113878][ T34] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.114449][ T34] #1: ffffc900059cfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.305516][ T34] #2: ffff888068d50800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 253.306449][ T34] locks held by kworker/u8:16/5925: 2, last CPU#0: [ 253.306586][ T34] #0: ffff888031f1b948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.307089][ T34] #1: ffffc9000587fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.307522][ T34] locks held by syz-executor/5931: 4, last CPU#0: [ 253.307613][ T34] #0: ffffffff8f238430 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 253.350982][ T34] #1: ffff888075d1a800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 253.351705][ T34] #2: ffff88807e9c0340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 253.352408][ T34] #3: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 253.398875][ T34] locks held by kworker/1:8/5934: 3, last CPU#1: [ 253.398959][ T34] #0: ffff88813fe09d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.399635][ T34] #1: ffffc900059efc40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.400315][ T34] #2: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x1890 [ 253.400625][ T34] locks held by syz-executor/5937: 1, last CPU#0: [ 253.400698][ T34] #0: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __page_table_check_zero+0x6c/0x430 [ 253.458864][ T34] locks held by syz-executor/5940: 2, last CPU#0: [ 253.458942][ T34] #0: ffff888075d1f180 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 [ 253.459591][ T34] #1: ffffffff8f15c2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 253.606744][ T34] locks held by kworker/u8:17/5943: 3, last CPU#0: [ 253.606845][ T34] #0: ffff88801c29d948 ((wq_completion)vmap_drain){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.607115][ T34] #1: ffffc90005bafc40 (drain_vmap_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 253.607655][ T34] #2: ffffffff8f28e3a0 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 [ 253.615939][ T34] locks held by dhcpcd/5949: 2, on CPU#0: [ 253.616057][ T34] #0: ffff888075a67b00 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 253.758740][ T34] #1: ffffffff8f1628e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 [ 253.759986][ T34] [ 253.760122][ T34] ============================================= [ 253.760122][ T34] [ 253.760266][ T34] NMI backtrace for cpu 0 [ 253.760382][ T34] CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 253.760460][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.760479][ T34] Call Trace: [ 253.760515][ T34] [ 253.760566][ T34] dump_stack_lvl+0xe8/0x150 [ 253.760837][ T34] nmi_cpu_backtrace+0x274/0x2d0 [ 253.761108][ T34] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 253.761662][ T34] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 253.761876][ T34] sys_info+0x135/0x170 [ 253.762023][ T34] watchdog+0x1058/0x10d0 [ 253.762980][ T34] ? watchdog+0x209/0x10d0 [ 253.763531][ T34] kthread+0x38b/0x480 [ 253.763964][ T34] ? __pfx_watchdog+0x10/0x10 [ 253.764135][ T34] ? __pfx_kthread+0x10/0x10 [ 253.764357][ T34] ret_from_fork+0x514/0xb70 [ 253.764752][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 253.765112][ T34] ? __switch_to+0xc78/0x1410 [ 253.765577][ T34] ? __pfx_kthread+0x10/0x10 [ 253.765843][ T34] ret_from_fork_asm+0x1a/0x30 [ 253.767175][ T34] [ 253.851665][ T34] Sending NMI from CPU 0 to CPUs 1: [ 253.851838][ C1] NMI backtrace for cpu 1 [ 253.851913][ C1] CPU: 1 UID: 0 PID: 16 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) [ 253.851995][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 253.852071][ C1] RIP: 0010:io_serial_in+0x77/0xc0 [ 253.852253][ C1] Code: e8 7e 9d 46 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 cf 8d b8 fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 44 89 f9 80 e1 07 [ 253.852303][ C1] RSP: 0018:ffffc900001578b8 EFLAGS: 00000002 [ 253.852336][ C1] RAX: 1ffffffff363c000 RBX: 00000000000003fd RCX: 0000000000000000 [ 253.852360][ C1] RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020 [ 253.852384][ C1] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 253.852411][ C1] R10: dffffc0000000000 R11: ffffffff85826670 R12: dffffc0000000000 [ 253.852441][ C1] R13: 0000000000000000 R14: ffffffff9b1e00c0 R15: 0000000000000000 [ 253.852472][ C1] FS: 0000000000000000(0000) GS:ffff88812472e000(0000) knlGS:0000000000000000 [ 253.852506][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.852541][ C1] CR2: 0000555df66224b0 CR3: 00000000797c0000 CR4: 00000000003526f0 [ 253.852582][ C1] Call Trace: [ 253.852634][ C1] [ 253.852858][ C1] wait_for_lsr+0x184/0x2f0 [ 253.853368][ C1] __serial8250_console_fifo_write+0xcd/0x3e0 [ 253.854120][ C1] serial8250_console_write+0xaa1/0x1200 [ 253.854387][ C1] ? ring_buffer_unlock_commit+0x51d/0x6c0 [ 253.854826][ C1] ? __pfx_serial8250_console_write+0x10/0x10 [ 253.855002][ C1] ? ring_buffer_event_data+0x94/0x100 [ 253.855475][ C1] ? trace_event_buffer_commit+0x258/0x7a0 [ 253.856246][ C1] nbcon_emit_next_record+0xef5/0x1a90 [ 253.857202][ C1] ? __pfx_nbcon_emit_next_record+0x10/0x10 [ 253.857816][ C1] ? nbcon_context_try_acquire+0x819/0xbd0 [ 253.858986][ C1] ? _raw_spin_lock_irqsave+0x4c/0x60 [ 253.859352][ C1] nbcon_kthread_func+0x6d9/0x8d0 [ 253.860123][ C1] ? nbcon_kthread_func+0x163/0x8d0 [ 253.860242][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 253.861039][ C1] ? __kthread_parkme+0x71/0x1f0 [ 253.861331][ C1] ? __kthread_parkme+0x199/0x1f0 [ 253.861877][ C1] kthread+0x38b/0x480 [ 253.862279][ C1] ? __pfx_nbcon_kthread_func+0x10/0x10 [ 253.862436][ C1] ? __pfx_kthread+0x10/0x10 [ 253.862595][ C1] ret_from_fork+0x514/0xb70 [ 253.863006][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 253.863364][ C1] ? __switch_to+0xc78/0x1410 [ 253.863740][ C1] ? __pfx_kthread+0x10/0x10 [ 253.864021][ C1] ret_from_fork_asm+0x1a/0x30 [ 253.865289][ C1] [ 254.459014][ T34] Kernel panic - not syncing: hung_task: blocked tasks [ 254.465987][ T34] CPU: 1 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 254.475169][ T34] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 254.485295][ T34] Call Trace: [ 254.488755][ T34] [ 254.491701][ T34] vpanic+0x26f/0x710 [ 254.495939][ T34] panic+0xc5/0xd0 [ 254.499889][ T34] ? __pfx_panic+0x10/0x10 [ 254.504418][ T34] ? preempt_schedule_common+0x7f/0xd0 [ 254.510243][ T34] ? preempt_schedule_thunk+0x16/0x40 [ 254.515882][ T34] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 254.522259][ T34] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 254.528949][ T34] watchdog+0x10cc/0x10d0 [ 254.533903][ T34] ? watchdog+0x209/0x10d0 [ 254.539216][ T34] kthread+0x38b/0x480 [ 254.543395][ T34] ? __pfx_watchdog+0x10/0x10 [ 254.548129][ T34] ? __pfx_kthread+0x10/0x10 [ 254.553059][ T34] ret_from_fork+0x514/0xb70 [ 254.558293][ T34] ? __pfx_ret_from_fork+0x10/0x10 [ 254.563488][ T34] ? __switch_to+0xc78/0x1410 [ 254.568530][ T34] ? __pfx_kthread+0x10/0x10 [ 254.573593][ T34] ret_from_fork_asm+0x1a/0x30 [ 254.579731][ T34] [ 254.583141][ T34] Kernel Offset: disabled [ 254.587494][ T34] Rebooting in 86400 seconds..