last executing test programs: 4.136938178s ago: executing program 2 (id=26): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPCONNADD(r1, 0x400442c8, &(0x7f0000000200)={r0, 0x0, 0x6}) 3.789439127s ago: executing program 2 (id=28): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000380), 0x149842, 0x0) write$dsp(r0, &(0x7f0000000b80)="eb67b6", 0x3) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r0, 0x0) close(r0) 2.927832499s ago: executing program 3 (id=31): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {@in6=@loopback, 0x0, 0x2b}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@loopback}]}, 0x138}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, {{@in6=@loopback, 0x0, 0x2b}, 0xa, @in6=@loopback, 0x0, 0x2}}, 0xe8) sendto$inet6(r1, &(0x7f0000000600)="abcdef123456", 0x6, 0x0, &(0x7f0000000700)={0xa, 0x1234, 0x0, @loopback}, 0x1c) 2.882327597s ago: executing program 2 (id=32): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000140)=0xfffffff4, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x97f, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000080)) 2.785456141s ago: executing program 3 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000600)='driver_override\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='at', 0x2) 2.694639787s ago: executing program 3 (id=34): syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000034709d405f0530c6acb601020301090212"], 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r1, @ANYBLOB="290e29bd7000fbdbdf252700000005003100030000001400300053e0e85290ceb080fb816d3cdadf198b0a0001007770616e31000000240032"], 0xd4}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) 1.857975644s ago: executing program 2 (id=41): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000040)={0x1f, @none}, 0x8) listen(r0, 0x1) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000080)=0x1, 0x4) 1.679829961s ago: executing program 0 (id=43): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_DEBUGREGS(r2, 0x4080aea2, &(0x7f0000000100)={[0x2b000, 0x200000, 0xfec00000, 0x5000], 0x9, 0xb8}) 1.627404274s ago: executing program 1 (id=44): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) listen(r0, 0x9) listen(r0, 0x0) 1.593527323s ago: executing program 2 (id=45): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000005c0)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000080)="09000000e70014000000d97bfbf788a88530470ef9cf12392158e4cc3baa88a8", 0x20, 0x40080c5, &(0x7f0000000100)={0x11, 0x8100, r1, 0x1, 0x8, 0x6, @remote}, 0x14) 1.433285571s ago: executing program 1 (id=46): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(r0, &(0x7f0000000400)="2ae0e710", 0x4, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x33, &(0x7f0000000040)=0x6, 0x4) recvmmsg(r0, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x10162, 0x0) 1.425835883s ago: executing program 2 (id=47): r0 = syz_usb_connect(0x5, 0x46, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000e75fcc08c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300021207c109050c04400006030f07059acbf5"], 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8, 0x32, 0xffffffffffffffff, 0x6931b000) write$char_usb(r1, &(0x7f0000000000)="93", 0xf5) 1.423147369s ago: executing program 0 (id=48): r0 = socket(0x10, 0x803, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001d80)="900736ffd7fb87465963b0d3522d82eab665c2832180d084a2b466cc4ea717ab45c96aea10a8c013fdd2a867d155cff2cc400602ee3af3f80c92a078afe315445c352d1695da6c390258ae2e7efc2c02fc161e1b5e271d98a04e5d977b6ca58c3c61f2e559489bcad21796d816c99b330ad4f7f0ff31a95635d4e18731539a4485d53546337f6453f17004a64899aa1c42bceea63fb4bb4a43deb4de7ddf18f773c836c304b2f2edf9c37e2859da3e0f28a1db43866032877a5b3218da48534a923d2b864964cf53bc0156359c23b20c4b5ed905fb9b6dd9178e6110aa63b24a24c71ff171dbf7bb65c26a4f3e3b960e1fe4e5c38c458170e7e5d38a2fa77262a334b70da13159214b59e99043f2d45738cfe619d4e54d9d9d52faad4185dc1461e3de1d4a8e2bac117f496b9198352ed12b367de480013f50733fcce28686f100f105d037fe1d3c387164fd3bb6d9f758e8c35de274cc824e0ef8a4ec4d740cb37a646300158bd9f137d0712242f3ff01641eedbf6207cc3e7b9314e8cd44581f210ae9980710a38a426305d71a732645e48a5faf121177bb16c0253dbba4b6495b2fdf147bf3557edbf1134ad8135eddb75535613f0c13e995f458d7117b7b4484be02dda974d1f894074f5258bc3416e61b41949c2bca7746dd9edc6fc1d0b9305c7ee799be795a7df68f76872046beb4e1ff6d5a62a7177902fdb74cb5d1e104b8852fd4db5ced74b73b68eb138695110452ddf5def0a6961d7010d1b170391e5897f32102ebade663ec2804708f63becf2b7595461d10062df096794e1cb4232cda841f3a86a6d5e50fe8db194bfb3721c9bc3e29b176f3554f1010776afe8fe89b5869bb25e5ffe24ad26f382b7176fd85e3d19a2d8e58031e1939ed39c96c4f2f967f75049ee7e36469b8c010992623f8248cff1c362bbb12e8ed5fd05b72fb1f391b4c13d06a453f2169bea0cc67768e06311494a3dc736c80ef644fc0d09dae7dfc09de2b7f6d0b21734486503b74bd3387ffa9a5da1b39a2ec9c410a4b2d4ec1f8ef1d3a7ced2637878b038da8d69b32a3e402580e5b746f8e7f930ff478e6b15f475b6b96a25cd8f55bdd73bc483ee5625b56b81f8d9183bc36a5c4c0974db6ad499bf1fcccb994c3defccf1324543260fb1a790ef60d50da4f955783af41066d51abdf7a566c2b2c876e0199e7b920068f226c7a5f14b65b3dbd7fb244c3fb1660740b5f849942e468af39e5a9bc80a6075878dfac23d0ae839a0e509448130e7dabadd7c494b64e67be6400ea34b097bfc578deb3c5ebefa9c1019ef65bf641c9388d9b29f6c9c2e5b8b81fcfdd94059d9a21c80f318d9675721a31ca77a4920b06cb744e96ae74ef66b4dfbe5d1085c9485abf9356d966cb63a75a250dc4432b89ec09dff3531613e12694abdd61d270ab34fba12ae1db3ed45fbc87eb1725f962de4922a64c82ed5d4b652ad926be7330f15fee7a6d53719f6231be26e7593454eabf6fdfe940f04c8cdf022ce9e278c0e2ce9aa9285594972d2b910cedf1d956976f9e6d9571210e4939821c9b68146925e2780db8e1fe6872ba1e178dfb627d9623b5c700cae1d3ce830422b9d906060b28d0956af355a2ce927c9cde8391b43fdbccd428403ee758de7c09de5a2c8eb2dac85a0e056b1ce291da6e54ea1e669b5eee9ca1043aa4f92368b39920f23f2ce3ea3906412de447a0ba28474f2b839a0413e1a0c5c1e7e818b6ae483fbf9a5fcf9367cf9badb8d2040e54dd868a672f3d24fc0e9a77648acb524999c46061b5a71cc8e0b3e66e5421b4e4f8ade64015793ac3949f7c0a3bd64b8e1d2bb99d3e51b5a295b1d2ae2de914a8d6309d9faf5f6b10edb2d9c1dad7eef2ade703d92f06f811cc8682fb98ba2ec324d9ffb23ccff4d231b459214004c7c3afd1f43265f3e40dfc15053103c220347ce2c480ffc73e500314bf7125baf8047ae9521a9c23b53983366fa69466d0bbd00374f703d8e1645849f024b5f2e6affcd99d0ac335e91daf78d5966b081f82762f050b090847f48696736db6ca4afa74e40c8be0fa72a4f8dfc1ba573ee763c9f995fe9fb17c2d1e6ef167c9f15d3bce4ea8a4634628e38f2460d0387c60cabdc6eb6c7223644ab5375a12b8bc39beec9d4c0346e3030fecb85b78038026498a62fdeefcde9de58bc66b9f8e23", 0x612}], 0x1}, 0x84) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x38a}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.255250579s ago: executing program 1 (id=49): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000140)={0xa, 0x4e24, 0x3, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)=' ', 0x1}], 0x1}, 0x4048043) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000080)={0x0, 0xbfda, 0x20}, &(0x7f0000000180)=0xc) 1.213841559s ago: executing program 0 (id=50): r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000400)={0xf0f01f}) r1 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x40) ioctl$VIDIOC_CROPCAP(r1, 0xc02c563a, &(0x7f0000000080)={0x9, {0x6, 0x7, 0x101, 0xffffffe1}, {0x8, 0x7, 0x8, 0x7ff}, {0x60ed}}) 1.163224164s ago: executing program 3 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/pci/devices/0000:00:03.0/resource0\x00', 0x1, 0x10) write(r0, &(0x7f00000004c0)='au', 0x2) 1.050478604s ago: executing program 0 (id=52): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000000)={0x2, 0x3}, 0x2) 923.849569ms ago: executing program 3 (id=53): socket$kcm(0x2, 0xa, 0x2) socket$kcm(0x2, 0xa, 0x2) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') preadv(r0, &(0x7f0000000640)=[{&(0x7f0000000480)=""/179, 0xb3}], 0x1, 0x4f, 0x0) 659.091063ms ago: executing program 3 (id=54): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000009c0)={0x1c, &(0x7f0000000a00)=ANY=[], 0x0, 0x0}) 504.492526ms ago: executing program 1 (id=55): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') 397.244647ms ago: executing program 1 (id=56): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x66) 289.728755ms ago: executing program 0 (id=57): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x4b564d03, 0x0, 0x800000001}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 193.873179ms ago: executing program 1 (id=58): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000380)={0x7b36}, 0x30, 0x0) landlock_restrict_self(r1, 0xe) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, 0x0) 0s ago: executing program 0 (id=59): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000140)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000000)='N', 0x1}], 0x1, 0x0, 0x0, 0xc04c000}, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={0x0, 0xd8f}, &(0x7f00000001c0)=0x8) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. [ 80.350520][ T5603] cgroup: Unknown subsys name 'net' [ 80.485828][ T5603] cgroup: Unknown subsys name 'cpuset' [ 80.489242][ T5603] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.162836][ T5603] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.505338][ T5616] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.506774][ T5616] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.507301][ T5616] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.508403][ T5616] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.509051][ T5616] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.587181][ T4931] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.588711][ T4931] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 84.589260][ T4931] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 84.590513][ T4931] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.591599][ T4931] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.646640][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 84.649890][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.650884][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.659826][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.682061][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.684012][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.701636][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.704947][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.711463][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.719125][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.287776][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.287876][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.288007][ T5613] bridge_slave_0: entered allmulticast mode [ 86.289948][ T5613] bridge_slave_0: entered promiscuous mode [ 86.323819][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.323938][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.324216][ T5617] bridge_slave_0: entered allmulticast mode [ 86.325623][ T5617] bridge_slave_0: entered promiscuous mode [ 86.333892][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.334177][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.334482][ T5617] bridge_slave_1: entered allmulticast mode [ 86.339537][ T5617] bridge_slave_1: entered promiscuous mode [ 86.383384][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.383530][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.383712][ T5620] bridge_slave_0: entered allmulticast mode [ 86.385107][ T5620] bridge_slave_0: entered promiscuous mode [ 86.395475][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.395755][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.399364][ T5613] bridge_slave_1: entered allmulticast mode [ 86.407877][ T5613] bridge_slave_1: entered promiscuous mode [ 86.455868][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.456066][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.456165][ T5620] bridge_slave_1: entered allmulticast mode [ 86.457669][ T5620] bridge_slave_1: entered promiscuous mode [ 86.533638][ T5622] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.533747][ T5622] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.534152][ T5622] bridge_slave_0: entered allmulticast mode [ 86.535758][ T5622] bridge_slave_0: entered promiscuous mode [ 86.541294][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.587402][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.588162][ T5622] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.588235][ T5622] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.588330][ T5622] bridge_slave_1: entered allmulticast mode [ 86.589977][ T5622] bridge_slave_1: entered promiscuous mode [ 86.593919][ T52] Bluetooth: hci0: command tx timeout [ 86.640656][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.645702][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.658257][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.662044][ T52] Bluetooth: hci1: command tx timeout [ 86.711711][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.735184][ T5622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.767306][ T5613] team0: Port device team_slave_0 added [ 86.770094][ T5622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.772266][ T5617] team0: Port device team_slave_0 added [ 86.800611][ T5613] team0: Port device team_slave_1 added [ 86.819693][ T5617] team0: Port device team_slave_1 added [ 86.821493][ T5620] team0: Port device team_slave_0 added [ 86.833617][ T5616] Bluetooth: hci2: command tx timeout [ 86.834085][ T5616] Bluetooth: hci3: command tx timeout [ 86.887769][ T5622] team0: Port device team_slave_0 added [ 86.920867][ T5620] team0: Port device team_slave_1 added [ 86.921862][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.925866][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.925990][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.939373][ T5622] team0: Port device team_slave_1 added [ 86.978953][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.978970][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.978997][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.054541][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.054561][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.054588][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.121699][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.121718][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.121745][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.144475][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.144525][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.144598][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.149555][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.149595][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.149663][ T5622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.154428][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.154455][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.154529][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.299836][ T5622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.299887][ T5622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.299962][ T5622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.390842][ T5613] hsr_slave_0: entered promiscuous mode [ 87.393904][ T5613] hsr_slave_1: entered promiscuous mode [ 87.464542][ T5620] hsr_slave_0: entered promiscuous mode [ 87.465656][ T5620] hsr_slave_1: entered promiscuous mode [ 87.466513][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 87.466621][ T5620] Cannot create hsr debugfs directory [ 87.525946][ T5617] hsr_slave_0: entered promiscuous mode [ 87.527101][ T5617] hsr_slave_1: entered promiscuous mode [ 87.527844][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 87.527863][ T5617] Cannot create hsr debugfs directory [ 87.614817][ T5622] hsr_slave_0: entered promiscuous mode [ 87.615577][ T5622] hsr_slave_1: entered promiscuous mode [ 87.616104][ T5622] debugfs: 'hsr0' already exists in 'hsr' [ 87.616126][ T5622] Cannot create hsr debugfs directory [ 88.069149][ T5613] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.087400][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.089128][ T5613] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.109380][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.110757][ T5613] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.128591][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.145438][ T5613] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.149418][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.219721][ T5620] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.230653][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.231504][ T5620] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.248506][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.260041][ T5620] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.270423][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.279655][ T5620] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.291096][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.409143][ T5617] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.426735][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.429469][ T5617] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.446960][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.447857][ T5617] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.451342][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.484099][ T5617] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.487343][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.590792][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.599678][ T5622] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.611813][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.626315][ T5622] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.630420][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.631035][ T5622] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.657776][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.658656][ T5622] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.663412][ T52] Bluetooth: hci0: command tx timeout [ 88.664639][ T5622] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.724399][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.742462][ T52] Bluetooth: hci1: command tx timeout [ 88.759827][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.759951][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.802340][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.808355][ T1158] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.808429][ T1158] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.902834][ T4931] Bluetooth: hci2: command tx timeout [ 88.902922][ T52] Bluetooth: hci3: command tx timeout [ 88.904755][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.935952][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.936023][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.966179][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.966271][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.006275][ T5613] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.024163][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.129863][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.145136][ T5622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.178007][ T1158] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.178118][ T1158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.220429][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.220542][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.256814][ T5622] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.286696][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.286812][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.331394][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.331801][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.270126][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.308072][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.416105][ T5613] veth0_vlan: entered promiscuous mode [ 90.476565][ T5613] veth1_vlan: entered promiscuous mode [ 90.499462][ T5620] veth0_vlan: entered promiscuous mode [ 90.522983][ T5622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.527240][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.548731][ T5620] veth1_vlan: entered promiscuous mode [ 90.592587][ T5613] veth0_macvtap: entered promiscuous mode [ 90.622451][ T5613] veth1_macvtap: entered promiscuous mode [ 90.630579][ T5620] veth0_macvtap: entered promiscuous mode [ 90.664075][ T5620] veth1_macvtap: entered promiscuous mode [ 90.708155][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.710266][ T5617] veth0_vlan: entered promiscuous mode [ 90.730139][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.742268][ T52] Bluetooth: hci0: command tx timeout [ 90.742313][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.780289][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.785066][ T5617] veth1_vlan: entered promiscuous mode [ 90.804256][ T1120] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.805404][ T1120] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.808256][ T5622] veth0_vlan: entered promiscuous mode [ 90.836309][ T52] Bluetooth: hci1: command tx timeout [ 90.856548][ T5622] veth1_vlan: entered promiscuous mode [ 90.873813][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.874552][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.904682][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.905382][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.982525][ T4931] Bluetooth: hci2: command tx timeout [ 90.982814][ T52] Bluetooth: hci3: command tx timeout [ 91.005882][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.006521][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.017680][ T5617] veth0_macvtap: entered promiscuous mode [ 91.071532][ T5617] veth1_macvtap: entered promiscuous mode [ 91.117135][ T5622] veth0_macvtap: entered promiscuous mode [ 91.121011][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.121033][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.158800][ T1158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.158820][ T1158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.206265][ T5622] veth1_macvtap: entered promiscuous mode [ 91.227045][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.227062][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.259056][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.283287][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.283310][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.312149][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.343956][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.374227][ T5622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.481270][ T5620] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.533072][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.533954][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.533971][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.582271][ T41] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583152][ T41] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583197][ T41] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583236][ T41] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583275][ T41] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583313][ T41] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.583352][ T41] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.721202][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.721224][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.858806][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.858831][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.917523][ T5769] input: syz0 as /devices/virtual/input/input5 [ 91.949651][ T10] cfg80211: failed to load regulatory.db [ 91.986409][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.986432][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.272759][ T5778] FAULT_INJECTION: forcing a failure. [ 92.272759][ T5778] name failslab, interval 1, probability 0, space 0, times 1 [ 92.272807][ T5778] CPU: 0 UID: 0 PID: 5778 Comm: syz.3.6 Not tainted syzkaller #0 PREEMPT(full) [ 92.272834][ T5778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.272856][ T5778] Call Trace: [ 92.272869][ T5778] [ 92.272879][ T5778] dump_stack_lvl+0xe8/0x150 [ 92.272925][ T5778] should_fail_ex+0x3eb/0x540 [ 92.272962][ T5778] should_failslab+0xa8/0x100 [ 92.272991][ T5778] __kvmalloc_node_noprof+0x171/0x820 [ 92.273032][ T5778] ? newary+0x142/0xad0 [ 92.273078][ T5778] ? newary+0x142/0xad0 [ 92.273118][ T5778] newary+0x142/0xad0 [ 92.273160][ T5778] ipcget+0x1db/0xf20 [ 92.273186][ T5778] ? do_futex+0x3e7/0x4e0 [ 92.273215][ T5778] ? __pfx_do_futex+0x10/0x10 [ 92.273240][ T5778] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 92.273264][ T5778] ? __pfx_ipcget+0x10/0x10 [ 92.273294][ T5778] ? __se_sys_futex+0x3a8/0x450 [ 92.273323][ T5778] __x64_sys_semget+0x1aa/0x210 [ 92.273364][ T5778] ? __pfx___x64_sys_semget+0x10/0x10 [ 92.273410][ T5778] do_syscall_64+0x166/0x520 [ 92.273430][ T5778] ? trace_irq_disable+0x3b/0x140 [ 92.273463][ T5778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.273486][ T5778] ? clear_bhb_loop+0x70/0xc0 [ 92.273514][ T5778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.273537][ T5778] RIP: 0033:0x7f35c3d9e159 [ 92.273564][ T5778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.273583][ T5778] RSP: 002b:00007f35c4d24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000040 [ 92.273613][ T5778] RAX: ffffffffffffffda RBX: 00007f35c4025fa0 RCX: 00007f35c3d9e159 [ 92.273630][ T5778] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000000 [ 92.273644][ T5778] RBP: 00007f35c3e3503b R08: 0000000000000000 R09: 0000000000000000 [ 92.273658][ T5778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.273671][ T5778] R13: 00007f35c4026038 R14: 00007f35c4025fa0 R15: 00007ffe52c83dc8 [ 92.273706][ T5778] [ 92.656910][ T5782] syz.1.7 uses obsolete (PF_INET,SOCK_PACKET) [ 92.827748][ T52] Bluetooth: hci0: command tx timeout [ 92.874557][ T5623] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 92.904034][ T52] Bluetooth: hci1: command tx timeout [ 93.024318][ T5623] usb 1-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 93.027043][ T5623] usb 1-1: config 1 has an invalid interface number: 3 but max is 0 [ 93.027071][ T5623] usb 1-1: config 1 has no interface number 0 [ 93.058467][ T5623] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.058501][ T5623] usb 1-1: Product: syz [ 93.058514][ T5623] usb 1-1: Manufacturer: syz [ 93.058529][ T5623] usb 1-1: SerialNumber: syz [ 93.062782][ T4931] Bluetooth: hci2: command tx timeout [ 93.062832][ T52] Bluetooth: hci3: command tx timeout [ 93.109296][ T5623] usb 1-1: 3:1 : does not exist [ 93.109323][ T5623] usb 1-1: 3:2 : does not exist [ 93.176658][ T5795] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.332160][ T5623] usb 1-1: USB disconnect, device number 2 [ 93.460657][ T5628] udevd[5628]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.3/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 93.852784][ T5348] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 93.886019][ T5822] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0, syncid = 1, id = 0 [ 94.002206][ T5348] usb 4-1: Using ep0 maxpacket: 16 [ 94.003810][ T5348] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 94.005893][ T5348] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.005926][ T5348] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 94.005965][ T5348] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 94.006010][ T5348] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.091019][ T5348] usb 4-1: config 0 descriptor?? [ 94.352758][ T5837] capability: warning: `syz.2.23' uses deprecated v2 capabilities in a way that may be insecure [ 94.382777][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 94.532084][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 94.534484][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=c215, bcdDevice= 0.00 [ 94.538936][ T10] usb 2-1: config 0 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 94.538970][ T10] usb 2-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 94.538997][ T10] usb 2-1: config 0 interface 0 has no altsetting 0 [ 94.539034][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.573949][ T10] usb 2-1: config 0 descriptor?? [ 94.636822][ T5348] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 94.636863][ T5348] microsoft 0003:045E:07DA.0001: ignoring exceeding usage max [ 94.710405][ T5348] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0001/input/input6 [ 94.860011][ T5348] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 95.014992][ T5348] usb 4-1: USB disconnect, device number 2 [ 95.169776][ T10] input: HID 046d:c215 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:046D:C215.0002/input/input7 [ 95.334287][ T10] logitech 0003:046D:C215.0002: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 046d:c215] on usb-dummy_hcd.1-1/input0 [ 95.338102][ T5855] fido_id[5855]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 95.379759][ T10] usb 2-1: USB disconnect, device number 2 [ 95.761614][ T5868] fido_id[5868]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 95.813594][ T5873] netlink: 52 bytes leftover after parsing attributes in process `syz.3.31'. [ 96.304022][ T5623] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 96.505762][ T5623] usb 4-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 96.508554][ T5623] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 96.508590][ T5623] usb 4-1: config 0 has no interfaces? [ 96.510802][ T5623] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.510826][ T5623] usb 4-1: Product: syz [ 96.510841][ T5623] usb 4-1: Manufacturer: syz [ 96.510856][ T5623] usb 4-1: SerialNumber: syz [ 96.577641][ T5623] usb 4-1: config 0 descriptor?? [ 96.830872][ T5882] netlink: 116 bytes leftover after parsing attributes in process `syz.3.34'. [ 96.861589][ T10] usb 4-1: USB disconnect, device number 3 [ 97.563490][ T5348] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.717087][ T5348] usb 3-1: Using ep0 maxpacket: 8 [ 97.719292][ T5348] usb 3-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 97.720497][ T5348] usb 3-1: config 0 has an invalid interface number: 186 but max is 0 [ 97.720523][ T5348] usb 3-1: config 0 has no interface number 0 [ 97.720563][ T5348] usb 3-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 97.720586][ T5348] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8 [ 97.720617][ T5348] usb 3-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 97.720643][ T5348] usb 3-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 97.720670][ T5348] usb 3-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 97.768287][ T5348] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.768368][ T5348] usb 3-1: Product: syz [ 97.768411][ T5348] usb 3-1: Manufacturer: syz [ 97.768453][ T5348] usb 3-1: SerialNumber: syz [ 97.865463][ T5348] usb 3-1: config 0 descriptor?? [ 98.111614][ T5348] iowarrior 3-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0 [ 98.283091][ T30] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 98.315829][ T5765] usb 3-1: USB disconnect, device number 2 [ 98.443512][ T30] usb 4-1: Using ep0 maxpacket: 16 [ 98.447020][ T30] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 98.448366][ T30] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 98.448397][ T30] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 98.492998][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.493027][ T30] usb 4-1: Product: syz [ 98.493044][ T30] usb 4-1: Manufacturer: syz [ 98.493060][ T30] usb 4-1: SerialNumber: syz [ 98.498612][ T30] usb 4-1: config 0 descriptor?? [ 98.535518][ T30] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 98.535558][ T30] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 98.650536][ T5962] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 98.653245][ T5962] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 98.708516][ T5962] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 98.721127][ T5962] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 98.721262][ T5962] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 98.739277][ T5962] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 98.755367][ T5962] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 98.756192][ T5962] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 98.772669][ T5962] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 98.778232][ T5962] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 98.778360][ T5962] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 98.854016][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 98.865977][ T5848] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 98.874435][ T5848] CPU: 0 UID: 0 PID: 5848 Comm: kbnepd bnep0 Not tainted syzkaller #0 PREEMPT(full) [ 98.883937][ T5848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 98.894035][ T5848] RIP: 0010:klist_del+0x49/0x110 [ 98.899030][ T5848] Code: f5 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 89 77 4b f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 6b 77 4b f6 4d 8b 7e 58 4c 89 f7 e8 af 5d [ 98.918674][ T5848] RSP: 0018:ffffc9000502f848 EFLAGS: 00010202 [ 98.924781][ T5848] RAX: 000000000000000b RBX: ffff88803180cc60 RCX: ffff88807fe60000 [ 98.932788][ T5848] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 98.940793][ T5848] RBP: ffffc9000502f970 R08: ffff8880759292d3 R09: 1ffff1100eb2525a [ 98.948799][ T5848] R10: dffffc0000000000 R11: ffffed100eb2525b R12: dffffc0000000000 [ 98.952305][ T5962] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 98.962718][ T5848] R13: 1ffff1100630198c R14: 0000000000000000 R15: ffff888066d48888 [ 98.970723][ T5848] FS: 0000000000000000(0000) GS:ffff88812485b000(0000) knlGS:0000000000000000 [ 98.979680][ T5848] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 98.986294][ T5848] CR2: 00007ffd36f91ea9 CR3: 0000000063cb2000 CR4: 00000000003526f0 [ 98.994306][ T5848] Call Trace: [ 98.997616][ T5848] [ 99.000577][ T5848] device_del+0x27f/0x8f0 [ 99.004970][ T5848] ? __pfx_device_del+0x10/0x10 [ 99.009860][ T5848] ? pm_runtime_set_memalloc_noio+0x1e7/0x260 [ 99.015977][ T5848] ? netdev_unregister_kobject+0x347/0x450 [ 99.021832][ T5848] unregister_netdevice_many_notify+0x1bdc/0x2140 [ 99.028308][ T5848] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 99.035121][ T5848] ? rtnl_net_dev_lock+0x36/0x2f0 [ 99.040302][ T5848] ? rtnl_net_dev_lock+0x36/0x2f0 [ 99.045391][ T5848] unregister_netdev+0x155/0x1f0 [ 99.050371][ T5848] ? __pfx_unregister_netdev+0x10/0x10 [ 99.055878][ T5848] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 99.061735][ T5848] bnep_session+0x2af2/0x2d20 [ 99.066458][ T5848] ? __lock_acquire+0x747/0x2de0 [ 99.071446][ T5848] ? __pfx_bnep_session+0x10/0x10 [ 99.076519][ T5848] ? do_raw_spin_lock+0x12b/0x2f0 [ 99.081590][ T5848] ? __pfx_woken_wake_function+0x10/0x10 [ 99.087261][ T5848] ? __kthread_parkme+0x71/0x1f0 [ 99.092243][ T5848] ? __kthread_parkme+0x199/0x1f0 [ 99.097307][ T5848] kthread+0x38b/0x480 [ 99.101428][ T5848] ? __pfx_bnep_session+0x10/0x10 [ 99.106497][ T5848] ? __pfx_kthread+0x10/0x10 [ 99.111137][ T5848] ret_from_fork+0x514/0xb70 [ 99.115808][ T5848] ? __pfx_ret_from_fork+0x10/0x10 [ 99.120973][ T5848] ? __switch_to+0xc89/0x1420 [ 99.125695][ T5848] ? __pfx_kthread+0x10/0x10 [ 99.130330][ T5848] ret_from_fork_asm+0x1a/0x30 [ 99.135134][ T5848] [ 99.138192][ T5848] Modules linked in: [ 99.143137][ T5848] ---[ end trace 0000000000000000 ]--- [ 99.153475][ T5848] RIP: 0010:klist_del+0x49/0x110 [ 99.153507][ T5848] Code: f5 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 89 77 4b f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 6b 77 4b f6 4d 8b 7e 58 4c 89 f7 e8 af 5d [ 99.153527][ T5848] RSP: 0018:ffffc9000502f848 EFLAGS: 00010202 [ 99.153547][ T5848] RAX: 000000000000000b RBX: ffff88803180cc60 RCX: ffff88807fe60000 [ 99.153563][ T5848] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 99.153577][ T5848] RBP: ffffc9000502f970 R08: ffff8880759292d3 R09: 1ffff1100eb2525a [ 99.153594][ T5848] R10: dffffc0000000000 R11: ffffed100eb2525b R12: dffffc0000000000 [ 99.153611][ T5848] R13: 1ffff1100630198c R14: 0000000000000000 R15: ffff888066d48888 [ 99.153627][ T5848] FS: 0000000000000000(0000) GS:ffff88812485b000(0000) knlGS:0000000000000000 [ 99.153645][ T5848] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.153661][ T5848] CR2: 00007ffd36f91ea9 CR3: 0000000063cb2000 CR4: 00000000003526f0 [ 99.153683][ T5848] Kernel panic - not syncing: Fatal exception [ 99.254467][ T5848] Kernel Offset: disabled [ 99.258818][ T5848] Rebooting in 86400 seconds..