last executing test programs: 20.752700512s ago: executing program 1 (id=529): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x5) fchdir(r1) creat(&(0x7f0000000000)='./file0\x00', 0x114) 16.755507095s ago: executing program 1 (id=543): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2201, 0x400000000000001}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') read$FUSE(r4, &(0x7f0000000040)={0x2020}, 0x2020) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15.249739069s ago: executing program 4 (id=550): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="06000000040000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f9ffffffb703000000080000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r1}, 0x18) syz_usb_connect(0x2, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x300000000000000, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r5, 0x52b242d) keyctl$join(0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$sysfs(0xffffffffffffff9c, 0x0, 0x1, 0x50) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) 15.153674549s ago: executing program 3 (id=551): openat$dsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0x801, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x7}) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) syz_io_uring_setup(0x496, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=ANY=[@ANYBLOB="00006fe9000a14000000090a010400000000000000000000000d20000000090a010400000002000000000a0000090900020073797a320000000034000000140a0e000000000000000000030000070900010073797a30000000000c0006400000000000000002080013400000000318000000120a0103000000000000000000000003"], 0xa8}, 0x1, 0x0, 0x0, 0x44810}, 0x44000) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0), 0x10, 0x746}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200), 0x88081, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r4, 0x4010744d, &(0x7f0000000180)) ioctl$TUNSETIFF(r4, 0x400454ca, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000620000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x6, 0x10000, 0x800000, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0xfffffffffffffffe, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x241000}) 13.15595893s ago: executing program 1 (id=552): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$rds(0x15, 0x5, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000580)={0x20000000}) write$vga_arbiter(r3, &(0x7f0000000200)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r3, &(0x7f0000000100)=@other={'unlock', ' ', 'mem'}, 0xb) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x11, {0x2, 0x4e24, @dev}, 'vcan0\x00'}) bind$rds(r2, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f0000000580)={&(0x7f00000005c0)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000003a80)=[@rdma_args={0x48, 0x114, 0x1, {{0x0, 0x2}, {0x0}, &(0x7f0000000480)=[{&(0x7f00000016c0)=""/96, 0x60}], 0x1, 0x39, 0x2}}], 0x48, 0x4000000}, 0x0) sendto$inet6(r1, &(0x7f0000000080)="8b", 0x1, 0x24008011, &(0x7f0000000000)={0xa, 0xfffc, 0x0, @private1, 0x882}, 0x1c) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_open_procfs(0x0, 0x0) futimesat(r6, 0x0, 0x0) 12.800371564s ago: executing program 3 (id=553): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r0, &(0x7f0000001fc0)={&(0x7f0000001bc0)={0xa, 0x4e20, 0x3, @local, 0x4}, 0x1c, 0x0}, 0x20040884) 12.63583986s ago: executing program 3 (id=554): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xbd, 0x16, 0xf, 0x40, 0x8086, 0x110, 0xbfad, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xa0, 0x12, 0x24}}]}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000580)={0x34, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 12.11187794s ago: executing program 4 (id=555): lsetxattr$security_capability(&(0x7f0000000080)='./cgroup/cgroup.procs\x00', &(0x7f0000000700), 0x0, 0x0, 0x1) r0 = socket$caif_seqpacket(0x25, 0x5, 0x3) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, 0xffffffffffffffff, 0x3d) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES32=0x1, @ANYBLOB="03000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000006ef2885a92523adf5bc6f5b4504f71f1f73d7f000000e33d2b2df85c901e83"], 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x15, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400", @ANYRES32=r4], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) accept$unix(r5, &(0x7f0000000300), &(0x7f0000000380)=0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001800010000000000fddbdf251d01040008", @ANYRES32, @ANYBLOB='\b\x00\t\x00', @ANYRES32], 0x24}}, 0x0) r8 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r8, 0x84, 0x85, &(0x7f0000001080)=""/4120, &(0x7f0000001040)=0x1018) creat(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xf21963aaf523cb02) 11.146595923s ago: executing program 4 (id=556): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) ptrace$ARCH_GET_FS(0x1e, 0x0, &(0x7f0000000240), 0x1003) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0xfffc, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="02060200020000000200000000"], 0x10}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8031, 0xffffffffffffffff, 0x28f42000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x2000004}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00'}, 0x10) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='.\x00', &(0x7f0000000000)='exfat\x00', 0x401, 0x0) 10.135874169s ago: executing program 1 (id=557): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r1, 0x38d, 0x70bd28, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20040080}, 0x2000c080) 9.986125533s ago: executing program 4 (id=559): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r2, 0x0) syz_io_uring_setup(0x8d2, 0x0, &(0x7f0000000040), 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000080)=0x200, 0x4) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x0}) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x6, 0x1, 0xfffffffffffffffd, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r3, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r3, 0x7a6, &(0x7f0000000040)={0x4, 0x100000, 0x0, 0xfffffffffffffffd}) remap_file_pages(&(0x7f0000299000/0x2000)=nil, 0x2000, 0x0, 0x5, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x48050}, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 9.968968035s ago: executing program 2 (id=560): setrlimit(0xb, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000080)={[{0x9, 0x7, 0x3, 0x1c, 0x5, 0x2, 0x4e, 0x3, 0xf9, 0x1, 0x80, 0x9, 0x8002200000000000}, {0xfffffffb, 0x6, 0x8, 0xc4, 0x2, 0x17, 0x7, 0xf1, 0x7, 0xff, 0x41, 0x7d, 0x7}, {0xe2a5, 0x4, 0x2, 0x9, 0x2, 0x7f, 0x6, 0xb, 0xff, 0x6, 0x3, 0x3, 0x131}]}) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 9.431783166s ago: executing program 3 (id=561): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, 0x0, 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 8.168085388s ago: executing program 3 (id=562): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_mreqsrc(r0, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 7.10465418s ago: executing program 1 (id=565): r0 = getpgrp(0xffffffffffffffff) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) ptrace$getregs(0xe, r0, 0x10000, &(0x7f0000000140)=""/84) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000001280)={0xe7, 0x3131354f, 0x3, @discrete={0x8ffff, 0x6}}) 6.772375011s ago: executing program 2 (id=567): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000000)='GPL\x00'}, 0x90) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) ioctl$BLKFLSBUF(r0, 0x1261, 0x0) 5.95491703s ago: executing program 2 (id=568): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000008"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) r4 = syz_open_dev$dri(&(0x7f0000003700), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r5 = syz_open_dev$video4linux(&(0x7f0000000480), 0xffff, 0x0) ioctl$VIDIOC_DQEVENT(r5, 0x80885659, &(0x7f00000003c0)={0x0, @frame_sync}) ioctl$VIDIOC_SUBDEV_S_FMT(r5, 0xc0585605, &(0x7f0000001180)={0x1, 0x0, {0xe, 0x7, 0x200a, 0x6, 0x4, 0x2, 0x0, 0x7}}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r4, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r4, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f00000003c0), 0x3, r6, 0xcccccccc}) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], 0x0, 0x0, 0x0) socketpair(0xf, 0x3, 0x2, &(0x7f00000001c0)) 5.95207109s ago: executing program 0 (id=569): r0 = syz_open_dev$video4linux(&(0x7f0000000180), 0x3, 0x80) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r0, 0xc0305616, &(0x7f0000000240)={0x0, {0x2, 0x3}}) 4.767902643s ago: executing program 2 (id=570): socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) ptrace$ARCH_GET_FS(0x1e, 0x0, &(0x7f0000000240), 0x1003) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0xfffc, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="02060200020000000200000000"], 0x10}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8031, 0xffffffffffffffff, 0x28f42000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x2000004}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r6}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00'}, 0x10) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='.\x00', &(0x7f0000000000)='exfat\x00', 0x401, 0x0) 4.766838164s ago: executing program 0 (id=571): unshare(0x2040400) syz_emit_vhci(&(0x7f0000000340)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x0, 0x0, 0x413}}}, 0x7) 3.813907085s ago: executing program 1 (id=572): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, 0x0, 0x0) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4) r5 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x353c7a510d3d58d2, 0x0) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf5000000}, 0x0) 2.981370304s ago: executing program 2 (id=573): connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, 0x0, 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 1.612127986s ago: executing program 0 (id=574): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={0xffffffffffffffff, r0, 0x25, 0x0, @val=@tracing}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="6400000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e65740000000014000780080006400056b20008001340"], 0x64}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000300000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 1.611692996s ago: executing program 2 (id=575): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000cc0)={'batadv_slave_1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000540)={@rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4400046, r1}) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfeffffff, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800efe000000000000000000a00000000000000000000000c00090008000000", @ANYRES32=0x0, @ANYBLOB="1400050000000000000000000000000000000002"], 0x3c}, 0x1, 0x11}, 0x0) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, 0x0) 1.392304907s ago: executing program 3 (id=576): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000100)=0x6, &(0x7f0000000280)=0x2) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, 0x0, 0x4000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000fb00f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x6a, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r4, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, 0x0, 0x1) io_uring_enter(0xffffffffffffffff, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000000c0)={0x101, 0x1, {}, {}, 0x2, 0xea}) socket$inet_tcp(0x2, 0x1, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) 1.322362833s ago: executing program 0 (id=577): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x8d}}, 0x0}, 0x94) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000880)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000300)={0x50, 0x0, &(0x7f00000008c0)=[@enter_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x1, 0x0, &(0x7f0000000780)="1f"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x4c, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x2, 0x0, &(0x7f0000000440)="79cf"}) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="02"], 0x10}}, 0x8890) close(r3) socket$key(0xf, 0x3, 0x2) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r3, 0x0, 0x4ffe6, 0x8) 1.220052883s ago: executing program 4 (id=578): r0 = socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) keyctl$negate(0xd, 0x0, 0xfffffffffffffffe, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x61, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NET_SET(r2, 0x0, 0x8811) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbefb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000700)=@abs={0x0, 0x0, 0x10000}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, &(0x7f0000000480)={0x0, 0x2, [0x1f0, 0x300, 0xb16, 0x146]}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)={0x1c, 0x7, 0x6, 0x401, 0x0, 0x0, {0x1, 0x0, 0xa}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000080) landlock_restrict_self(0xffffffffffffffff, 0x5) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)}, 0x60044084) 248.918256ms ago: executing program 4 (id=579): lsetxattr$security_capability(&(0x7f0000000080)='./cgroup/cgroup.procs\x00', &(0x7f0000000700), 0x0, 0x0, 0x1) r0 = socket$caif_seqpacket(0x25, 0x5, 0x3) setsockopt$CAIFSO_REQ_PARAM(r0, 0x116, 0x80, 0xffffffffffffffff, 0x3d) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYRES32=0x1, @ANYBLOB="03000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000006ef2885a92523adf5bc6f5b4504f71f1f73d7f000000e33d2b2df85c901e83"], 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x15, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400", @ANYRES32=r4], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x20223000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) accept$unix(r5, &(0x7f0000000300), &(0x7f0000000380)=0x6e) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001800010000000000fddbdf251d01040008", @ANYRES32, @ANYBLOB='\b\x00\t\x00', @ANYRES32], 0x24}}, 0x0) r8 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r8, 0x84, 0x85, &(0x7f0000001080)=""/4120, &(0x7f0000001040)=0x1018) creat(&(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xf21963aaf523cb02) 227.680869ms ago: executing program 0 (id=580): fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f0000000280)='./file1\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_SETQUOTA(r0, 0xffffffff80000800, 0x0, &(0x7f00000000c0)={0x0, 0x1, 0x2000240000a95c, 0x40000009, 0x4000000201, 0x8000000000000001, 0x48d1, 0x0, 0x800000df}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0) mknodat$loop(r1, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) unlinkat(r1, &(0x7f0000000240)='./file1\x00', 0x0) 0s ago: executing program 0 (id=581): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.parent_freezing\x00', 0x275a, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r1, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) r2 = openat$dsp(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$SNDCTL_DSP_GETTRIGGER(r2, 0x80045010, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) syz_init_net_socket$rose(0xb, 0x5, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x200000b, 0x12, r0, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r4, 0x89f1, &(0x7f0000000000)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.199' (ED25519) to the list of known hosts. [ 56.119623][ T4171] cgroup: Unknown subsys name 'net' [ 56.262864][ T4171] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 57.586102][ T4171] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 59.010363][ T4185] chnl_net:caif_netlink_parms(): no params data found [ 59.075631][ T4184] chnl_net:caif_netlink_parms(): no params data found [ 59.144906][ T4183] chnl_net:caif_netlink_parms(): no params data found [ 59.191543][ T4185] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.199509][ T4185] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.207937][ T4185] device bridge_slave_0 entered promiscuous mode [ 59.242362][ T4185] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.249519][ T4185] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.257887][ T4185] device bridge_slave_1 entered promiscuous mode [ 59.278651][ T4184] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.285967][ T4184] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.294019][ T4184] device bridge_slave_0 entered promiscuous mode [ 59.317971][ T4182] chnl_net:caif_netlink_parms(): no params data found [ 59.332446][ T4184] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.339745][ T4184] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.347791][ T4184] device bridge_slave_1 entered promiscuous mode [ 59.364983][ T4185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.393981][ T4185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.403245][ T4189] chnl_net:caif_netlink_parms(): no params data found [ 59.460945][ T4184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.472497][ T4184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.484234][ T4185] team0: Port device team_slave_0 added [ 59.496550][ T4185] team0: Port device team_slave_1 added [ 59.506171][ T4183] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.513553][ T4183] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.521727][ T4183] device bridge_slave_0 entered promiscuous mode [ 59.558542][ T4183] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.565689][ T4183] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.573730][ T4183] device bridge_slave_1 entered promiscuous mode [ 59.611692][ T4184] team0: Port device team_slave_0 added [ 59.618491][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.625450][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.651840][ T4185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.673257][ T4182] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.680535][ T4182] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.689200][ T4182] device bridge_slave_0 entered promiscuous mode [ 59.697809][ T4184] team0: Port device team_slave_1 added [ 59.703626][ T4182] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.711083][ T4182] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.719111][ T4182] device bridge_slave_1 entered promiscuous mode [ 59.726258][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.733596][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.759917][ T4185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.779393][ T4183] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.790356][ T4183] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.868641][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.875632][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 59.901872][ T4184] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.915195][ T4182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.924586][ T4189] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.932396][ T4189] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.940308][ T4189] device bridge_slave_0 entered promiscuous mode [ 59.951059][ T4185] device hsr_slave_0 entered promiscuous mode [ 59.957949][ T4185] device hsr_slave_1 entered promiscuous mode [ 59.967208][ T4183] team0: Port device team_slave_0 added [ 59.973629][ T4184] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.980913][ T4184] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.007454][ T4184] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.020576][ T4182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.030500][ T4189] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.037916][ T4189] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.045861][ T4189] device bridge_slave_1 entered promiscuous mode [ 60.060119][ T4183] team0: Port device team_slave_1 added [ 60.089482][ T4189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.113413][ T4182] team0: Port device team_slave_0 added [ 60.127961][ T4189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.151416][ T4182] team0: Port device team_slave_1 added [ 60.175895][ T4183] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.183195][ T4183] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.209400][ T4183] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.245098][ T4189] team0: Port device team_slave_0 added [ 60.251462][ T4183] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.258447][ T4183] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.284511][ T4183] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.305943][ T4182] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.313020][ T4182] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.339745][ T4182] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.354053][ T4184] device hsr_slave_0 entered promiscuous mode [ 60.360960][ T4184] device hsr_slave_1 entered promiscuous mode [ 60.367682][ T4184] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.375441][ T4184] Cannot create hsr debugfs directory [ 60.382334][ T4189] team0: Port device team_slave_1 added [ 60.397906][ T4182] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.404869][ T4182] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.431027][ T4182] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.468485][ T4189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 60.475447][ T4189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.501821][ T4189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 60.513950][ T4189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 60.521058][ T4189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 60.547811][ T4189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 60.624058][ T4182] device hsr_slave_0 entered promiscuous mode [ 60.631133][ T4182] device hsr_slave_1 entered promiscuous mode [ 60.638015][ T4182] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.645568][ T4182] Cannot create hsr debugfs directory [ 60.660379][ T4183] device hsr_slave_0 entered promiscuous mode [ 60.667645][ T4183] device hsr_slave_1 entered promiscuous mode [ 60.674073][ T4183] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.681835][ T4183] Cannot create hsr debugfs directory [ 60.718966][ T4189] device hsr_slave_0 entered promiscuous mode [ 60.725944][ T4189] device hsr_slave_1 entered promiscuous mode [ 60.731251][ T13] Bluetooth: hci1: command 0x0409 tx timeout [ 60.738471][ T4189] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 60.740297][ T13] Bluetooth: hci0: command 0x0409 tx timeout [ 60.746257][ T4189] Cannot create hsr debugfs directory [ 60.806886][ T4192] Bluetooth: hci4: command 0x0409 tx timeout [ 60.813130][ T4192] Bluetooth: hci3: command 0x0409 tx timeout [ 60.817368][ T1108] Bluetooth: hci2: command 0x0409 tx timeout [ 60.977430][ T4185] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 60.988981][ T4185] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 60.998578][ T4185] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 61.007638][ T4185] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 61.043719][ T4184] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 61.054159][ T4184] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 61.064983][ T4184] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 61.079957][ T4184] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 61.165550][ T4185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.186297][ T4183] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 61.195387][ T4183] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 61.205209][ T4183] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 61.220585][ T4183] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 61.235396][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.244097][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.264663][ T4185] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.292059][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.301353][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.310825][ T3076] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.318087][ T3076] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.330682][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.349677][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.358890][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.368133][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.375201][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.389652][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 61.401642][ T4182] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 61.417788][ T4184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.439394][ T4182] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 61.450871][ T4182] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 61.460465][ T4182] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 61.470181][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.479214][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.487409][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 61.499487][ T4184] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.515116][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 61.524857][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 61.549716][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 61.558332][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.569379][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.578806][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.585877][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.594663][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 61.603288][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 61.612146][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.637479][ T4189] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 61.648260][ T4189] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 61.662108][ T4189] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 61.671407][ T4189] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 61.681522][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.690393][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.699928][ T3076] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.707016][ T3076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.715192][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 61.723819][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 61.732311][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.743571][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 61.763504][ T4185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 61.775012][ T4185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 61.792139][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.801430][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.831898][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 61.844675][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 61.855027][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 61.871541][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 61.880743][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 61.889791][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.898798][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 61.941880][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.951245][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.962317][ T4184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 61.980622][ T4183] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.047060][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 62.054921][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 62.070365][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.093753][ T4189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.107472][ T4183] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.125904][ T4182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 62.134889][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.144222][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.174053][ T4182] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.189952][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.205434][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.214603][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.221743][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.230983][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 62.239902][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.255611][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.262837][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.272667][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 62.281806][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.289868][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.311291][ T4189] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.339735][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.348831][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 62.360319][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.369515][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.378407][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.385480][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.393648][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 62.404188][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.412989][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.420090][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.428925][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.436813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.444564][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 62.453660][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.462800][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 62.472709][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 62.481628][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 62.492004][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.500918][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 62.510513][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 62.519816][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 62.528656][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.543035][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.551219][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.559860][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.573623][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 62.584774][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.606005][ T4182] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 62.618970][ T4182] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 62.637346][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 62.651050][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 62.661398][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 62.674372][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.685299][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 62.698355][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 62.705957][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 62.714785][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.724787][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 62.737487][ T4183] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 62.753408][ T4184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.771118][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.792054][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.816999][ T4251] Bluetooth: hci0: command 0x041b tx timeout [ 62.820122][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.823076][ T4251] Bluetooth: hci1: command 0x041b tx timeout [ 62.830113][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.849501][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 62.860326][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.872314][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.879429][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.887302][ T4252] Bluetooth: hci2: command 0x041b tx timeout [ 62.893540][ T4252] Bluetooth: hci3: command 0x041b tx timeout [ 62.898196][ T4251] Bluetooth: hci4: command 0x041b tx timeout [ 62.906083][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.919952][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.003658][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 63.017150][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.025773][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.035575][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.044610][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 63.053850][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.063575][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.071665][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.087791][ T4184] device veth0_vlan entered promiscuous mode [ 63.094741][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.112498][ T4185] device veth0_vlan entered promiscuous mode [ 63.127123][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.135978][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.153620][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.162603][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.180434][ T4184] device veth1_vlan entered promiscuous mode [ 63.202305][ T4182] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.218533][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.229475][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.238552][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.248413][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.257479][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.265714][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.274563][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.282402][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.301997][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.310298][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.318055][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.333006][ T4189] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 63.344433][ T4189] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.353698][ T4185] device veth1_vlan entered promiscuous mode [ 63.377375][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.385914][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.413721][ T4183] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 63.435107][ T4184] device veth0_macvtap entered promiscuous mode [ 63.452295][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 63.466390][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.478122][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 63.487204][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.504694][ T4185] device veth0_macvtap entered promiscuous mode [ 63.518518][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 63.527999][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 63.543416][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 63.558533][ T4182] device veth0_vlan entered promiscuous mode [ 63.567006][ T4184] device veth1_macvtap entered promiscuous mode [ 63.592444][ T4185] device veth1_macvtap entered promiscuous mode [ 63.599850][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 63.609061][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 63.620830][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 63.629252][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.637855][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.646235][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 63.655499][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 63.664348][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.672631][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.685831][ T4182] device veth1_vlan entered promiscuous mode [ 63.715809][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.726674][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 63.737590][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.750969][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 63.764249][ T4183] device veth0_vlan entered promiscuous mode [ 63.777104][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 63.785299][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 63.795950][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 63.805800][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.815930][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 63.824785][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 63.834064][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 63.842585][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 63.851907][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.859568][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.867129][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 63.874899][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 63.886018][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.895944][ T4184] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 63.908218][ T4184] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 63.920321][ T4184] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 63.935070][ T4183] device veth1_vlan entered promiscuous mode [ 63.943471][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 63.951851][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 63.961526][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 63.970743][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 63.980127][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 63.994010][ T4185] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.002989][ T4185] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.012765][ T4185] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.023734][ T4185] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.036284][ T4189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.066972][ T4184] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.075718][ T4184] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.085545][ T4184] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.098134][ T4184] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.133579][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 64.142024][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.153255][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.162228][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.171040][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.190715][ T4182] device veth0_macvtap entered promiscuous mode [ 64.200235][ T4183] device veth0_macvtap entered promiscuous mode [ 64.209151][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.218024][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.225983][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.235204][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.255102][ T4182] device veth1_macvtap entered promiscuous mode [ 64.270656][ T4183] device veth1_macvtap entered promiscuous mode [ 64.325093][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.342542][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.355322][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.366152][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.380173][ T4182] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.393162][ T4189] device veth0_vlan entered promiscuous mode [ 64.402421][ T4183] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.416053][ T4183] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.426111][ T4183] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.436833][ T4183] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.446678][ T4183] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 64.457146][ T4183] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.468579][ T4183] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 64.481365][ T4183] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.493729][ T4183] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.506197][ T4183] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.517087][ T4183] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.528896][ T4183] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.536279][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 64.545286][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 64.554553][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.563532][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.572807][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 64.581779][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 64.590703][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 64.599741][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.608781][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.617074][ T3076] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.630506][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.641562][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.652358][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.663306][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.673177][ T4182] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 64.683906][ T4182] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 64.694923][ T4182] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 64.718321][ T4183] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.730899][ T4183] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.741734][ T4183] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.751078][ T4183] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.762201][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 64.771129][ T1237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 64.782240][ T4189] device veth1_vlan entered promiscuous mode [ 64.791611][ T4182] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.801077][ T4182] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.810443][ T4182] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.819578][ T4182] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 64.842280][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.850517][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.903207][ T4192] Bluetooth: hci1: command 0x040f tx timeout [ 64.910780][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 64.917199][ T4192] Bluetooth: hci0: command 0x040f tx timeout [ 64.925405][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 64.934226][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 64.944979][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.953942][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.966092][ T4189] device veth0_macvtap entered promiscuous mode [ 64.973048][ T4192] Bluetooth: hci4: command 0x040f tx timeout [ 64.982744][ T4192] Bluetooth: hci3: command 0x040f tx timeout [ 64.992738][ T4192] Bluetooth: hci2: command 0x040f tx timeout [ 65.023711][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.039649][ T4189] device veth1_macvtap entered promiscuous mode [ 65.040077][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.067276][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.075306][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.089221][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.105199][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.114090][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 65.122200][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 65.155927][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.171455][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.182748][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.198905][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.217178][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.229453][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.239434][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.250260][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.261944][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.285537][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.300525][ T1237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.312978][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.327693][ T1237] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.338583][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 65.355535][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.370913][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.387151][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.403035][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.414815][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.431142][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.442046][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.462926][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.474832][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.503584][ T4189] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.514579][ T4189] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.531757][ T4189] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.543231][ T4189] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.606422][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.625416][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.651560][ T1237] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.667329][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 65.667689][ T1237] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 65.682928][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.266254][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.275016][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.346724][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.354690][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.363343][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.406757][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.414862][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.462838][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.477872][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.486046][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.508196][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.536936][ T1237] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.544914][ T1237] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.567948][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.623741][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 66.633194][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 66.930997][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 66.966803][ T4295] Bluetooth: hci0: command 0x0419 tx timeout [ 66.975065][ T4295] Bluetooth: hci1: command 0x0419 tx timeout [ 67.119940][ T4295] Bluetooth: hci2: command 0x0419 tx timeout [ 67.135778][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 67.211992][ T4295] Bluetooth: hci3: command 0x0419 tx timeout [ 67.238749][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 67.297045][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 67.317713][ T4295] Bluetooth: hci4: command 0x0419 tx timeout [ 67.367003][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 67.376184][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 67.526925][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 67.535975][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 70.851869][ T4338] hfs: can't find a HFS filesystem on dev nullb0 [ 71.467318][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.473986][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.859832][ T4334] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 74.326495][ T4355] 9pnet: Could not find request transport: fd0xffffffffffffffff [ 74.622678][ T4362] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 75.147665][ T4173] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 75.211288][ T4381] netlink: 332 bytes leftover after parsing attributes in process `syz.0.20'. [ 75.457834][ T4383] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.471271][ T4383] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.618687][ T4381] netlink: 'syz.0.20': attribute type 1 has an invalid length. [ 75.678751][ T4173] usb 5-1: Using ep0 maxpacket: 32 [ 75.856658][ T4383] syz.2.18 (4383) used greatest stack depth: 20896 bytes left [ 75.906782][ T4173] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 76.034960][ T4173] usb 5-1: config 0 has no interface number 0 [ 76.146578][ T4260] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 76.216686][ T4173] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=b3.be [ 76.307541][ T4173] usb 5-1: New USB device strings: Mfr=164, Product=196, SerialNumber=3 [ 76.316009][ T4173] usb 5-1: Product: syz [ 76.413979][ T4173] usb 5-1: Manufacturer: syz [ 76.486512][ T4260] usb 2-1: Using ep0 maxpacket: 32 [ 76.504379][ T4400] netlink: 16 bytes leftover after parsing attributes in process `syz.2.22'. [ 76.526747][ T4173] usb 5-1: SerialNumber: syz [ 76.593416][ T4402] process 'syz.0.24' launched '/dev/fd/8' with NULL argv: empty string added [ 76.607401][ T4260] usb 2-1: config 0 has an invalid interface number: 240 but max is 0 [ 76.623305][ T4260] usb 2-1: config 0 has no interface number 0 [ 76.648723][ T4260] usb 2-1: config 0 interface 240 has no altsetting 0 [ 76.719509][ T4173] usb 5-1: config 0 descriptor?? [ 76.799716][ T4173] smsc95xx v2.0.0 [ 77.026914][ T4260] usb 2-1: New USB device found, idVendor=0dba, idProduct=3000, bcdDevice=19.6f [ 77.037468][ T4260] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.045611][ T4260] usb 2-1: Product: syz [ 77.082130][ T4260] usb 2-1: config 0 descriptor?? [ 77.128764][ T4260] usb 2-1: can't set config #0, error -71 [ 77.145684][ T4260] usb 2-1: USB disconnect, device number 2 [ 78.706845][ T4173] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 78.815311][ T4173] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 79.006748][ T4173] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 79.065406][ T4173] smsc95xx: probe of 5-1:0.67 failed with error -71 [ 79.133021][ T4173] usb 5-1: USB disconnect, device number 2 [ 81.448993][ T7] cfg80211: failed to load regulatory.db [ 83.035657][ T4435] 9pnet: Could not find request transport: fd0xffffffffffffffff [ 86.674289][ T4506] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 86.683056][ T4506] overlayfs: overlapping lowerdir path [ 87.326455][ C0] sched: RT throttling activated [ 88.608821][ T4527] netlink: 16 bytes leftover after parsing attributes in process `syz.2.56'. [ 93.668372][ T4550] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 95.623944][ T4583] netlink: 16 bytes leftover after parsing attributes in process `syz.1.70'. [ 97.695035][ T4597] hub 8-0:1.0: USB hub found [ 97.701000][ T4597] hub 8-0:1.0: 1 port detected [ 100.001335][ T4617] netlink: 16 bytes leftover after parsing attributes in process `syz.4.81'. [ 103.586214][ T4650] netlink: 8 bytes leftover after parsing attributes in process `syz.4.89'. [ 104.267856][ T4651] lo speed is unknown, defaulting to 1000 [ 104.273773][ T4651] lo speed is unknown, defaulting to 1000 [ 104.281114][ T4651] lo speed is unknown, defaulting to 1000 [ 104.289863][ T4651] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 104.300875][ T4651] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 104.432742][ T4651] lo speed is unknown, defaulting to 1000 [ 104.439335][ T4651] lo speed is unknown, defaulting to 1000 [ 104.445681][ T4651] lo speed is unknown, defaulting to 1000 [ 104.452633][ T4651] lo speed is unknown, defaulting to 1000 [ 104.458965][ T4651] lo speed is unknown, defaulting to 1000 [ 104.465211][ T4651] lo speed is unknown, defaulting to 1000 [ 104.883154][ T4660] fuse: blksize only supported for fuseblk [ 105.159122][ T4672] netlink: 8 bytes leftover after parsing attributes in process `syz.1.95'. [ 108.674274][ T4706] netlink: 16 bytes leftover after parsing attributes in process `syz.3.101'. [ 109.746575][ T4295] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 110.016743][ T4295] usb 5-1: Using ep0 maxpacket: 8 [ 110.146706][ T4295] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x2 has invalid maxpacket 19910, setting to 64 [ 110.190581][ T4295] usb 5-1: config 0 interface 0 has no altsetting 0 [ 110.407501][ T4729] netlink: set zone limit has 8 unknown bytes [ 110.840223][ T4295] usb 5-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 110.897806][ T4295] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.973842][ T4295] usb 5-1: Product: syz [ 110.992897][ T4295] usb 5-1: Manufacturer: syz [ 111.012589][ T4295] usb 5-1: SerialNumber: syz [ 111.032619][ T4295] usb 5-1: config 0 descriptor?? [ 111.090226][ T4295] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 found [ 111.308860][ T4295] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 now disconnected [ 111.379350][ T4295] snd_usb_toneport: probe of 5-1:0.0 failed with error -22 [ 111.521994][ T4173] usb 5-1: USB disconnect, device number 3 [ 111.958011][ T4743] binder: 4742:4743 unknown command 0 [ 111.986561][ T4743] binder: 4742:4743 ioctl c0306201 200000000080 returned -22 [ 112.449726][ T4751] syz.2.123 (4751) used greatest stack depth: 20768 bytes left [ 112.488855][ T4295] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 112.611166][ T4759] 9pnet: p9_errstr2errno: server reported unknown error  [ 112.856665][ T4295] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 0, changing to 4 [ 112.889405][ T4295] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 112.942937][ T4295] usb 2-1: config 0 interface 0 has no altsetting 0 [ 113.146726][ T4295] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 113.170805][ T4295] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 113.204088][ T4295] usb 2-1: Product: syz [ 113.229871][ T4295] usb 2-1: Manufacturer: syz [ 113.245853][ T4295] usb 2-1: SerialNumber: syz [ 113.273129][ T4295] usb 2-1: config 0 descriptor?? [ 113.361246][ T4295] usb 2-1: selecting invalid altsetting 0 [ 113.587695][ T4754] usb 2-1: selecting invalid altsetting 0 [ 113.596731][ T4754] usb 2-1: 0:0: usb_set_interface failed (-22) [ 113.603027][ T4754] usb 2-1: selecting invalid altsetting 0 [ 113.685064][ T4295] usb 2-1: USB disconnect, device number 3 [ 113.706540][ T1108] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 113.738008][ T4754] usb 2-1: 0:0: usb_set_interface failed (-22) [ 115.298455][ T1108] usb 4-1: Using ep0 maxpacket: 16 [ 115.439163][ T4776] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 115.450938][ T4776] exFAT-fs (loop0): unable to read boot sector [ 115.457378][ T4776] exFAT-fs (loop0): failed to read boot sector [ 115.463602][ T4776] exFAT-fs (loop0): failed to recognize exfat type [ 116.126704][ T1108] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 116.169544][ T1108] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 116.394055][ T1108] usb 4-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 117.951438][ T1108] usb 4-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 118.024549][ T1108] usb 4-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 118.184201][ T4787] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 118.191147][ T4787] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 118.200389][ T1108] usb 4-1: config 1 interface 0 has no altsetting 0 [ 118.267610][ T1108] usb 4-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 118.360309][ T1108] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 118.532040][ T4787] vhci_hcd vhci_hcd.0: Device attached [ 118.569392][ T1108] usb 4-1: can't set config #1, error -71 [ 118.707021][ T1108] usb 4-1: USB disconnect, device number 2 [ 118.836815][ T4253] vhci_hcd: vhci_device speed not set [ 118.906656][ T4253] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 120.924584][ T4811] capability: warning: `syz.2.140' uses deprecated v2 capabilities in a way that may be insecure [ 124.971004][ T4788] vhci_hcd: connection reset by peer [ 125.000750][ T4507] vhci_hcd: stop threads [ 125.005593][ T4507] vhci_hcd: release socket [ 125.047810][ T4507] vhci_hcd: disconnect device [ 125.126564][ T4253] vhci_hcd: vhci_device speed not set [ 125.332089][ T4839] binder: 4838:4839 ioctl c0306201 200000000080 returned -14 [ 127.286539][ T4791] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 127.483763][ T4867] netlink: 16 bytes leftover after parsing attributes in process `syz.4.153'. [ 127.506523][ T4331] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 128.036292][ T4871] netlink: 12 bytes leftover after parsing attributes in process `syz.0.157'. [ 128.056690][ T4791] usb 2-1: New USB device found, idVendor=0830, idProduct=0060, bcdDevice=13.2b [ 128.066187][ T4791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.076681][ T4331] usb 3-1: config 0 has an invalid interface number: 50 but max is 0 [ 128.095124][ T4331] usb 3-1: config 0 has no interface number 0 [ 128.108903][ T4331] usb 3-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 128.146627][ T4791] usb 2-1: Product: syz [ 128.150837][ T4791] usb 2-1: Manufacturer: syz [ 128.189540][ T4791] usb 2-1: SerialNumber: syz [ 128.276805][ T4331] usb 3-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 128.291711][ T4331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.312178][ T4331] usb 3-1: Product: syz [ 128.330539][ T4295] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 128.339701][ T4331] usb 3-1: Manufacturer: syz [ 128.344515][ T4331] usb 3-1: SerialNumber: syz [ 128.359758][ T4331] usb 3-1: config 0 descriptor?? [ 128.587769][ T4791] usb 2-1: palm_os_4_probe - error -110 getting connection info [ 128.589878][ T4331] yurex 3-1:0.50: USB YUREX device now attached to Yurex #0 [ 128.607032][ T4791] visor 2-1:1.0: Handspring Visor / Palm OS converter detected [ 128.657712][ T4295] usb 5-1: Using ep0 maxpacket: 32 [ 128.792476][ T4791] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 128.858630][ T4791] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 129.039847][ T4791] usb 2-1: USB disconnect, device number 4 [ 129.146591][ T4295] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 175, using maximum allowed: 30 [ 129.237836][ T4791] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 129.260018][ T4791] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 129.268507][ T4295] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 175 [ 129.272857][ T4791] visor 2-1:1.0: device disconnected [ 129.355297][ T4878] device syzkaller1 entered promiscuous mode [ 129.379478][ T4295] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 129.423543][ T4295] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.025362][ T4295] usb 5-1: config 0 descriptor?? [ 130.287055][ T4295] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 130.303079][ T4295] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 130.337012][ T4295] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 130.346587][ T4295] usb 5-1: media controller created [ 130.372495][ T4295] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 131.384213][ T4295] az6027: usb out operation failed. (-71) [ 131.874354][ T4295] az6027: usb out operation failed. (-71) [ 131.907613][ T4295] stb0899_attach: Driver disabled by Kconfig [ 131.924025][ T4295] az6027: no front-end attached [ 131.924025][ T4295] [ 131.956631][ T4295] az6027: usb out operation failed. (-71) [ 131.962670][ T4295] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 131.985091][ T4295] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input5 [ 132.034999][ T23] usb 3-1: USB disconnect, device number 2 [ 132.047544][ T23] yurex 3-1:0.50: USB YUREX #0 now disconnected [ 132.126050][ T4295] dvb-usb: schedule remote query interval to 400 msecs. [ 132.162748][ T4295] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 132.205655][ T4295] usb 5-1: USB disconnect, device number 4 [ 132.386656][ T4253] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 132.580744][ T4295] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 132.724760][ T4253] usb 2-1: Using ep0 maxpacket: 16 [ 132.729928][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.729998][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.860443][ T4253] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 132.928838][ T4253] usb 2-1: config 0 interface 0 has no altsetting 0 [ 132.994083][ T4253] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 133.103106][ T4253] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.194451][ T4253] usb 2-1: config 0 descriptor?? [ 133.715359][ T4253] hid-generic 0003:1E71:2009.0001: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.1-1/input0 [ 134.432188][ T7] usb 2-1: USB disconnect, device number 5 [ 134.552142][ T4915] netlink: 16 bytes leftover after parsing attributes in process `syz.2.168'. [ 134.637985][ T4906] fido_id[4906]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 134.771350][ T4909] block device autoloading is deprecated and will be removed. [ 135.346590][ T23] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 136.065799][ T4932] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.173'. [ 136.146660][ T23] usb 5-1: Using ep0 maxpacket: 16 [ 136.444676][ T7] hid-generic 0005:4C4A:0002.0002: item fetching failed at offset 0/1 [ 136.518519][ T7] hid-generic: probe of 0005:4C4A:0002.0002 failed with error -22 [ 136.536590][ T23] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.576536][ T23] usb 5-1: config 0 has no interfaces? [ 136.638610][ T4938] tipc: Started in network mode [ 136.686380][ T4938] tipc: Node identity 7ae52e374fcf, cluster identity 4711 [ 136.727089][ T4938] tipc: Enabled bearer , priority 0 [ 136.773710][ T4935] tipc: Resetting bearer [ 136.777050][ T23] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 136.801948][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.835983][ T23] usb 5-1: Product: syz [ 136.845498][ T4934] tipc: Disabling bearer [ 136.847354][ T23] usb 5-1: Manufacturer: syz [ 136.886305][ T23] usb 5-1: SerialNumber: syz [ 136.919097][ T23] usb 5-1: config 0 descriptor?? [ 139.570445][ T4972] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 141.316841][ T4331] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 141.549972][ T4983] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 141.556588][ T4983] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 142.335884][ T4983] vhci_hcd vhci_hcd.0: Device attached [ 142.490315][ T4988] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(12) [ 142.496974][ T4988] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 142.606668][ T23] usb 35-1: new low-speed USB device number 3 using vhci_hcd [ 143.351486][ T4988] vhci_hcd vhci_hcd.0: Device attached [ 143.432237][ T4989] vhci_hcd: connection closed [ 143.433169][ T4507] vhci_hcd: stop threads [ 143.442662][ T4986] vhci_hcd: connection reset by peer [ 143.473233][ T4507] vhci_hcd: release socket [ 143.498414][ T4507] vhci_hcd: disconnect device [ 143.517452][ T4507] vhci_hcd: stop threads [ 143.536707][ T4507] vhci_hcd: release socket [ 143.556697][ T4507] vhci_hcd: disconnect device [ 143.666603][ T4331] usb 1-1: unable to read config index 0 descriptor/all [ 143.673610][ T4173] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 143.684416][ T4331] usb 1-1: can't read configurations, error -71 [ 143.926562][ T4173] usb 3-1: Using ep0 maxpacket: 16 [ 144.046924][ T4173] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 144.076712][ T4173] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 144.093039][ T5007] netlink: 16 bytes leftover after parsing attributes in process `syz.1.196'. [ 144.166764][ T4173] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 144.188972][ T4173] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 144.239780][ T4173] usb 3-1: Manufacturer: syz [ 144.331657][ T4173] usb 3-1: config 0 descriptor?? [ 145.376884][ T5000] sctp: failed to load transform for md5: -2 [ 145.676973][ T4260] usb 5-1: USB disconnect, device number 5 [ 145.712106][ T4244] usb 3-1: USB disconnect, device number 3 [ 146.022614][ T4253] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 146.406938][ T4253] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 146.415261][ T4253] usb 1-1: config 0 has no interface number 0 [ 146.423969][ T4253] usb 1-1: config 0 interface 41 has no altsetting 0 [ 146.607201][ T4253] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 146.638191][ T4253] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 146.646557][ T4253] usb 1-1: Product: syz [ 146.673334][ T4253] usb 1-1: Manufacturer: syz [ 146.678097][ T4253] usb 1-1: SerialNumber: syz [ 146.727294][ T4253] usb 1-1: config 0 descriptor?? [ 147.076713][ T4487] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 148.189867][ T5036] netlink: 'syz.0.199': attribute type 4 has an invalid length. [ 149.026597][ T23] vhci_hcd: vhci_device speed not set [ 149.032220][ T4487] usb 3-1: New USB device found, idVendor=0830, idProduct=0060, bcdDevice=13.2b [ 149.052050][ T4487] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 149.062479][ T5038] netlink: 'syz.0.199': attribute type 17 has an invalid length. [ 149.071754][ T5038] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 149.147883][ T4253] CoreChips: probe of 1-1:0.41 failed with error -71 [ 149.166576][ T4487] usb 3-1: Product: syz [ 149.180022][ T5041] Zero length message leads to an empty skb [ 149.216582][ T4487] usb 3-1: Manufacturer: syz [ 149.221253][ T4487] usb 3-1: SerialNumber: syz [ 149.226814][ T4253] usb 1-1: USB disconnect, device number 4 [ 149.656574][ T4487] usb 3-1: palm_os_4_probe - error -110 getting connection info [ 150.303329][ T4487] visor 3-1:1.0: Handspring Visor / Palm OS converter detected [ 150.319267][ T4487] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB0 [ 150.330360][ T4487] usb 3-1: Handspring Visor / Palm OS converter now attached to ttyUSB1 [ 150.915702][ T4487] usb 3-1: USB disconnect, device number 4 [ 150.931104][ T4487] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0 [ 150.972936][ T26] audit: type=1326 audit(1766745021.814:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 150.992780][ T4487] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1 [ 151.022294][ T4487] visor 3-1:1.0: device disconnected [ 151.088595][ T26] audit: type=1326 audit(1766745021.864:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=37 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.193932][ T26] audit: type=1326 audit(1766745021.864:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.251273][ T26] audit: type=1326 audit(1766745021.864:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.325932][ T26] audit: type=1326 audit(1766745021.864:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.559424][ T26] audit: type=1326 audit(1766745021.864:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.583919][ T26] audit: type=1326 audit(1766745021.864:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.609185][ T26] audit: type=1326 audit(1766745021.864:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.633621][ T26] audit: type=1326 audit(1766745021.864:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 151.656533][ T26] audit: type=1326 audit(1766745021.864:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5057 comm="syz.1.211" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc3a3e0c749 code=0x7ffc0000 [ 153.803036][ T5081] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 153.810914][ T5081] IPv6: NLM_F_CREATE should be set when creating new route [ 153.818195][ T5081] IPv6: NLM_F_CREATE should be set when creating new route [ 154.202873][ T7] Bluetooth: hci2: command 0x2016 tx timeout [ 155.255965][ T5095] netlink: 'syz.2.223': attribute type 1 has an invalid length. [ 155.672799][ T5103] netlink: 16 bytes leftover after parsing attributes in process `syz.0.218'. [ 156.387129][ T4237] Bluetooth: hci4: command 0x0406 tx timeout [ 158.491030][ T5153] netlink: 16 bytes leftover after parsing attributes in process `syz.2.237'. [ 161.081542][ T5164] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 161.403353][ T5164] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 162.692001][ T5174] ODEBUG: Out of memory. ODEBUG disabled [ 163.032347][ T5185] netlink: 4 bytes leftover after parsing attributes in process `syz.0.249'. [ 163.729082][ T5204] netlink: 16 bytes leftover after parsing attributes in process `syz.0.253'. [ 167.020013][ T4791] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 168.688837][ T5227] tmpfs: Unknown parameter 'usrquota' [ 168.866829][ T4791] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 168.876852][ T4791] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 168.922163][ T4791] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 168.948974][ T4791] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 169.023875][ T4791] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 169.141498][ T4791] usb 3-1: config 0 descriptor?? [ 169.259278][ T5214] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 169.536676][ T4791] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 169.636141][ T4791] usb 3-1: USB disconnect, device number 5 [ 169.812464][ T5231] device syzkaller0 entered promiscuous mode [ 170.136510][ T5239] netlink: 16 bytes leftover after parsing attributes in process `syz.2.265'. [ 170.939286][ T5248] netlink: 176 bytes leftover after parsing attributes in process `syz.4.267'. [ 173.196029][ T4791] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 173.596741][ T5282] netlink: 16 bytes leftover after parsing attributes in process `syz.1.276'. [ 173.618021][ T4791] usb 1-1: Using ep0 maxpacket: 16 [ 173.837831][ T4791] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 173.891013][ T4791] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 173.978418][ T4791] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 174.076557][ T4791] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 174.163836][ T4791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 174.317444][ T4791] usb 1-1: config 0 descriptor?? [ 174.543480][ T5294] vivid-006: disconnect [ 174.808540][ T4791] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0 [ 174.836375][ T4791] microsoft 0003:045E:07DA.0003: ignoring exceeding usage max [ 174.874269][ T4791] microsoft 0003:045E:07DA.0003: report is too long [ 174.900316][ T4791] microsoft 0003:045E:07DA.0003: item 0 4 0 8 parsing failed [ 174.936142][ T4791] microsoft 0003:045E:07DA.0003: parse failed [ 174.959552][ T4791] microsoft: probe of 0003:045E:07DA.0003 failed with error -22 [ 175.066921][ T4791] usb 1-1: USB disconnect, device number 5 [ 175.241556][ T5292] vivid-006: reconnect [ 176.464363][ T5311] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 176.597238][ T5311] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 176.661695][ T5311] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 176.732668][ T5311] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 176.937254][ T5311] syz.0.284 (5311) used greatest stack depth: 20352 bytes left [ 179.396549][ T4295] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 179.527225][ T5343] netlink: 16 bytes leftover after parsing attributes in process `syz.4.289'. [ 179.568378][ T5342] ntfs3: loop3: try to read out of volume at offset 0x0 [ 179.767684][ T4295] usb 3-1: config index 0 descriptor too short (expected 45, got 36) [ 179.812552][ T4295] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 179.837065][ T4295] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 179.856486][ T4295] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 179.892819][ T4295] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 179.974704][ T4295] usb 3-1: config 0 descriptor?? [ 180.012589][ T5333] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 180.048686][ T4295] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 180.417734][ T4487] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 181.439088][ T4295] Bluetooth: hci0: command 0x0406 tx timeout [ 181.569050][ T4487] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 181.626393][ T4331] usb 3-1: USB disconnect, device number 6 [ 181.686664][ T4487] usb 1-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 181.695894][ T4487] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 181.761471][ T4487] usb 1-1: Manufacturer: syz [ 181.928385][ T4487] usb 1-1: config 0 descriptor?? [ 182.042684][ T4487] usb 1-1: Found UVC 0.00 device (18ec:3288) [ 182.098855][ T4487] usb 1-1: No valid video chain found. [ 182.235307][ T4487] usb 1-1: USB disconnect, device number 6 [ 182.406599][ T4791] Bluetooth: hci2: command 0x0406 tx timeout [ 184.150853][ T4487] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 185.886727][ T4487] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 185.926543][ T7] Bluetooth: hci2: command 0x0406 tx timeout [ 185.932754][ T4487] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 185.936768][ T7] Bluetooth: hci1: command 0x0406 tx timeout [ 185.958355][ T5424] netlink: 16 bytes leftover after parsing attributes in process `syz.0.314'. [ 185.974926][ T4487] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 186.003918][ T7] Bluetooth: hci4: command 0x0406 tx timeout [ 186.009632][ T4487] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 186.946634][ T4487] usb 3-1: can't set config #27, error -71 [ 186.992751][ T4487] usb 3-1: USB disconnect, device number 7 [ 194.283280][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.289696][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.598718][ T7] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 194.836113][ T4331] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 194.854368][ T7] usb 4-1: Using ep0 maxpacket: 8 [ 195.306670][ T7] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 195.324894][ T7] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 195.355346][ T7] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 195.385690][ T7] usb 4-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 195.420070][ T7] usb 4-1: config 0 interface 0 has no altsetting 0 [ 195.448142][ T4331] usb 3-1: Using ep0 maxpacket: 32 [ 195.597434][ T7] usb 4-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 195.617372][ T4331] usb 3-1: unable to get BOS descriptor or descriptor too short [ 195.637635][ T7] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 195.661346][ T7] usb 4-1: Product: syz [ 195.671488][ T7] usb 4-1: Manufacturer: syz [ 195.689042][ T7] usb 4-1: SerialNumber: syz [ 195.704034][ T7] usb 4-1: config 0 descriptor?? [ 195.716686][ T4331] usb 3-1: config 56 has an invalid interface number: 222 but max is 0 [ 195.733077][ T4331] usb 3-1: config 56 has no interface number 0 [ 195.753699][ T7] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 found [ 195.769511][ T4331] usb 3-1: config 56 interface 222 has no altsetting 0 [ 195.957659][ T4331] usb 3-1: New USB device found, idVendor=2020, idProduct=2031, bcdDevice=3b.23 [ 195.967094][ T7] snd_usb_toneport 4-1:0.0: cannot get proper max packet size [ 195.982492][ T7] snd_usb_toneport 4-1:0.0: Line 6 TonePort UX2 now disconnected [ 195.990596][ T4331] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 196.003240][ T4331] usb 3-1: Product: syz [ 196.010371][ T7] snd_usb_toneport: probe of 4-1:0.0 failed with error -22 [ 196.020671][ T4331] usb 3-1: Manufacturer: syz [ 196.045011][ T4331] usb 3-1: SerialNumber: syz [ 196.182934][ T7] usb 4-1: USB disconnect, device number 3 [ 196.639557][ T5509] netlink: 16 bytes leftover after parsing attributes in process `syz.4.344'. [ 197.444035][ T4331] option 3-1:56.222: GSM modem (1-port) converter detected [ 197.453995][ T4331] usb 3-1: USB disconnect, device number 8 [ 197.461108][ T4331] option 3-1:56.222: device disconnected [ 197.794875][ T5527] lo speed is unknown, defaulting to 1000 [ 198.045985][ T5530] tmpfs: Unknown parameter 'mpol"prmfer:ê' [ 198.343873][ T5537] netlink: 24 bytes leftover after parsing attributes in process `syz.4.356'. [ 198.386995][ T5539] tmpfs: Unknown parameter 'usrquota' [ 201.813335][ T5615] syz.0.380[5615] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 201.813429][ T5615] syz.0.380[5615] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 201.900553][ T5617] netlink: 16 bytes leftover after parsing attributes in process `syz.3.377'. [ 202.771284][ T26] kauditd_printk_skb: 61 callbacks suppressed [ 202.771297][ T26] audit: type=1326 audit(1766745073.614:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 203.377234][ T26] audit: type=1326 audit(1766745073.614:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 203.457141][ T26] audit: type=1326 audit(1766745073.644:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=237 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 203.501170][ T26] audit: type=1326 audit(1766745073.784:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 203.557440][ T26] audit: type=1326 audit(1766745073.784:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 203.671448][ T26] audit: type=1326 audit(1766745073.794:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5618 comm="syz.3.381" exe="/root/syz-executor" sig=0 arch=c000003e syscall=299 compat=0 ip=0x7f466c4c0749 code=0x7ffc0000 [ 204.976826][ T4253] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 205.200682][ T5641] ERROR: device name not specified. [ 205.946788][ T4253] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.983638][ T4253] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 206.141779][ T4253] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.221336][ T5648] netlink: 16 bytes leftover after parsing attributes in process `syz.0.391'. [ 206.377985][ T4253] usb 4-1: config 0 descriptor?? [ 206.472297][ T4253] pwc: Askey VC010 type 2 USB webcam detected. [ 206.912584][ T4253] pwc: recv_control_msg error -32 req 02 val 2b00 [ 207.007375][ T4253] pwc: recv_control_msg error -32 req 02 val 2700 [ 207.126527][ T4253] pwc: recv_control_msg error -32 req 02 val 2c00 [ 207.166603][ T4253] pwc: recv_control_msg error -32 req 04 val 1000 [ 207.226537][ T4253] pwc: recv_control_msg error -32 req 04 val 1300 [ 207.266637][ T4253] pwc: recv_control_msg error -32 req 04 val 1400 [ 207.306586][ T4253] pwc: recv_control_msg error -32 req 02 val 2000 [ 207.346586][ T4253] pwc: recv_control_msg error -32 req 02 val 2100 [ 207.390008][ T4253] pwc: recv_control_msg error -32 req 04 val 1500 [ 207.570697][ T4200] Bluetooth: hci0: SCO packet for unknown connection handle 0 [ 207.676706][ T4253] pwc: recv_control_msg error -71 req 02 val 2400 [ 207.706533][ T4253] pwc: recv_control_msg error -71 req 02 val 2600 [ 207.736642][ T4253] pwc: recv_control_msg error -71 req 02 val 2900 [ 207.768927][ T4253] pwc: recv_control_msg error -71 req 02 val 2800 [ 207.826571][ T4253] pwc: recv_control_msg error -71 req 04 val 1100 [ 207.856625][ T4253] pwc: recv_control_msg error -71 req 04 val 1200 [ 207.882629][ T4253] pwc: Registered as video103. [ 208.023734][ T4253] input: PWC snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/input/input7 [ 208.052497][ T4253] usb 4-1: USB disconnect, device number 4 [ 208.211987][ T5674] syz.0.399 uses obsolete (PF_INET,SOCK_PACKET) [ 208.218820][ T5674] device syzkaller1 entered promiscuous mode [ 210.594143][ T5698] 9pnet: Insufficient options for proto=fd [ 211.403601][ T4251] libceph: connect (1)[c::]:6789 error -101 [ 211.419286][ T4251] libceph: mon0 (1)[c::]:6789 connect error [ 211.586667][ T5696] ceph: No mds server is up or the cluster is laggy [ 211.820211][ T5709] tipc: Started in network mode [ 211.825095][ T5709] tipc: Node identity 4, cluster identity 4711 [ 211.831540][ T5709] tipc: Node number set to 4 [ 211.838089][ T4251] libceph: connect (1)[c::]:6789 error -101 [ 211.844244][ T4251] libceph: mon0 (1)[c::]:6789 connect error [ 212.291461][ T5718] netlink: 272 bytes leftover after parsing attributes in process `syz.4.412'. [ 213.556486][ T4251] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 213.966966][ T4251] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 213.997483][ T4251] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 214.011562][ T4251] usb 4-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 214.023394][ T4251] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 214.048756][ T4251] usb 4-1: config 0 descriptor?? [ 214.649087][ T4251] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 215.117481][ T4251] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 215.127698][ T4251] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 215.136325][ T4251] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 215.144047][ T4251] playstation 0003:054C:0DF2.0004: unknown main item tag 0x0 [ 215.155461][ T4251] playstation 0003:054C:0DF2.0004: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.3-1/input0 [ 215.523744][ T5743] netlink: 16 bytes leftover after parsing attributes in process `syz.2.421'. [ 215.616894][ T4251] playstation 0003:054C:0DF2.0004: Failed to retrieve feature with reportID 32: -71 [ 216.236816][ T4251] playstation 0003:054C:0DF2.0004: Failed to retrieve DualSense firmware info: -71 [ 216.246255][ T4251] playstation 0003:054C:0DF2.0004: Failed to get firmware info from DualSense [ 216.432530][ T4251] playstation 0003:054C:0DF2.0004: Failed to create dualsense. [ 216.448725][ T4251] playstation: probe of 0003:054C:0DF2.0004 failed with error -71 [ 216.471468][ T4251] usb 4-1: USB disconnect, device number 5 [ 218.982196][ T5766] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 218.993174][ T5766] exFAT-fs (loop2): unable to read boot sector [ 218.999390][ T5766] exFAT-fs (loop2): failed to read boot sector [ 219.005561][ T5766] exFAT-fs (loop2): failed to recognize exfat type [ 219.793395][ T5761] fido_id[5761]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 220.137935][ T5769] ubi31: attaching mtd0 [ 220.201292][ T5769] ubi31: scanning is finished [ 220.206204][ T5769] ubi31: empty MTD device detected [ 220.665895][ T5769] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 220.695876][ T5769] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 220.712214][ T5769] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 220.723565][ T5769] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 220.734065][ T5769] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 220.747187][ T5769] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 220.755592][ T5769] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2316826249 [ 220.796473][ T5769] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 220.808830][ T5772] ubi31: background thread "ubi_bgt31d" started, PID 5772 [ 223.758178][ T5805] netlink: 16 bytes leftover after parsing attributes in process `syz.4.436'. [ 231.057406][ T5855] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 231.068395][ T5855] exFAT-fs (loop2): unable to read boot sector [ 231.074569][ T5855] exFAT-fs (loop2): failed to read boot sector [ 231.080793][ T5855] exFAT-fs (loop2): failed to recognize exfat type [ 231.900858][ T5857] tipc: Started in network mode [ 231.917528][ T5857] tipc: Node identity 7a1b12467d3, cluster identity 4711 [ 231.945216][ T5857] tipc: Enabled bearer , priority 0 [ 231.956309][ T5858] device syzkaller0 entered promiscuous mode [ 232.019703][ T5857] netlink: 62 bytes leftover after parsing attributes in process `syz.2.451'. [ 232.054566][ T5857] tipc: Resetting bearer [ 232.129526][ T5856] tipc: Resetting bearer [ 232.237468][ T5856] tipc: Disabling bearer [ 232.476250][ T5868] netlink: 4 bytes leftover after parsing attributes in process `syz.2.454'. [ 232.486213][ T5868] netlink: 12 bytes leftover after parsing attributes in process `syz.2.454'. [ 235.069495][ T5894] netlink: 16 bytes leftover after parsing attributes in process `syz.0.462'. [ 236.087541][ T5897] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 236.098788][ T5897] exFAT-fs (loop0): unable to read boot sector [ 236.105038][ T5897] exFAT-fs (loop0): failed to read boot sector [ 236.111316][ T5897] exFAT-fs (loop0): failed to recognize exfat type [ 237.078194][ T5905] netlink: 32 bytes leftover after parsing attributes in process `syz.0.464'. [ 238.301656][ T4252] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 238.496521][ T4252] usb 3-1: device descriptor read/64, error -71 [ 238.779720][ T4252] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 238.895584][ T5948] tmpfs: Unknown parameter 'usrquota' [ 238.986489][ T4252] usb 3-1: device descriptor read/64, error -71 [ 239.089064][ T4251] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 239.106907][ T4252] usb usb3-port1: attempt power cycle [ 239.357980][ T4251] usb 1-1: Using ep0 maxpacket: 16 [ 239.509632][ T4251] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 239.516630][ T4252] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 239.526550][ T4251] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 239.546445][ T4251] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 239.597090][ T4251] usb 1-1: config 0 descriptor?? [ 239.636665][ T4252] usb 3-1: device descriptor read/8, error -71 [ 240.011756][ T5957] netlink: 16 bytes leftover after parsing attributes in process `syz.4.474'. [ 240.177233][ T4251] mcp2221 0003:04D8:00DD.0005: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 240.616934][ T5949] udc-core: couldn't find an available UDC or it's busy [ 240.636579][ T5949] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 240.676556][ T4252] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 240.777087][ T4252] usb 3-1: device descriptor read/8, error -71 [ 241.209982][ T4252] usb usb3-port1: unable to enumerate USB device [ 241.373248][ T23] usb 1-1: USB disconnect, device number 7 [ 242.564053][ T5873] Set syz1 is full, maxelem 65536 reached [ 242.974010][ T5985] netlink: 40 bytes leftover after parsing attributes in process `syz.0.483'. [ 243.332800][ T5992] netlink: 16 bytes leftover after parsing attributes in process `syz.4.486'. [ 244.129386][ T5996] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 244.171015][ T5996] exFAT-fs (loop3): unable to read boot sector [ 244.346970][ T5996] exFAT-fs (loop3): failed to read boot sector [ 244.667191][ T5996] exFAT-fs (loop3): failed to recognize exfat type [ 247.044628][ T6029] device syzkaller1 entered promiscuous mode [ 247.509041][ T6031] netlink: 16 bytes leftover after parsing attributes in process `syz.3.499'. [ 247.600400][ T6035] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 247.615400][ T6035] exFAT-fs (loop3): unable to read boot sector [ 247.622641][ T6035] exFAT-fs (loop3): failed to read boot sector [ 247.629628][ T6035] exFAT-fs (loop3): failed to recognize exfat type [ 248.193462][ T6040] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 249.302884][ T6044] program syz.2.503 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 251.828361][ T6067] netlink: 16 bytes leftover after parsing attributes in process `syz.3.512'. [ 251.837747][ T6068] netlink: 16 bytes leftover after parsing attributes in process `syz.0.511'. [ 252.983903][ T6073] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 252.995617][ T6073] exFAT-fs (loop3): unable to read boot sector [ 253.002051][ T6073] exFAT-fs (loop3): failed to read boot sector [ 253.008289][ T6073] exFAT-fs (loop3): failed to recognize exfat type [ 254.423472][ T6074] blk_update_request: I/O error, dev loop1, sector 2 op 0x0:(READ) flags 0x1000 phys_seg 1 prio class 0 [ 254.435204][ T6074] EXT4-fs (loop1): unable to read superblock [ 254.675854][ T6091] program syz.2.518 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 254.777896][ T4252] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 255.228358][ T6103] netlink: 4 bytes leftover after parsing attributes in process `syz.0.525'. [ 255.386161][ T4252] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 255.608222][ T6110] netlink: 16 bytes leftover after parsing attributes in process `syz.2.524'. [ 258.094785][ T4252] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 258.280001][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 258.286355][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.406641][ T4252] usb 4-1: string descriptor 0 read error: -71 [ 258.412878][ T4252] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 258.554026][ T4252] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 258.581366][ T4252] usb 4-1: config 0 descriptor?? [ 258.648435][ T6126] binder: 6119:6126 ioctl c0306201 0 returned -14 [ 259.336512][ T4252] usb 4-1: can't set config #0, error -71 [ 259.364251][ T4252] usb 4-1: USB disconnect, device number 6 [ 259.406840][ T6130] netlink: 4 bytes leftover after parsing attributes in process `syz.4.534'. [ 260.074059][ T6140] netlink: 168 bytes leftover after parsing attributes in process `syz.3.536'. [ 261.299892][ T6145] device syzkaller0 entered promiscuous mode [ 261.602329][ T6157] blk_update_request: I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.613597][ T6157] exFAT-fs (loop0): unable to read boot sector [ 261.619883][ T6157] exFAT-fs (loop0): failed to read boot sector [ 261.626218][ T6157] exFAT-fs (loop0): failed to recognize exfat type [ 262.214644][ T6150] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 262.225128][ T6152] netlink: 16 bytes leftover after parsing attributes in process `syz.2.538'. [ 265.632832][ T4791] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 266.226522][ T4791] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 266.242275][ T4791] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 266.256596][ T4791] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.288235][ T4791] usb 3-1: config 0 descriptor?? [ 266.339073][ T4791] pwc: Askey VC010 type 2 USB webcam detected. [ 266.776482][ T4791] pwc: recv_control_msg error -32 req 02 val 2b00 [ 266.816478][ T4791] pwc: recv_control_msg error -32 req 02 val 2700 [ 266.836435][ T4252] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 266.866543][ T4791] pwc: recv_control_msg error -32 req 02 val 2c00 [ 266.950858][ T4791] pwc: recv_control_msg error -32 req 04 val 1000 [ 267.115401][ T4791] pwc: recv_control_msg error -32 req 04 val 1300 [ 267.156519][ T4791] pwc: recv_control_msg error -32 req 04 val 1400 [ 267.197053][ T4252] usb 4-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 267.206250][ T4252] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 267.231579][ T6203] netlink: 16 bytes leftover after parsing attributes in process `syz.4.555'. [ 267.837216][ T4791] pwc: recv_control_msg error -32 req 02 val 2000 [ 267.856779][ T4252] usb 4-1: config 0 descriptor?? [ 267.884870][ T4331] Bluetooth: hci3: command 0x0406 tx timeout [ 267.908680][ T4252] gspca_main: spca508-2.14.0 probing 8086:0110 [ 267.956810][ T4791] pwc: recv_control_msg error -32 req 02 val 2100 [ 267.996486][ T4791] pwc: recv_control_msg error -32 req 04 val 1500 [ 268.893771][ T4791] pwc: recv_control_msg error -32 req 02 val 2500 [ 268.936554][ T4791] pwc: recv_control_msg error -71 req 02 val 2400 [ 268.956511][ T4791] pwc: recv_control_msg error -71 req 02 val 2600 [ 268.986487][ T4791] pwc: recv_control_msg error -71 req 02 val 2900 [ 269.008490][ T4791] pwc: recv_control_msg error -71 req 02 val 2800 [ 269.036562][ T4791] pwc: recv_control_msg error -71 req 04 val 1100 [ 269.056514][ T4791] pwc: recv_control_msg error -71 req 04 val 1200 [ 269.087915][ T4791] pwc: Registered as video103. [ 269.093739][ T4791] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input8 [ 269.126773][ T4252] gspca_spca508: reg_read err -71 [ 269.154363][ T4252] gspca_spca508: reg_read err -71 [ 269.196540][ T4252] gspca_spca508: reg_read err -71 [ 269.210564][ T4791] usb 3-1: USB disconnect, device number 13 [ 269.226646][ T4252] gspca_spca508: reg_read err -71 [ 269.266483][ T4252] gspca_spca508: reg write: error -71 [ 269.272030][ T4252] spca508: probe of 4-1:0.0 failed with error -71 [ 269.343288][ T4252] usb 4-1: USB disconnect, device number 7 [ 269.686477][ T4791] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 271.279160][ T4791] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 271.308401][ T4791] usb 3-1: config 220 has an invalid descriptor of length 251, skipping remainder of the config [ 271.486786][ T4791] usb 3-1: config 220 has no interface number 2 [ 271.930705][ T4791] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 271.944277][ T4791] usb 3-1: config 220 interface 0 has no altsetting 0 [ 271.951331][ T4791] usb 3-1: config 220 interface 76 has no altsetting 0 [ 271.966530][ T4791] usb 3-1: config 220 interface 1 has no altsetting 0 [ 272.156547][ T4791] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 272.328651][ T4791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 272.389561][ T6242] netlink: 16 bytes leftover after parsing attributes in process `syz.0.566'. [ 272.701881][ T4791] usb 3-1: Product: syz [ 272.740438][ T4791] usb 3-1: Manufacturer: syz [ 272.784653][ T4791] usb 3-1: SerialNumber: syz [ 272.887249][ T4791] usb 3-1: can't set config #220, error -71 [ 272.957198][ T4791] usb 3-1: USB disconnect, device number 14 [ 274.660622][ T6253] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 274.671997][ T6253] exFAT-fs (loop2): unable to read boot sector [ 274.678275][ T6253] exFAT-fs (loop2): failed to read boot sector [ 274.684490][ T6253] exFAT-fs (loop2): failed to recognize exfat type [ 276.685795][ T6263] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 278.930810][ T6277] tmpfs: Unknown parameter 'usrquota' [ 279.197427][ T6282] ================================================================== [ 279.205857][ T6282] BUG: KASAN: use-after-free in ax25_dev_device_down+0x35e/0x520 [ 279.213608][ T6282] Write of size 4 at addr ffff8881431c3eb8 by task syz.0.581/6282 [ 279.221444][ T6282] [ 279.223781][ T6282] CPU: 0 PID: 6282 Comm: syz.0.581 Not tainted syzkaller #0 [ 279.231078][ T6282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 279.241141][ T6282] Call Trace: [ 279.244424][ T6282] [ 279.247360][ T6282] dump_stack_lvl+0x168/0x230 [ 279.252059][ T6282] ? show_regs_print_info+0x20/0x20 [ 279.257269][ T6282] ? load_image+0x3b0/0x3b0 [ 279.261777][ T6282] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 279.267159][ T6282] ? lockdep_hardirqs_on+0x94/0x140 [ 279.272371][ T6282] print_address_description+0x60/0x2d0 [ 279.277928][ T6282] ? ax25_dev_device_down+0x35e/0x520 [ 279.283313][ T6282] kasan_report+0xdf/0x130 [ 279.287744][ T6282] ? ax25_dev_device_down+0x35e/0x520 [ 279.293120][ T6282] ? kfree+0xef/0x2a0 [ 279.297109][ T6282] kasan_check_range+0x27b/0x290 [ 279.302055][ T6282] ax25_dev_device_down+0x35e/0x520 [ 279.307273][ T6282] ax25_device_event+0x4b4/0x4f0 [ 279.312230][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 279.317612][ T6282] dev_close_many+0x28d/0x400 [ 279.322298][ T6282] ? _raw_spin_unlock+0x40/0x40 [ 279.327166][ T6282] ? __dev_open+0x420/0x420 [ 279.331686][ T6282] ? bond_netdev_event+0x159/0xea0 [ 279.336820][ T6282] ? try_to_del_timer_sync+0x165/0x1b0 [ 279.342298][ T6282] dev_close+0x14c/0x200 [ 279.346544][ T6282] ? __dev_close_many+0x2a0/0x2a0 [ 279.351577][ T6282] ? macvlan_device_event+0x10b/0x930 [ 279.356981][ T6282] bpq_device_event+0x2f4/0x9c0 [ 279.361845][ T6282] ? lockdep_rtnl_is_held+0x22/0x30 [ 279.367050][ T6282] ? team_device_event+0x11b/0x9e0 [ 279.372184][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 279.377574][ T6282] dev_close_many+0x28d/0x400 [ 279.382260][ T6282] ? __dev_open+0x420/0x420 [ 279.386772][ T6282] ? lock_chain_count+0x20/0x20 [ 279.391657][ T6282] ? lockdep_hardirqs_on_prepare+0x760/0x760 [ 279.397654][ T6282] dev_close+0x14c/0x200 [ 279.401911][ T6282] ? __dev_close_many+0x2a0/0x2a0 [ 279.406937][ T6282] ? __local_bh_enable_ip+0x12a/0x1b0 [ 279.412314][ T6282] ? _local_bh_enable+0xa0/0xa0 [ 279.417166][ T6282] bond_setup_by_slave+0x61/0x3a0 [ 279.422202][ T6282] bond_enslave+0x77c/0x3a40 [ 279.426809][ T6282] ? stack_trace_save+0x98/0xe0 [ 279.431663][ T6282] ? slab_free_freelist_hook+0xea/0x170 [ 279.437218][ T6282] ? verify_lock_unused+0x140/0x140 [ 279.442424][ T6282] ? mark_lock+0x94/0x320 [ 279.446769][ T6282] ? bond_lower_state_changed+0x150/0x150 [ 279.452496][ T6282] ? __lock_acquire+0x12d9/0x7c60 [ 279.457541][ T6282] ? apparmor_capable+0x12c/0x190 [ 279.462579][ T6282] ? bpf_lsm_capable+0x5/0x10 [ 279.467274][ T6282] ? full_name_hash+0x8e/0xe0 [ 279.471959][ T6282] bond_do_ioctl+0x2a2/0x8c0 [ 279.476560][ T6282] ? bond_eth_ioctl+0x200/0x200 [ 279.481423][ T6282] ? rcu_lock_release+0x20/0x20 [ 279.486290][ T6282] ? lock_chain_count+0x20/0x20 [ 279.491152][ T6282] ? dev_ioctl+0x54e/0xe50 [ 279.495571][ T6282] ? dev_ioctl+0x54e/0xe50 [ 279.499994][ T6282] ? dev_ioctl+0x54e/0xe50 [ 279.504417][ T6282] ? __mutex_lock_common+0x431/0x2390 [ 279.509801][ T6282] ? full_name_hash+0x8e/0xe0 [ 279.514498][ T6282] ? dev_siocbond+0xcf/0x100 [ 279.519108][ T6282] dev_ifsioc+0xc01/0xe70 [ 279.523449][ T6282] ? dev_ioctl+0xe50/0xe50 [ 279.527872][ T6282] ? apparmor_capable+0x12c/0x190 [ 279.532901][ T6282] ? full_name_hash+0x8e/0xe0 [ 279.537592][ T6282] dev_ioctl+0x55f/0xe50 [ 279.541854][ T6282] ? _copy_from_user+0x111/0x170 [ 279.546801][ T6282] sock_do_ioctl+0x222/0x2f0 [ 279.551400][ T6282] ? sock_show_fdinfo+0xb0/0xb0 [ 279.556282][ T6282] sock_ioctl+0x4ed/0x6e0 [ 279.560616][ T6282] ? sock_poll+0x3f0/0x3f0 [ 279.565044][ T6282] ? bpf_lsm_file_ioctl+0x5/0x10 [ 279.569980][ T6282] ? security_file_ioctl+0x7c/0xa0 [ 279.575094][ T6282] ? sock_poll+0x3f0/0x3f0 [ 279.579511][ T6282] __se_sys_ioctl+0xfa/0x170 [ 279.584110][ T6282] do_syscall_64+0x4c/0xa0 [ 279.588534][ T6282] ? clear_bhb_loop+0x30/0x80 [ 279.593220][ T6282] ? clear_bhb_loop+0x30/0x80 [ 279.597917][ T6282] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 279.603919][ T6282] RIP: 0033:0x7fa0e4910749 [ 279.608344][ T6282] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 279.627955][ T6282] RSP: 002b:00007fa0e2b77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 279.636370][ T6282] RAX: ffffffffffffffda RBX: 00007fa0e4b66fa0 RCX: 00007fa0e4910749 [ 279.644365][ T6282] RDX: 0000200000000180 RSI: 0000000000008990 RDI: 0000000000000005 [ 279.652337][ T6282] RBP: 00007fa0e4994f91 R08: 0000000000000000 R09: 0000000000000000 [ 279.660310][ T6282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 279.668286][ T6282] R13: 00007fa0e4b67038 R14: 00007fa0e4b66fa0 R15: 00007ffc1b6f9c28 [ 279.676301][ T6282] [ 279.679331][ T6282] [ 279.681659][ T6282] Allocated by task 4334: [ 279.685988][ T6282] __kasan_kmalloc+0xb5/0xf0 [ 279.690584][ T6282] ax25_dev_device_up+0x50/0x580 [ 279.695529][ T6282] ax25_device_event+0x483/0x4f0 [ 279.700468][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 279.705840][ T6282] __dev_notify_flags+0x178/0x2d0 [ 279.710873][ T6282] dev_change_flags+0xe3/0x1a0 [ 279.715678][ T6282] dev_ifsioc+0x147/0xe70 [ 279.720010][ T6282] dev_ioctl+0x55f/0xe50 [ 279.724255][ T6282] sock_do_ioctl+0x222/0x2f0 [ 279.728986][ T6282] sock_ioctl+0x4ed/0x6e0 [ 279.733351][ T6282] __se_sys_ioctl+0xfa/0x170 [ 279.737975][ T6282] do_syscall_64+0x4c/0xa0 [ 279.742415][ T6282] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 279.748316][ T6282] [ 279.750657][ T6282] Freed by task 6282: [ 279.754639][ T6282] kasan_set_track+0x4b/0x70 [ 279.759244][ T6282] kasan_set_free_info+0x1f/0x40 [ 279.764190][ T6282] ____kasan_slab_free+0xd5/0x110 [ 279.769217][ T6282] slab_free_freelist_hook+0xea/0x170 [ 279.774608][ T6282] kfree+0xef/0x2a0 [ 279.778436][ T6282] ax25_dev_device_down+0x1c0/0x520 [ 279.783640][ T6282] ax25_device_event+0x4b4/0x4f0 [ 279.788587][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 279.793975][ T6282] dev_close_many+0x28d/0x400 [ 279.798659][ T6282] dev_close+0x14c/0x200 [ 279.802903][ T6282] bpq_device_event+0x2f4/0x9c0 [ 279.807758][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 279.813134][ T6282] dev_close_many+0x28d/0x400 [ 279.817813][ T6282] dev_close+0x14c/0x200 [ 279.822059][ T6282] bond_setup_by_slave+0x61/0x3a0 [ 279.827082][ T6282] bond_enslave+0x77c/0x3a40 [ 279.831677][ T6282] bond_do_ioctl+0x2a2/0x8c0 [ 279.836271][ T6282] dev_ifsioc+0xc01/0xe70 [ 279.840604][ T6282] dev_ioctl+0x55f/0xe50 [ 279.844847][ T6282] sock_do_ioctl+0x222/0x2f0 [ 279.849432][ T6282] sock_ioctl+0x4ed/0x6e0 [ 279.853760][ T6282] __se_sys_ioctl+0xfa/0x170 [ 279.858356][ T6282] do_syscall_64+0x4c/0xa0 [ 279.862781][ T6282] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 279.868674][ T6282] [ 279.871001][ T6282] The buggy address belongs to the object at ffff8881431c3e00 [ 279.871001][ T6282] which belongs to the cache kmalloc-192 of size 192 [ 279.885052][ T6282] The buggy address is located 184 bytes inside of [ 279.885052][ T6282] 192-byte region [ffff8881431c3e00, ffff8881431c3ec0) [ 279.898341][ T6282] The buggy address belongs to the page: [ 279.903997][ T6282] page:ffffea00050c70c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881431c3900 pfn:0x1431c3 [ 279.915543][ T6282] flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) [ 279.923185][ T6282] raw: 057ff00000000200 ffffea000507f4c8 ffffea000507e548 ffff888016841a00 [ 279.931778][ T6282] raw: ffff8881431c3900 0000000000100003 00000001ffffffff 0000000000000000 [ 279.940365][ T6282] page dumped because: kasan: bad access detected [ 279.946794][ T6282] page_owner tracks the page as allocated [ 279.952524][ T6282] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2378691041, free_ts 0 [ 279.967534][ T6282] get_page_from_freelist+0x1b77/0x1c60 [ 279.973102][ T6282] __alloc_pages+0x1e1/0x470 [ 279.977695][ T6282] alloc_page_interleave+0x24/0x1e0 [ 279.982891][ T6282] new_slab+0xc0/0x4b0 [ 279.987008][ T6282] ___slab_alloc+0x81e/0xdf0 [ 279.991607][ T6282] kmem_cache_alloc_trace+0x1a5/0x2a0 [ 279.996985][ T6282] call_usermodehelper_setup+0x8a/0x260 [ 280.002536][ T6282] kobject_uevent_env+0x65e/0x890 [ 280.007571][ T6282] kernel_add_sysfs_param+0xfb/0x120 [ 280.012869][ T6282] param_sysfs_builtin+0x164/0x1e0 [ 280.017998][ T6282] param_sysfs_init+0x66/0x70 [ 280.022682][ T6282] do_one_initcall+0x1ee/0x680 [ 280.027464][ T6282] do_initcall_level+0x137/0x1f0 [ 280.032409][ T6282] do_initcalls+0x4b/0x90 [ 280.036742][ T6282] kernel_init_freeable+0x3ce/0x560 [ 280.041954][ T6282] kernel_init+0x19/0x1b0 [ 280.046281][ T6282] page_owner free stack trace missing [ 280.051642][ T6282] [ 280.053981][ T6282] Memory state around the buggy address: [ 280.059619][ T6282] ffff8881431c3d80: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 280.067684][ T6282] ffff8881431c3e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 280.075761][ T6282] >ffff8881431c3e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 280.083824][ T6282] ^ [ 280.089713][ T6282] ffff8881431c3f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 280.097778][ T6282] ffff8881431c3f80: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 280.105846][ T6282] ================================================================== [ 280.113923][ T6282] Disabling lock debugging due to kernel taint [ 280.204072][ T6282] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 280.211435][ T6282] CPU: 0 PID: 6282 Comm: syz.0.581 Tainted: G B syzkaller #0 [ 280.220136][ T6282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 280.230204][ T6282] Call Trace: [ 280.233499][ T6282] [ 280.236440][ T6282] dump_stack_lvl+0x168/0x230 [ 280.241135][ T6282] ? show_regs_print_info+0x20/0x20 [ 280.246341][ T6282] ? load_image+0x3b0/0x3b0 [ 280.250863][ T6282] panic+0x2c9/0x7f0 [ 280.254768][ T6282] ? bpf_jit_dump+0xd0/0xd0 [ 280.259281][ T6282] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 280.265195][ T6282] ? _raw_spin_unlock+0x40/0x40 [ 280.270048][ T6282] ? ax25_dev_device_down+0x35e/0x520 [ 280.275421][ T6282] check_panic_on_warn+0x80/0xa0 [ 280.280361][ T6282] ? ax25_dev_device_down+0x35e/0x520 [ 280.285732][ T6282] end_report+0x6d/0xf0 [ 280.289885][ T6282] kasan_report+0x102/0x130 [ 280.294402][ T6282] ? ax25_dev_device_down+0x35e/0x520 [ 280.299786][ T6282] ? kfree+0xef/0x2a0 [ 280.303770][ T6282] kasan_check_range+0x27b/0x290 [ 280.308712][ T6282] ax25_dev_device_down+0x35e/0x520 [ 280.313921][ T6282] ax25_device_event+0x4b4/0x4f0 [ 280.318869][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 280.324256][ T6282] dev_close_many+0x28d/0x400 [ 280.328966][ T6282] ? _raw_spin_unlock+0x40/0x40 [ 280.333823][ T6282] ? __dev_open+0x420/0x420 [ 280.338335][ T6282] ? bond_netdev_event+0x159/0xea0 [ 280.343462][ T6282] ? try_to_del_timer_sync+0x165/0x1b0 [ 280.348931][ T6282] dev_close+0x14c/0x200 [ 280.353187][ T6282] ? __dev_close_many+0x2a0/0x2a0 [ 280.358245][ T6282] ? macvlan_device_event+0x10b/0x930 [ 280.363633][ T6282] bpq_device_event+0x2f4/0x9c0 [ 280.368497][ T6282] ? lockdep_rtnl_is_held+0x22/0x30 [ 280.373723][ T6282] ? team_device_event+0x11b/0x9e0 [ 280.378858][ T6282] raw_notifier_call_chain+0xcb/0x160 [ 280.384247][ T6282] dev_close_many+0x28d/0x400 [ 280.388932][ T6282] ? __dev_open+0x420/0x420 [ 280.393440][ T6282] ? lock_chain_count+0x20/0x20 [ 280.398296][ T6282] ? lockdep_hardirqs_on_prepare+0x760/0x760 [ 280.404293][ T6282] dev_close+0x14c/0x200 [ 280.408538][ T6282] ? __dev_close_many+0x2a0/0x2a0 [ 280.413578][ T6282] ? __local_bh_enable_ip+0x12a/0x1b0 [ 280.418970][ T6282] ? _local_bh_enable+0xa0/0xa0 [ 280.423831][ T6282] bond_setup_by_slave+0x61/0x3a0 [ 280.428863][ T6282] bond_enslave+0x77c/0x3a40 [ 280.433460][ T6282] ? stack_trace_save+0x98/0xe0 [ 280.438332][ T6282] ? slab_free_freelist_hook+0xea/0x170 [ 280.443900][ T6282] ? verify_lock_unused+0x140/0x140 [ 280.449107][ T6282] ? mark_lock+0x94/0x320 [ 280.453455][ T6282] ? bond_lower_state_changed+0x150/0x150 [ 280.459183][ T6282] ? __lock_acquire+0x12d9/0x7c60 [ 280.464214][ T6282] ? apparmor_capable+0x12c/0x190 [ 280.469254][ T6282] ? bpf_lsm_capable+0x5/0x10 [ 280.473936][ T6282] ? full_name_hash+0x8e/0xe0 [ 280.478625][ T6282] bond_do_ioctl+0x2a2/0x8c0 [ 280.483219][ T6282] ? bond_eth_ioctl+0x200/0x200 [ 280.488077][ T6282] ? rcu_lock_release+0x20/0x20 [ 280.492958][ T6282] ? lock_chain_count+0x20/0x20 [ 280.497821][ T6282] ? dev_ioctl+0x54e/0xe50 [ 280.502247][ T6282] ? dev_ioctl+0x54e/0xe50 [ 280.506669][ T6282] ? dev_ioctl+0x54e/0xe50 [ 280.511090][ T6282] ? __mutex_lock_common+0x431/0x2390 [ 280.516477][ T6282] ? full_name_hash+0x8e/0xe0 [ 280.521168][ T6282] ? dev_siocbond+0xcf/0x100 [ 280.525775][ T6282] dev_ifsioc+0xc01/0xe70 [ 280.530120][ T6282] ? dev_ioctl+0xe50/0xe50 [ 280.534544][ T6282] ? apparmor_capable+0x12c/0x190 [ 280.539595][ T6282] ? full_name_hash+0x8e/0xe0 [ 280.544285][ T6282] dev_ioctl+0x55f/0xe50 [ 280.548540][ T6282] ? _copy_from_user+0x111/0x170 [ 280.553493][ T6282] sock_do_ioctl+0x222/0x2f0 [ 280.558120][ T6282] ? sock_show_fdinfo+0xb0/0xb0 [ 280.562981][ T6282] sock_ioctl+0x4ed/0x6e0 [ 280.567322][ T6282] ? sock_poll+0x3f0/0x3f0 [ 280.571768][ T6282] ? bpf_lsm_file_ioctl+0x5/0x10 [ 280.576717][ T6282] ? security_file_ioctl+0x7c/0xa0 [ 280.581843][ T6282] ? sock_poll+0x3f0/0x3f0 [ 280.586263][ T6282] __se_sys_ioctl+0xfa/0x170 [ 280.590862][ T6282] do_syscall_64+0x4c/0xa0 [ 280.595292][ T6282] ? clear_bhb_loop+0x30/0x80 [ 280.599974][ T6282] ? clear_bhb_loop+0x30/0x80 [ 280.604662][ T6282] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 280.610569][ T6282] RIP: 0033:0x7fa0e4910749 [ 280.614997][ T6282] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 280.634617][ T6282] RSP: 002b:00007fa0e2b77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 280.643030][ T6282] RAX: ffffffffffffffda RBX: 00007fa0e4b66fa0 RCX: 00007fa0e4910749 [ 280.651007][ T6282] RDX: 0000200000000180 RSI: 0000000000008990 RDI: 0000000000000005 [ 280.658996][ T6282] RBP: 00007fa0e4994f91 R08: 0000000000000000 R09: 0000000000000000 [ 280.666974][ T6282] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 280.674991][ T6282] R13: 00007fa0e4b67038 R14: 00007fa0e4b66fa0 R15: 00007ffc1b6f9c28 [ 280.683155][ T6282] [ 280.686564][ T6282] Kernel Offset: disabled [ 280.691174][ T6282] Rebooting in 86400 seconds..