last executing test programs: 4m13.496047068s ago: executing program 2 (id=3): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) shmdt(0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r6, r6, 0x0, 0x200000) 4m11.688096031s ago: executing program 2 (id=9): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) memfd_create(0x0, 0x2) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x21, 0x0) 4m9.693355576s ago: executing program 2 (id=10): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) openat$sndseq(0xffffffffffffff9c, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newtaction={0x8c, 0x30, 0x1, 0x0, 0x0, {}, [{0x78, 0x1, [@m_ct={0x2c, 0x2, 0x0, 0x0, {{0x7}, {0x4}, {0x4, 0x2}, {0xc}, {0xc}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0xfffffffffffffffe, 0x4}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x8c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e2eafb9fdd672bad09dfb78c7699c74e82fa0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 4m7.924962232s ago: executing program 2 (id=12): syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x100}, 0x0) select(0x2a, 0x0, 0x0, &(0x7f0000000400)={0xfefdffffffffffff, 0x1, 0x2, 0x300}, &(0x7f0000000440)={0x0, 0x2710}) 4m6.576434638s ago: executing program 2 (id=13): socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000280)='g', 0x1, 0x4008891, &(0x7f000005ffe4)={0xa, 0x0, 0x202, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x41}, 0x1c) recvmmsg(r2, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 3m51.39543987s ago: executing program 32 (id=13): socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000280)='g', 0x1, 0x4008891, &(0x7f000005ffe4)={0xa, 0x0, 0x202, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x41}, 0x1c) recvmmsg(r2, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 1m20.896601471s ago: executing program 5 (id=191): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, 0x0, 0x0) sendto(r0, &(0x7f0000000740)="50fbdf12a30d7a48b2c5c84948f3426077a9f0ca1475183db3bf52a6b2cdb77ef9af2a603a3e78adff59fbb22bae1b2443011fd801251bcef8f165533aac58c7556dd51edc5a6865d4e29f0bbd0ed602050000000000002944de604d849a1e3b32905b0d26e9ff34b83f38a2ae8b1c6748ef8b87ef2a359249c3e294931489ba57f83f96048684434854ab3b6ad59f45e832972639508fe4dcb371c013bc129572e996a7db94fae8d71a076ec54a28a926e37c7a678a5e16c121f27527bf75fb49d3", 0xc2, 0x0, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f00000003c0)='}', 0x1) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x52, 0x0, 0x0) 1m20.218867023s ago: executing program 5 (id=192): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x6, 0x200) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000000c0)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT32(0xffffffffffffffff, 0xc06c4124, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) r6 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$MRT6(r6, 0x29, 0xcf, 0x0, 0x0) r7 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r7, 0x2007ffb) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x40e02, 0x8) r9 = creat(&(0x7f0000000500)='./bus\x00', 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x15, 0x0, 0x0, &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x100, 0x4, '\x00', 0x0, @fallback=0x24, r8, 0x8, &(0x7f0000000480)={0x4, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000800)=[0xffffffffffffffff]}, 0x94) syz_open_dev$sg(0x0, 0x0, 0x401) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_SET_MSRS(r9, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000070100400020000000020000000000004898ed5c80ab7cd833c544951fea3a29c290"]) r10 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r10) ioctl$VIDIOC_LOG_STATUS(r0, 0x5646, 0x0) 1m15.220744688s ago: executing program 5 (id=200): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x21, 0x0) 1m13.875728812s ago: executing program 5 (id=201): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r3 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/vlan/config\x00') socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) sendmsg$tipc(r4, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) read$char_usb(r3, &(0x7f0000000240)=""/9, 0x9) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$fuse(0x0, &(0x7f00000020c0)='.\x00', &(0x7f0000000000), 0x0, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000200)={0x101602, 0x3, 0x1}, 0x18) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xd3d7, 0x2) 1m5.118594193s ago: executing program 5 (id=210): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0x0, 0x0, 0x33565348, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 1m3.704299353s ago: executing program 5 (id=212): clock_adjtime(0x3, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120c000200040001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x52}, 0x8) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) madvise(&(0x7f0000304000/0x3000)=nil, 0x3000, 0x9) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x40, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) close(0xffffffffffffffff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x14) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$cont(0x11, r6, 0x10000000000005, 0xfffffffffffffffa) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 51.272332654s ago: executing program 1 (id=224): socket$kcm(0x11, 0x3, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1000000000000010, 0x80802, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e008000000008", @ANYRES16=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 48.996100706s ago: executing program 1 (id=228): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000003, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15}, 0x94) socket$inet_udp(0x2, 0x2, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="240000006800010000000000000000000200000000000000080006000100000004000b"], 0x24}}, 0x4004094) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, 0x0) 47.612503327s ago: executing program 33 (id=212): clock_adjtime(0x3, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120c000200040001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x52}, 0x8) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) madvise(&(0x7f0000304000/0x3000)=nil, 0x3000, 0x9) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x40, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) close(0xffffffffffffffff) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x14) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x2) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$cont(0x11, r6, 0x10000000000005, 0xfffffffffffffffa) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 43.044457412s ago: executing program 1 (id=235): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0x0, 0x0, 0x33565348, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 41.609206392s ago: executing program 1 (id=238): socket$kcm(0x11, 0x3, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1000000000000010, 0x80802, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000700fc000000080011000700000008000e008000000008", @ANYRES16=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 40.053054888s ago: executing program 1 (id=241): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x7a6f938d2aadffed, 0x300) r3 = socket$kcm(0x2b, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x58, 0x0, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_TYPE={0x8}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x58}}, 0x0) socket$kcm(0x10, 0x2, 0x0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000300)='kmem_cache_free\x00'}, 0x18) r6 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r6, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f00000000c0)={'ni_at_a2150\x00', [0x4f27, 0x5, 0x10000, 0x2f, 0x66, 0xcc7, 0x5, 0x80007, 0xa, 0x100, 0x9, 0x1, 0x1db, 0x5, 0x0, 0x80000101, 0x5, 0x1a449, 0x3, 0x40020003, 0x208d, 0x2, 0xd27, 0xae, 0x7fff, 0x8, 0x3c, 0x1, 0x6, 0x0, 0x1000000]}) 34.162546167s ago: executing program 1 (id=245): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000080)={{0x3, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_STOP(r4, 0x54a1) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) unshare(0x64000600) 18.790166593s ago: executing program 34 (id=245): prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r4, 0x40345410, &(0x7f0000000080)={{0x3, 0x1}}) ioctl$SNDRV_TIMER_IOCTL_START(r4, 0x54a0) ioctl$SNDRV_TIMER_IOCTL_STOP(r4, 0x54a1) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, 0x0, 0x18) unshare(0x64000600) 18.108679074s ago: executing program 0 (id=264): syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='oom_score_adj\x00') r0 = socket$packet(0x11, 0x2, 0x300) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x5) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000480)='./file0\x00', 0x103680, 0x20) open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) inotify_init1(0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000c0000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="440000000906010200120000000c0000000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c00028008000140"], 0x44}, 0x1, 0x0, 0x0, 0x10008086}, 0x4000050) ftruncate(r3, 0x2000009) creat(&(0x7f0000000000)='./bus\x00', 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) write$usbip_server(r5, 0x0, 0x0) sendmmsg$inet(r2, 0x0, 0x0, 0x20008040) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x0, &(0x7f0000000080)}, 0x10) 14.910426669s ago: executing program 4 (id=266): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x5, 0x36, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000040)='P') 14.039389422s ago: executing program 0 (id=267): socketpair$unix(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) shmdt(0x0) setns(0xffffffffffffffff, 0x24020000) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r1, r1, 0x0, 0x200000) 13.458761349s ago: executing program 0 (id=268): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0xa, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) read$msr(r0, &(0x7f0000002240)=""/102400, 0x19000) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x0) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000080)={0x1, 0x0, 0x1, &(0x7f0000000000)={0x1f, "06c4ce00000000006eb5e52829e7cc839300000400"}}) open(0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x401, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4}]}, @IFLA_IFNAME={0x14, 0x3, 'ip6gre0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x840}, 0x0) 12.556544268s ago: executing program 3 (id=269): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r4 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0x0, 0x0, 0x33565348, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 12.545091221s ago: executing program 4 (id=270): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) memfd_create(0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x21, 0x0) 11.121296987s ago: executing program 3 (id=271): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 10.8574267s ago: executing program 4 (id=272): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='cramfs\x00', 0x800, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='btrfs\x00', 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c00000058000701fefffffffcffffff017c0000040042801000018006000600800a00000400008004000280"], 0x2c}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000e27f000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000134c2651638af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000e80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x19}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) epoll_create1(0x0) syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x100}, &(0x7f0000000040), &(0x7f0000000000)) 10.066045106s ago: executing program 4 (id=273): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r2, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) r3 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/vlan/config\x00') socket$inet_mptcp(0x2, 0x1, 0x106) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) sendmsg$tipc(r4, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) read$char_usb(r3, &(0x7f0000000240)=""/9, 0x9) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='.\x00', &(0x7f0000000000), 0x0, 0x0) openat2$dir(0xffffffffffffff9c, 0x0, &(0x7f0000000200)={0x101602, 0x3, 0x1}, 0x18) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xd3d7, 0x2) 7.817849078s ago: executing program 3 (id=274): mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0x118810, 0xffffffffffffffff, 0x2d74000) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x40000000000029d, 0x832b, 0x0) recvfrom$inet6(r0, 0x0, 0x0, 0x1, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000280)=""/239, 0xef) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000180)="b6", 0x1}], 0x1) syz_usb_disconnect(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000380)={'wlan0\x00', 0x0}) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f000009de40), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f000009de80)={0x1, 0x2, 0x0, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) syz_clone(0x200000, &(0x7f00000005c0)="898daad2c55b060bf2cd986fdd55e72d5fad44af4029b1e71cb02fd0bc334ae5c57a6038858c5dc9f4efc9ee3307489eb941e2addee5d317799db34cad57579dd18bd2eba822854cba43318e6902bd7e9cfa363f6d7a1e1d0b07003115781cdc8e8d3fb7055118c2d9b74adefd857b87f30908c94e14674f489bdea047c4363a8051", 0x82, &(0x7f0000000040), 0x0, &(0x7f0000000140)="289f9b4014ed3e3fc5") madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x10) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r5, &(0x7f0000000580)='1\x00', 0x2) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYRESHEX], 0x0) write$sysctl(r5, &(0x7f0000000000)='2\x00', 0x2) bind$inet6(0xffffffffffffffff, &(0x7f00000003c0)={0xa, 0x4e21, 0xff, @mcast2, 0x7f}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f00000008c0), 0x4) 7.580637697s ago: executing program 4 (id=275): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDGKBDIACR(r6, 0x4bfa, &(0x7f00000000c0)=""/239) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd25, 0x25df9bfb, {0x0, 0x0, 0x0, r8, {0xd, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x54, 0x2, [@TCA_ROUTE4_ACT={0x50, 0x6, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x5, 0x20, 0x7, 0x8}, 0x39}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xfc, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4014}, 0x4c094) r9 = socket(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000003c0)) sendmsg$nl_route_sched(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x70bd2c, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}, {0x5, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) 4.366293259s ago: executing program 3 (id=276): socketpair$unix(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x18, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) shmdt(0x0) setns(0xffffffffffffffff, 0x24020000) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r3, r3, 0x0, 0x200000) 3.268650258s ago: executing program 3 (id=277): syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @random="08c82553c54d", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x65, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local}, {{0xffff, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000bd3000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f00000000c0)) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.955862351s ago: executing program 4 (id=278): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x5, 0x36, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f0000000040)='P') 2.854489719s ago: executing program 0 (id=279): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42400) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) r4 = syz_open_dev$video(0x0, 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f00000002c0)={0x9, @pix={0x0, 0x0, 0x33565348, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}) 1.520347849s ago: executing program 0 (id=280): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) memfd_create(0x0, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0xfffffffe}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x21, 0x0) 1.430948474s ago: executing program 3 (id=281): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='cramfs\x00', 0x800, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mount(&(0x7f0000000100)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='btrfs\x00', 0x5, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c00000058000701fefffffffcffffff017c0000040042801000018006000600800a00000400008004000280"], 0x2c}, 0x1, 0x0, 0x0, 0x4000c000}, 0xc000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000e27f000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000134c2651638af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000e80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x19}, @NFTA_SYNPROXY_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) epoll_create1(0x0) syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x100}, &(0x7f0000000040), &(0x7f0000000000)) 0s ago: executing program 0 (id=282): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x11, 0x19, 0x0, &(0x7f0000000000)='GPL\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x1}, 0x94) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000540)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0xffff, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7}]}, &(0x7f0000000240)=0xc) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r4, @in={{0x2, 0x4e22, @private=0xa010102}}}, &(0x7f0000000040)=0x84) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e6, &(0x7f0000000240)="7c773d39aeef000000006dcffe32d6e49f") ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448e7, &(0x7f0000000080)) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001640)=@newtaction={0xf0, 0x30, 0x1, 0x2, 0x25dfdbfc, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x2, 0x0, 0x446, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, 0xfffffffd, 0x0, 0x2}}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x401, 0x1, 0x0, {0x0, 0x0, 0x0, 0x401}, {0x0, 0x0, 0x1}}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x8010}, 0x2000000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.244' (ED25519) to the list of known hosts. [ 91.162912][ T5824] cgroup: Unknown subsys name 'net' [ 91.402236][ T5824] cgroup: Unknown subsys name 'cpuset' [ 91.436811][ T5824] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.104038][ T10] cfg80211: failed to load regulatory.db [ 93.568472][ T5824] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.139385][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.186699][ T5845] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.187596][ T5845] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.188909][ T5845] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.196856][ T5845] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.218148][ T5846] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 98.223687][ T5841] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 98.227285][ T5851] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 98.231215][ T5846] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 98.236573][ T5846] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 98.237100][ T5846] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 98.238928][ T5852] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 98.239379][ T5852] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 98.256557][ T5851] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 98.257546][ T5851] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 98.262119][ T5845] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 98.273327][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 98.286289][ T59] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 98.338591][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 98.339515][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 98.343362][ T5155] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 98.345950][ T5155] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 98.348182][ T5155] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 98.349596][ T5155] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 98.364823][ T5845] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 99.240568][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 99.604156][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 99.615084][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 99.664010][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 99.672749][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 100.248185][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.249201][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.249647][ T5836] bridge_slave_0: entered allmulticast mode [ 100.251809][ T5836] bridge_slave_0: entered promiscuous mode [ 100.257023][ T5840] Bluetooth: hci0: command tx timeout [ 100.320364][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.320514][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.321040][ T5836] bridge_slave_1: entered allmulticast mode [ 100.323965][ T5836] bridge_slave_1: entered promiscuous mode [ 100.336451][ T5840] Bluetooth: hci1: command tx timeout [ 100.336551][ T5840] Bluetooth: hci4: command tx timeout [ 100.416270][ T5845] Bluetooth: hci2: command tx timeout [ 100.416482][ T5845] Bluetooth: hci3: command tx timeout [ 100.982237][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.067165][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.067335][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.067477][ T5844] bridge_slave_0: entered allmulticast mode [ 101.069420][ T5844] bridge_slave_0: entered promiscuous mode [ 101.072173][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.072321][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.072505][ T5837] bridge_slave_0: entered allmulticast mode [ 101.074628][ T5837] bridge_slave_0: entered promiscuous mode [ 101.181427][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.247907][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.248082][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.248282][ T5844] bridge_slave_1: entered allmulticast mode [ 101.251327][ T5844] bridge_slave_1: entered promiscuous mode [ 101.254197][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.254343][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.254531][ T5837] bridge_slave_1: entered allmulticast mode [ 101.259816][ T5837] bridge_slave_1: entered promiscuous mode [ 101.261593][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.261815][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.262027][ T5847] bridge_slave_0: entered allmulticast mode [ 101.265249][ T5847] bridge_slave_0: entered promiscuous mode [ 101.342585][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.342710][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.342847][ T5843] bridge_slave_0: entered allmulticast mode [ 101.344727][ T5843] bridge_slave_0: entered promiscuous mode [ 101.497143][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.497278][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.497421][ T5847] bridge_slave_1: entered allmulticast mode [ 101.499408][ T5847] bridge_slave_1: entered promiscuous mode [ 101.658917][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.659039][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.659193][ T5843] bridge_slave_1: entered allmulticast mode [ 101.661145][ T5843] bridge_slave_1: entered promiscuous mode [ 101.875426][ T5836] team0: Port device team_slave_0 added [ 101.953210][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.961004][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.040557][ T5836] team0: Port device team_slave_1 added [ 102.111029][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.125430][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.148060][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.234243][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.336286][ T5840] Bluetooth: hci0: command tx timeout [ 102.360584][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.416471][ T5840] Bluetooth: hci4: command tx timeout [ 102.416483][ T5845] Bluetooth: hci1: command tx timeout [ 102.452367][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.506328][ T5840] Bluetooth: hci3: command tx timeout [ 102.506366][ T5840] Bluetooth: hci2: command tx timeout [ 102.673587][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.673600][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 102.673618][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.780194][ T5844] team0: Port device team_slave_0 added [ 102.971268][ T5837] team0: Port device team_slave_0 added [ 103.049758][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.049776][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.049804][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.170208][ T5844] team0: Port device team_slave_1 added [ 103.172318][ T5837] team0: Port device team_slave_1 added [ 103.174311][ T5847] team0: Port device team_slave_0 added [ 103.192435][ T5843] team0: Port device team_slave_0 added [ 103.340008][ T5847] team0: Port device team_slave_1 added [ 103.345333][ T5843] team0: Port device team_slave_1 added [ 103.698831][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.698849][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.698875][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.701592][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.701607][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.701635][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.941862][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.941881][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.941909][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.943214][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.943228][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.943246][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.944311][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.944322][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.944340][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.139526][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.139543][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.139571][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.164938][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.164954][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.164983][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.179837][ T5836] hsr_slave_0: entered promiscuous mode [ 104.181678][ T5836] hsr_slave_1: entered promiscuous mode [ 104.185369][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.185387][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.185418][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.416339][ T5845] Bluetooth: hci0: command tx timeout [ 104.496278][ T5845] Bluetooth: hci4: command tx timeout [ 104.496317][ T5845] Bluetooth: hci1: command tx timeout [ 104.576229][ T5845] Bluetooth: hci3: command tx timeout [ 104.576265][ T5845] Bluetooth: hci2: command tx timeout [ 104.718563][ T5844] hsr_slave_0: entered promiscuous mode [ 104.720039][ T5844] hsr_slave_1: entered promiscuous mode [ 104.721264][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 104.721393][ T5844] Cannot create hsr debugfs directory [ 104.897249][ T5837] hsr_slave_0: entered promiscuous mode [ 104.898699][ T5837] hsr_slave_1: entered promiscuous mode [ 104.899821][ T5837] debugfs: 'hsr0' already exists in 'hsr' [ 104.899847][ T5837] Cannot create hsr debugfs directory [ 104.988752][ T5847] hsr_slave_0: entered promiscuous mode [ 104.989792][ T5847] hsr_slave_1: entered promiscuous mode [ 104.990429][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 104.990454][ T5847] Cannot create hsr debugfs directory [ 105.273594][ T5843] hsr_slave_0: entered promiscuous mode [ 105.274539][ T5843] hsr_slave_1: entered promiscuous mode [ 105.275198][ T5843] debugfs: 'hsr0' already exists in 'hsr' [ 105.275221][ T5843] Cannot create hsr debugfs directory [ 106.496242][ T5840] Bluetooth: hci0: command tx timeout [ 106.576376][ T5840] Bluetooth: hci1: command tx timeout [ 106.576408][ T5840] Bluetooth: hci4: command tx timeout [ 106.656351][ T5845] Bluetooth: hci2: command tx timeout [ 106.656385][ T5845] Bluetooth: hci3: command tx timeout [ 106.834843][ T5836] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 106.891574][ T5836] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 106.933631][ T5836] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 106.993723][ T5836] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 107.138778][ T5844] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 107.188025][ T5844] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 107.231541][ T5844] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 107.280506][ T5844] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 107.451962][ T5837] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 107.501239][ T5837] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 107.551182][ T5837] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 107.609291][ T5837] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 107.769395][ T5847] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.823136][ T5847] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.876167][ T5847] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.982346][ T5847] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 108.148822][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.183771][ T5843] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 108.233876][ T5843] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 108.274736][ T5843] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 108.314640][ T5843] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 108.407148][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.435750][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.476770][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.476909][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.523773][ T3584] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.524056][ T3584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.589464][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.642711][ T1220] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.642926][ T1220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.663690][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.703458][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.703662][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.805364][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.835168][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.866632][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.868076][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.970605][ T3584] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.970857][ T3584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.051429][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.106897][ T3584] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.107101][ T3584] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.185588][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 109.198556][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.198717][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.407224][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.458312][ T3584] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.458464][ T3584] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.501623][ T3584] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.502365][ T3584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.533027][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.940316][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.363847][ T5844] veth0_vlan: entered promiscuous mode [ 110.432247][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.464652][ T5844] veth1_vlan: entered promiscuous mode [ 110.508990][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.654884][ T5836] veth0_vlan: entered promiscuous mode [ 110.680505][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.698258][ T5844] veth0_macvtap: entered promiscuous mode [ 110.739707][ T5844] veth1_macvtap: entered promiscuous mode [ 110.753118][ T5837] veth0_vlan: entered promiscuous mode [ 110.759657][ T5836] veth1_vlan: entered promiscuous mode [ 110.825349][ T5837] veth1_vlan: entered promiscuous mode [ 110.832717][ T5847] veth0_vlan: entered promiscuous mode [ 110.864049][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.895410][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.930929][ T5847] veth1_vlan: entered promiscuous mode [ 110.963178][ T1220] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.980965][ T1220] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.000865][ T1220] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.017327][ T1220] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.022570][ T5843] veth0_vlan: entered promiscuous mode [ 111.040158][ T5836] veth0_macvtap: entered promiscuous mode [ 111.113465][ T5836] veth1_macvtap: entered promiscuous mode [ 111.170367][ T5843] veth1_vlan: entered promiscuous mode [ 111.172484][ T5837] veth0_macvtap: entered promiscuous mode [ 111.286146][ T5837] veth1_macvtap: entered promiscuous mode [ 111.329952][ T5847] veth0_macvtap: entered promiscuous mode [ 111.403645][ T5847] veth1_macvtap: entered promiscuous mode [ 111.413960][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.450884][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.450911][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.483634][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.495639][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.568148][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.568473][ T1220] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.595102][ T1220] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.614285][ T1220] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.634423][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.635683][ T1220] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.635880][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.635896][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.684403][ T5843] veth0_macvtap: entered promiscuous mode [ 111.699845][ T1220] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.704523][ T1220] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.711837][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.755301][ T1220] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.778392][ T1220] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.782338][ T5843] veth1_macvtap: entered promiscuous mode [ 111.932384][ T3518] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.940466][ T3518] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.943281][ T3518] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.953940][ T3518] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.560144][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.638931][ T1220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.638954][ T1220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.733036][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.001794][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.001814][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.056081][ T1167] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.064787][ T3518] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.084001][ T3518] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.158848][ T3518] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.187616][ T3518] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.187637][ T3518] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.383720][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.383742][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.329502][ C1] vkms_vblank_simulate: vblank timer overrun [ 115.517365][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.517387][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.602406][ T2991] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.602428][ T2991] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.726610][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 115.946706][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 115.987640][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 115.987662][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.036080][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 116.487325][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 116.491334][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 116.706097][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 116.968252][ T1167] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.968273][ T1167] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.070157][ C1] vkms_vblank_simulate: vblank timer overrun [ 118.156100][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 118.156148][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 118.156187][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 118.156225][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.078529][ C1] vkms_vblank_simulate: vblank timer overrun [ 119.243340][ C1] vkms_vblank_simulate: vblank timer overrun [ 119.619767][ T5995] Bluetooth: MGMT ver 1.23 [ 122.769483][ T6006] ubi0: attaching mtd0 [ 122.850757][ T6006] ubi0: scanning is finished [ 122.850778][ T6006] ubi0: empty MTD device detected [ 124.692057][ T6006] ubi0 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt0d", error -4 [ 125.317498][ C0] vkms_vblank_simulate: vblank timer overrun [ 125.629374][ C0] vkms_vblank_simulate: vblank timer overrun [ 126.458146][ C0] vkms_vblank_simulate: vblank timer overrun [ 127.610252][ C0] vkms_vblank_simulate: vblank timer overrun [ 127.950153][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.051006][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.376783][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.542776][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.595059][ C0] vkms_vblank_simulate: vblank timer overrun [ 129.113044][ C0] vkms_vblank_simulate: vblank timer overrun [ 131.550300][ T6057] block nbd1: shutting down sockets [ 133.039644][ T6065] vivid-000: kernel_thread() failed [ 133.175598][ T6062] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 138.094470][ T6084] mmap: syz.4.25 (6084) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 138.640808][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.642416][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 143.067350][ T5845] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 143.071812][ T5845] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 143.072850][ T5845] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 143.159755][ T5845] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 143.162674][ T5845] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 146.131444][ T6122] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 146.136975][ T6122] cramfs: wrong magic [ 148.405743][ T5840] Bluetooth: hci5: command tx timeout [ 150.417224][ T5840] Bluetooth: hci5: command tx timeout [ 151.096452][ T6002] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 151.298153][ T6002] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 151.298181][ T6002] usb 5-1: config 0 has no interface number 0 [ 151.304754][ T6002] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 151.304782][ T6002] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.304801][ T6002] usb 5-1: Product: syz [ 151.304814][ T6002] usb 5-1: Manufacturer: syz [ 151.304829][ T6002] usb 5-1: SerialNumber: syz [ 151.768721][ T6002] usb 5-1: config 0 descriptor?? [ 152.726099][ T5840] Bluetooth: hci5: command tx timeout [ 153.183360][ T6002] usb 5-1: can't set config #0, error -71 [ 153.429303][ T6002] usb 5-1: USB disconnect, device number 2 [ 153.678540][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 153.838231][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 153.841110][ T10] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 153.841137][ T10] usb 1-1: config 0 has no interface number 0 [ 153.841188][ T10] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 153.841213][ T10] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 153.841239][ T10] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 153.841266][ T10] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 153.841311][ T10] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 153.841336][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 153.971714][ T10] usb 1-1: config 0 descriptor?? [ 154.049411][ T10] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 154.176786][ T6002] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 154.336202][ T6002] usb 5-1: Using ep0 maxpacket: 8 [ 154.364003][ T6002] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 154.364034][ T6002] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.364056][ T6002] usb 5-1: Product: syz [ 154.364072][ T6002] usb 5-1: Manufacturer: syz [ 154.364087][ T6002] usb 5-1: SerialNumber: syz [ 154.418806][ T6002] usb 5-1: config 0 descriptor?? [ 154.819084][ T5840] Bluetooth: hci5: command tx timeout [ 154.864171][ T6002] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 155.834766][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.879726][ T45] usb 1-1: USB disconnect, device number 2 [ 155.889285][ T6002] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 156.098779][ T45] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 160.128058][ T6039] usb 5-1: USB disconnect, device number 3 [ 162.398789][ T6189] block nbd3: shutting down sockets [ 162.820259][ T6202] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 162.864326][ T6202] cramfs: wrong magic [ 163.752832][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.016403][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.981166][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 171.716204][ T6039] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 171.906060][ T6039] usb 4-1: Using ep0 maxpacket: 8 [ 171.914909][ T6039] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 171.914931][ T6039] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.914945][ T6039] usb 4-1: Product: syz [ 171.914955][ T6039] usb 4-1: Manufacturer: syz [ 171.914966][ T6039] usb 4-1: SerialNumber: syz [ 172.031888][ T6039] usb 4-1: config 0 descriptor?? [ 172.254624][ T6039] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 172.480628][ T6237] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 172.496907][ T6237] cramfs: wrong magic [ 173.177918][ T6237] vivid-000: kernel_thread() failed [ 173.266823][ T6039] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 174.046602][ T6108] chnl_net:caif_netlink_parms(): no params data found [ 175.362581][ T45] usb 4-1: USB disconnect, device number 2 [ 179.201649][ T13] bridge_slave_1: left allmulticast mode [ 179.201770][ T13] bridge_slave_1: left promiscuous mode [ 179.203528][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.380710][ T13] bridge_slave_0: left allmulticast mode [ 179.380744][ T13] bridge_slave_0: left promiscuous mode [ 179.381012][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.809300][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 183.994064][ T6284] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 183.995090][ T6284] cramfs: wrong magic [ 184.316824][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 184.349408][ T13] bond0 (unregistering): Released all slaves [ 185.231215][ T6108] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.231427][ T6108] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.233068][ T6108] bridge_slave_0: entered allmulticast mode [ 185.267474][ T6108] bridge_slave_0: entered promiscuous mode [ 185.290721][ T6108] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.290866][ T6108] bridge0: port 2(bridge_slave_1) entered disabled state [ 185.291063][ T6108] bridge_slave_1: entered allmulticast mode [ 185.295290][ T6108] bridge_slave_1: entered promiscuous mode [ 185.347276][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 185.541143][ T10] usb 4-1: Using ep0 maxpacket: 8 [ 185.566794][ T10] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 185.566825][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.566847][ T10] usb 4-1: Product: syz [ 185.566861][ T10] usb 4-1: Manufacturer: syz [ 185.566876][ T10] usb 4-1: SerialNumber: syz [ 185.714139][ T10] usb 4-1: config 0 descriptor?? [ 186.104142][ T10] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 186.521961][ T10] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 187.358046][ T6108] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 187.405430][ T6108] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 188.018307][ T5905] usb 4-1: USB disconnect, device number 3 [ 190.063061][ T6336] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 190.064316][ T6336] cramfs: wrong magic [ 190.663721][ T6343] ubi0: attaching mtd0 [ 190.672477][ T6343] ubi0: scanning is finished [ 191.237564][ T6343] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 191.237590][ T6343] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 191.237608][ T6343] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 191.237625][ T6343] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 191.237641][ T6343] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 191.237657][ T6343] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 191.237674][ T6343] ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 1720346938 [ 191.237694][ T6343] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 191.238987][ T6347] ubi0: background thread "ubi_bgt0d" started, PID 6347 [ 193.757817][ T6108] team0: Port device team_slave_0 added [ 193.782700][ T6108] team0: Port device team_slave_1 added [ 193.945856][ T13] hsr_slave_0: left promiscuous mode [ 194.004042][ T13] hsr_slave_1: left promiscuous mode [ 194.005079][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 194.005152][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 194.086263][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 194.086297][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 194.539163][ T13] veth1_macvtap: left promiscuous mode [ 194.539347][ T13] veth0_macvtap: left promiscuous mode [ 194.540074][ T13] veth1_vlan: left promiscuous mode [ 194.540344][ T13] veth0_vlan: left promiscuous mode [ 196.430979][ T6378] netlink: 8 bytes leftover after parsing attributes in process `syz.4.83'. [ 198.098281][ T13] team0 (unregistering): Port device team_slave_1 removed [ 198.298287][ T13] team0 (unregistering): Port device team_slave_0 removed [ 199.624475][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.624551][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.906576][ T45] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 201.076224][ T45] usb 2-1: Using ep0 maxpacket: 16 [ 201.080243][ T45] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 201.080294][ T45] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 201.080318][ T45] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 201.097269][ T45] usb 2-1: config 0 descriptor?? [ 201.908780][ T6390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.912826][ T6390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 202.121575][ T45] usbhid 2-1:0.0: can't add hid device: -71 [ 202.121709][ T45] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 202.145699][ T45] usb 2-1: USB disconnect, device number 2 [ 204.258478][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 204.264846][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 204.289135][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 204.290014][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 204.290572][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 205.256252][ T5920] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 205.406184][ T5920] usb 2-1: Using ep0 maxpacket: 8 [ 205.408987][ T5920] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.409019][ T5920] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 205.412300][ T5920] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 205.412329][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 205.412349][ T5920] usb 2-1: Product: syz [ 205.412364][ T5920] usb 2-1: Manufacturer: syz [ 205.412379][ T5920] usb 2-1: SerialNumber: syz [ 205.474403][ T5920] usb 2-1: config 0 descriptor?? [ 206.312152][ T13] bridge_slave_1: left allmulticast mode [ 206.312187][ T13] bridge_slave_1: left promiscuous mode [ 206.312490][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.338067][ T5840] Bluetooth: hci3: command tx timeout [ 206.437380][ T13] bridge_slave_0: left allmulticast mode [ 206.437404][ T13] bridge_slave_0: left promiscuous mode [ 206.437605][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.556154][ T45] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 206.762115][ T45] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 206.769392][ T45] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 206.769426][ T45] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.769451][ T45] usb 5-1: Product: syz [ 206.769469][ T45] usb 5-1: Manufacturer: syz [ 206.769486][ T45] usb 5-1: SerialNumber: syz [ 206.845471][ T45] usb 5-1: config 0 descriptor?? [ 207.043422][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 207.137861][ T45] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 207.179893][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 207.253033][ T6386] udevd[6386]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 207.294339][ T13] bond0 (unregistering): Released all slaves [ 207.457553][ T6417] chnl_net:caif_netlink_parms(): no params data found [ 207.613305][ T6457] netlink: 8 bytes leftover after parsing attributes in process `syz.3.95'. [ 208.275375][ T5928] usb 2-1: USB disconnect, device number 3 [ 208.422512][ T5840] Bluetooth: hci3: command tx timeout [ 209.081858][ T13] team0 (unregistering): Port device team_slave_1 removed [ 209.519048][ T9] usb 5-1: USB disconnect, device number 4 [ 209.660979][ T13] team0 (unregistering): Port device team_slave_0 removed [ 210.829775][ T5840] Bluetooth: hci3: command tx timeout [ 212.961167][ T5840] Bluetooth: hci3: command tx timeout [ 214.151995][ T6511] sg_write: data in/out 44633/14 bytes for SCSI command 0x0-- guessing data in; [ 214.151995][ T6511] program syz.0.105 not setting count and/or reply_len properly [ 214.411165][ T6417] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.417307][ T6417] bridge0: port 1(bridge_slave_0) entered disabled state [ 214.420154][ T6417] bridge_slave_0: entered allmulticast mode [ 214.431118][ T6417] bridge_slave_0: entered promiscuous mode [ 214.697333][ T6417] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.697478][ T6417] bridge0: port 2(bridge_slave_1) entered disabled state [ 214.697730][ T6417] bridge_slave_1: entered allmulticast mode [ 214.729156][ T6417] bridge_slave_1: entered promiscuous mode [ 215.538320][ T6512] debugfs: 'ttyS3' already exists in 'caif_serial' [ 215.722656][ T6417] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 215.754283][ T6417] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 216.491982][ T6417] team0: Port device team_slave_0 added [ 216.519998][ T6417] team0: Port device team_slave_1 added [ 218.523052][ T6417] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 218.523065][ T6417] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 218.523084][ T6417] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 218.597072][ T6417] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 218.597089][ T6417] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 218.597116][ T6417] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 219.027043][ T6529] debugfs: 'ttyS3' already exists in 'caif_serial' [ 219.397717][ T6417] hsr_slave_0: entered promiscuous mode [ 219.398725][ T6417] hsr_slave_1: entered promiscuous mode [ 219.436394][ T6417] debugfs: 'hsr0' already exists in 'hsr' [ 219.436427][ T6417] Cannot create hsr debugfs directory [ 222.176104][ T5155] Bluetooth: hci0: command 0x0406 tx timeout [ 222.176244][ T5155] Bluetooth: hci4: command 0x0406 tx timeout [ 222.176352][ T5155] Bluetooth: hci1: command 0x0406 tx timeout [ 222.176436][ T5155] Bluetooth: hci2: command 0x0406 tx timeout [ 222.520204][ T6417] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 222.676192][ T5928] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 222.836527][ T6417] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 222.852941][ T5928] usb 5-1: Using ep0 maxpacket: 16 [ 223.806933][ T5928] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 223.806986][ T5928] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 223.807007][ T5928] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.192340][ T6417] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 224.273945][ T5928] usb 5-1: config 0 descriptor?? [ 224.534210][ T6417] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 224.910519][ T5928] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 224.910560][ T5928] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 224.910588][ T5928] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 224.910615][ T5928] mcp2221 0003:04D8:00DD.0001: unknown main item tag 0x0 [ 224.912455][ T5928] mcp2221 0003:04D8:00DD.0001: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 225.000008][ T6556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 225.065616][ T6556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 225.075908][ C0] usb 5-1: input irq status -75 received [ 225.395643][ T6579] Lens A: ================= START STATUS ================= [ 225.396782][ T6579] Lens A: Focus, Absolute: 0 [ 225.396899][ T6579] Lens A: ================== END STATUS ================== [ 225.556140][ T45] usb 5-1: USB disconnect, device number 5 [ 226.013414][ T6417] 8021q: adding VLAN 0 to HW filter on device bond0 [ 226.123315][ T6417] 8021q: adding VLAN 0 to HW filter on device team0 [ 226.170216][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.170572][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.271886][ T1220] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.273229][ T1220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 228.857251][ T6604] netlink: 96 bytes leftover after parsing attributes in process `syz.0.118'. [ 229.057946][ T6605] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 229.791605][ T6604] syz.0.118 (6604) used greatest stack depth: 18552 bytes left [ 230.444099][ T6417] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 230.447070][ T5913] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 230.606076][ T5913] usb 1-1: Using ep0 maxpacket: 16 [ 230.610673][ T5913] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 230.610724][ T5913] usb 1-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 230.610749][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 230.654916][ T5913] usb 1-1: config 0 descriptor?? [ 231.170919][ T5913] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 231.170958][ T5913] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 231.170986][ T5913] mcp2221 0003:04D8:00DD.0002: unknown main item tag 0x0 [ 231.171937][ T5913] mcp2221 0003:04D8:00DD.0002: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.0-1/input0 [ 232.356835][ T6612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 232.357501][ T6612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 232.359669][ C1] usb 1-1: input irq status -75 received [ 232.652172][ T5913] usb 1-1: USB disconnect, device number 3 [ 233.518772][ T6417] veth0_vlan: entered promiscuous mode [ 234.116120][ T6039] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 234.459497][ T6039] usb 1-1: Using ep0 maxpacket: 8 [ 235.124639][ T6039] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 235.124698][ T6039] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 235.124723][ T6039] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 235.127499][ T6039] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 235.127553][ T6039] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 235.127577][ T6039] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 235.131512][ T6039] usb 1-1: config 168 has an invalid descriptor of length 0, skipping remainder of the config [ 235.131567][ T6039] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 235.131591][ T6039] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 235.251184][ T6039] usb 1-1: string descriptor 0 read error: -22 [ 235.251338][ T6039] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 235.251362][ T6039] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.392817][ T6039] adutux 1-1:168.0: interrupt endpoints not found [ 235.402405][ T6417] veth1_vlan: entered promiscuous mode [ 235.675403][ T6039] usb 1-1: USB disconnect, device number 4 [ 236.012302][ T6417] veth0_macvtap: entered promiscuous mode [ 236.048152][ T6417] veth1_macvtap: entered promiscuous mode [ 236.237688][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.239364][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.294923][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.402897][ T6652] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 236.574303][ T6652] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 236.857823][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.860250][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.862253][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.864401][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 236.866688][ T6652] wlan0 speed is unknown, defaulting to 1000 [ 237.090407][ T6417] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 237.127631][ T6417] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 237.446665][ T67] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.450522][ T67] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.452649][ T67] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.458021][ T67] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 237.531596][ T6662] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 237.550727][ T6662] cramfs: wrong magic [ 239.027931][ T6673] Lens A: ================= START STATUS ================= [ 239.027951][ T6673] Lens A: Focus, Absolute: 0 [ 239.027974][ T6673] Lens A: ================== END STATUS ================== [ 239.220549][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.220566][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 239.573110][ T6672] Lens A: ================= START STATUS ================= [ 239.573146][ T6672] Lens A: Focus, Absolute: 0 [ 239.573170][ T6672] Lens A: ================== END STATUS ================== [ 239.695068][ T38] audit: type=1800 audit(1756916777.466:2): pid=6672 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.128" name="bus" dev="ramfs" ino=11518 res=0 errno=0 [ 239.938399][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.938415][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 240.658618][ T6680] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 240.662736][ T6680] cramfs: wrong magic [ 241.777422][ T6692] sg_write: data in/out 44633/14 bytes for SCSI command 0x0-- guessing data in; [ 241.777422][ T6692] program syz.4.131 not setting count and/or reply_len properly [ 245.616190][ T5928] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 245.776205][ T5928] usb 2-1: Using ep0 maxpacket: 16 [ 245.812795][ T5928] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 245.812850][ T5928] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 245.812876][ T5928] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 245.909586][ T5928] usb 2-1: config 0 descriptor?? [ 246.394548][ T5928] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 246.394589][ T5928] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 246.420926][ T5928] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 246.421019][ T5928] mcp2221 0003:04D8:00DD.0003: unknown main item tag 0x0 [ 246.422057][ T5928] mcp2221 0003:04D8:00DD.0003: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 246.537317][ T6724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 246.537846][ T6724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 246.539325][ C0] usb 2-1: input irq status -75 received [ 246.848865][ T5928] usb 2-1: USB disconnect, device number 4 [ 248.585553][ T6738] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 248.585581][ T6738] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 248.880580][ T6738] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 248.880604][ T6738] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 249.159252][ T6738] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 249.159275][ T6738] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 249.197481][ T6745] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 249.198273][ T6745] cramfs: wrong magic [ 249.285504][ T6738] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 249.285527][ T6738] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 249.375508][ T6738] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 249.375525][ T6738] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 251.316591][ T38] audit: type=1800 audit(1756916789.336:3): pid=6757 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.143" name="bus" dev="ramfs" ino=11049 res=0 errno=0 [ 251.425071][ T6757] Lens A: ================= START STATUS ================= [ 251.425087][ T6757] Lens A: Focus, Absolute: 0 [ 251.425103][ T6757] Lens A: ================== END STATUS ================== [ 251.579874][ T6766] sg_write: data in/out 44633/14 bytes for SCSI command 0x0-- guessing data in; [ 251.579874][ T6766] program syz.1.144 not setting count and/or reply_len properly [ 252.009495][ T6771] Lens A: ================= START STATUS ================= [ 252.009517][ T6771] Lens A: Focus, Absolute: 0 [ 252.009545][ T6771] Lens A: ================== END STATUS ================== [ 252.051173][ T38] audit: type=1800 audit(1756916790.006:4): pid=6771 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.145" name="bus" dev="ramfs" ino=11812 res=0 errno=0 [ 253.813742][ T6786] ubi: mtd0 is already attached to ubi0 [ 253.814206][ T6786] ubi0: detaching mtd0 [ 254.042747][ T6786] ubi0: mtd0 is detached [ 254.839420][ T6792] wlan0 speed is unknown, defaulting to 1000 [ 262.129130][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 262.129324][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 262.167070][ T6825] wlan0 speed is unknown, defaulting to 1000 [ 262.667404][ T38] audit: type=1800 audit(1756916800.686:5): pid=6828 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.4.156" name="bus" dev="ramfs" ino=11960 res=0 errno=0 [ 262.727297][ T6828] Lens A: ================= START STATUS ================= [ 262.727316][ T6828] Lens A: Focus, Absolute: 0 [ 262.727336][ T6828] Lens A: ================== END STATUS ================== [ 263.203169][ T6837] sg_write: data in/out 44633/14 bytes for SCSI command 0x0-- guessing data in; [ 263.203169][ T6837] program syz.4.158 not setting count and/or reply_len properly [ 266.688781][ T6859] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 266.689828][ T6859] cramfs: wrong magic [ 270.239462][ T6891] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 270.240147][ T6891] cramfs: wrong magic [ 272.061984][ T6907] wlan0 speed is unknown, defaulting to 1000 [ 275.617910][ T6927] wlan0 speed is unknown, defaulting to 1000 [ 276.866146][ T6337] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 277.026175][ T6337] usb 2-1: Using ep0 maxpacket: 16 [ 277.028125][ T6337] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 277.028159][ T6337] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 277.028175][ T6337] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 277.081948][ T6337] usb 2-1: config 0 descriptor?? [ 277.769440][ T6337] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 277.769477][ T6337] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 277.769512][ T6337] mcp2221 0003:04D8:00DD.0004: unknown main item tag 0x0 [ 277.770613][ T6337] mcp2221 0003:04D8:00DD.0004: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 277.977499][ T6932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 277.978050][ T6932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 277.979541][ C0] usb 2-1: input irq status -75 received [ 278.213023][ T6337] usb 2-1: USB disconnect, device number 5 [ 280.672888][ T6961] ubi0: attaching mtd0 [ 280.675049][ T6961] ubi0: scanning is finished [ 280.959205][ T6961] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 280.959225][ T6961] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 280.959237][ T6961] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 280.959249][ T6961] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 280.959261][ T6961] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 280.959272][ T6961] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 280.959284][ T6961] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1720346938 [ 280.959298][ T6961] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 280.959370][ T6967] ubi0: background thread "ubi_bgt0d" started, PID 6967 [ 289.408617][ T38] audit: type=1800 audit(1756916827.436:6): pid=7031 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.188" name="bus" dev="ramfs" ino=12320 res=0 errno=0 [ 289.573666][ T7031] Lens A: ================= START STATUS ================= [ 289.573688][ T7031] Lens A: Focus, Absolute: 0 [ 289.573714][ T7031] Lens A: ================== END STATUS ================== [ 290.004826][ T7030] block nbd3: shutting down sockets [ 291.495200][ T38] audit: type=1800 audit(1756916829.446:7): pid=7054 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.5.192" name="bus" dev="ramfs" ino=12353 res=0 errno=0 [ 291.676825][ T7054] Lens A: ================= START STATUS ================= [ 291.676846][ T7054] Lens A: Focus, Absolute: 0 [ 291.676871][ T7054] Lens A: ================== END STATUS ================== [ 292.470030][ T7066] netlink: 8 bytes leftover after parsing attributes in process `syz.1.189'. [ 292.914882][ T7073] ubi: mtd0 is already attached to ubi0 [ 292.915184][ T7073] ubi0: detaching mtd0 [ 292.963898][ T7073] ubi0: mtd0 is detached [ 293.841641][ T7083] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 293.842569][ T7083] cramfs: wrong magic [ 304.220594][ T7147] wlan0 speed is unknown, defaulting to 1000 [ 312.286514][ T7187] block nbd4: shutting down sockets [ 313.038897][ T38] audit: type=1800 audit(1756916851.056:8): pid=7200 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.216" name="bus" dev="ramfs" ino=13432 res=0 errno=0 [ 313.203326][ T7200] Lens A: ================= START STATUS ================= [ 313.203342][ T7200] Lens A: Focus, Absolute: 0 [ 313.203359][ T7200] Lens A: ================== END STATUS ================== [ 320.338804][ T7248] netlink: 8 bytes leftover after parsing attributes in process `syz.1.224'. [ 322.501173][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 322.501284][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 325.506083][ T6337] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 325.656150][ T6337] usb 5-1: Using ep0 maxpacket: 8 [ 325.674533][ T6337] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 325.674561][ T6337] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.674576][ T6337] usb 5-1: Product: syz [ 325.674586][ T6337] usb 5-1: Manufacturer: syz [ 325.674596][ T6337] usb 5-1: SerialNumber: syz [ 325.740417][ T5845] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 325.750644][ T5845] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 325.752395][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 325.758637][ T5845] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 325.759594][ T5845] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 325.780232][ T5851] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 325.780769][ T5851] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 325.781253][ T5851] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 325.782992][ T5851] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 325.783944][ T5851] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 325.926116][ T6337] usb 5-1: config 0 descriptor?? [ 326.159628][ T6337] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 326.809661][ T5999] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.134308][ T7284] wlan0 speed is unknown, defaulting to 1000 [ 327.682149][ T6337] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 327.713576][ T6337] usb 5-1: USB disconnect, device number 6 [ 327.860796][ T5845] Bluetooth: hci3: command tx timeout [ 327.920032][ T5999] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.498299][ T7301] netlink: 8 bytes leftover after parsing attributes in process `syz.3.237'. [ 329.787683][ T6337] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 329.940295][ T5845] Bluetooth: hci3: command tx timeout [ 330.373401][ T7305] netlink: 8 bytes leftover after parsing attributes in process `syz.1.238'. [ 330.392056][ T6337] usb 1-1: Using ep0 maxpacket: 8 [ 330.395125][ T6337] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 330.395180][ T6337] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 330.395208][ T6337] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.436632][ T6337] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 330.436691][ T6337] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 330.436719][ T6337] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.442094][ T6337] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 330.442152][ T6337] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 330.442178][ T6337] usb 1-1: config 168 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.496097][ T6337] usb 1-1: string descriptor 0 read error: -22 [ 330.496264][ T6337] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 330.496294][ T6337] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.562851][ T6337] adutux 1-1:168.0: interrupt endpoints not found [ 330.587066][ T5999] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.025238][ T5845] Bluetooth: hci3: command tx timeout [ 333.747773][ T5999] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.798477][ T45] usb 1-1: USB disconnect, device number 5 [ 334.262046][ T5845] Bluetooth: hci3: command tx timeout [ 334.712707][ T6039] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 334.856135][ T6039] usb 1-1: Using ep0 maxpacket: 8 [ 334.908652][ T6039] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 334.908682][ T6039] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.908703][ T6039] usb 1-1: Product: syz [ 334.908718][ T6039] usb 1-1: Manufacturer: syz [ 334.908732][ T6039] usb 1-1: SerialNumber: syz [ 334.977899][ T6039] usb 1-1: config 0 descriptor?? [ 335.299223][ T6340] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 335.330181][ T6039] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 335.467392][ T6340] usb 4-1: Using ep0 maxpacket: 8 [ 335.606557][ T6340] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 335.606588][ T6340] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.606609][ T6340] usb 4-1: Product: syz [ 335.606624][ T6340] usb 4-1: Manufacturer: syz [ 335.606642][ T6340] usb 4-1: SerialNumber: syz [ 335.643341][ T6340] usb 4-1: config 0 descriptor?? [ 335.972001][ T6340] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 336.626983][ T6039] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 336.738560][ T6039] usb 1-1: USB disconnect, device number 6 [ 337.083208][ T7284] chnl_net:caif_netlink_parms(): no params data found [ 338.566351][ T7347] wlan0 speed is unknown, defaulting to 1000 [ 338.591749][ T5999] bridge_slave_1: left allmulticast mode [ 338.591778][ T5999] bridge_slave_1: left promiscuous mode [ 338.591992][ T5999] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.631911][ T6340] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 338.709155][ T6039] usb 4-1: USB disconnect, device number 4 [ 338.798021][ T5999] bridge_slave_0: left allmulticast mode [ 338.798055][ T5999] bridge_slave_0: left promiscuous mode [ 338.798367][ T5999] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.783373][ T7370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.250'. [ 346.157023][ T5999] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 346.196929][ T5999] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 346.224847][ T5999] bond0 (unregistering): Released all slaves [ 348.833587][ T7430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.256'. [ 351.615581][ T7446] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 351.616779][ T7446] cramfs: wrong magic [ 353.657029][ T5999] hsr_slave_0: left promiscuous mode [ 353.676661][ T5999] hsr_slave_1: left promiscuous mode [ 353.677377][ T5999] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 353.677400][ T5999] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 353.737428][ T5999] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 353.737451][ T5999] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 354.100456][ T5851] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 354.117345][ T5851] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 354.121961][ T5851] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 354.136065][ T5851] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 354.144384][ T5851] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 354.166235][ T5999] veth1_macvtap: left promiscuous mode [ 354.166360][ T5999] veth0_macvtap: left promiscuous mode [ 354.166660][ T5999] veth1_vlan: left promiscuous mode [ 354.166897][ T5999] veth0_vlan: left promiscuous mode [ 356.256784][ T5851] Bluetooth: hci1: command tx timeout [ 356.456080][ T6337] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 356.606099][ T6337] usb 5-1: Using ep0 maxpacket: 16 [ 356.609254][ T6337] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 356.609298][ T6337] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 356.609315][ T6337] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 356.614455][ T6337] usb 5-1: config 0 descriptor?? [ 357.383765][ T6337] mcp2221 0003:04D8:00DD.0005: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 357.636618][ T6337] usb 5-1: USB disconnect, device number 7 [ 358.347927][ T5851] Bluetooth: hci1: command tx timeout [ 360.254929][ T7492] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 360.256016][ T7492] cramfs: wrong magic [ 360.416152][ T5851] Bluetooth: hci1: command tx timeout [ 360.745001][ T6337] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 360.896407][ T6337] usb 4-1: Using ep0 maxpacket: 8 [ 360.911230][ T6337] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 360.911263][ T6337] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.911284][ T6337] usb 4-1: Product: syz [ 360.911299][ T6337] usb 4-1: Manufacturer: syz [ 360.911314][ T6337] usb 4-1: SerialNumber: syz [ 360.993215][ T6337] usb 4-1: config 0 descriptor?? [ 361.221999][ T6337] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 362.497516][ T5851] Bluetooth: hci1: command tx timeout [ 362.527219][ T6337] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 362.530436][ T6337] usb 4-1: USB disconnect, device number 5 [ 363.418235][ T5999] team0 (unregistering): Port device team_slave_1 removed [ 363.796159][ T5913] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 364.078547][ T5913] usb 4-1: Using ep0 maxpacket: 8 [ 364.480021][ T5913] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 364.480085][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 364.480115][ T5913] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 364.480142][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 364.480170][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 364.482605][ T5913] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 364.482663][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 364.482694][ T5913] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 364.482721][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 364.482749][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 364.485333][ T5913] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 364.485391][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 364.485420][ T5913] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 364.485447][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 364.485474][ T5913] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 364.662280][ T5913] usb 4-1: string descriptor 0 read error: -22 [ 364.662457][ T5913] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 364.662482][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.684635][ T5999] team0 (unregistering): Port device team_slave_0 removed [ 364.788910][ T5913] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 365.135559][ T5913] usb 4-1: USB disconnect, device number 6 [ 365.167494][ T7514] usb 4-1: Couldn't submit interrupt_out_urb -19 [ 365.786205][ T6337] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 365.916223][ T6337] usb 4-1: device descriptor read/64, error -71 [ 366.166287][ T6337] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 366.296161][ T6337] usb 4-1: device descriptor read/64, error -71 [ 366.417068][ T6337] usb usb4-port1: attempt power cycle [ 367.875336][ T7284] bridge0: port 1(bridge_slave_0) entered blocking state [ 367.875503][ T7284] bridge0: port 1(bridge_slave_0) entered disabled state [ 367.875758][ T7284] bridge_slave_0: entered allmulticast mode [ 367.908832][ T7284] bridge_slave_0: entered promiscuous mode [ 368.036352][ T7284] bridge0: port 2(bridge_slave_1) entered blocking state [ 368.036513][ T7284] bridge0: port 2(bridge_slave_1) entered disabled state [ 368.036736][ T7284] bridge_slave_1: entered allmulticast mode [ 368.096426][ T7284] bridge_slave_1: entered promiscuous mode [ 368.436042][ T5913] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 369.481169][ T5913] usb 5-1: Using ep0 maxpacket: 16 [ 369.526517][ T5913] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 369.526567][ T5913] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 369.526590][ T5913] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.572525][ T5913] usb 5-1: config 0 descriptor?? [ 369.948699][ T7284] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 369.956717][ T7284] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 370.912967][ T7538] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 370.914068][ T7538] cramfs: wrong magic [ 370.963379][ T5913] mcp2221 0003:04D8:00DD.0006: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 371.186958][ C1] ================================================================== [ 371.187034][ C1] BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x106a/0x1240 [ 371.187064][ C1] Read of size 1 at addr ffff8880281d3fff by task ktimers/1/29 [ 371.187091][ C1] [ 371.187122][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 371.187149][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 371.187170][ C1] Call Trace: [ 371.187179][ C1] [ 371.187189][ C1] dump_stack_lvl+0x189/0x250 [ 371.187228][ C1] ? __kasan_check_byte+0x12/0x40 [ 371.187262][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 371.187294][ C1] ? lock_release+0x4b/0x3e0 [ 371.187327][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 371.187347][ C1] print_report+0xca/0x240 [ 371.187376][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 371.187396][ C1] kasan_report+0x118/0x150 [ 371.187426][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 371.187449][ C1] mcp2221_raw_event+0x106a/0x1240 [ 371.187469][ C1] ? down_trylock+0x50/0xb0 [ 371.187501][ C1] hid_input_report+0x40f/0x530 [ 371.187532][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 371.187554][ C1] hid_irq_in+0x47e/0x6d0 [ 371.187577][ C1] __usb_hcd_giveback_urb+0x3b4/0x5e0 [ 371.187609][ C1] dummy_timer+0x89c/0x45a0 [ 371.187659][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 371.187689][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 371.187719][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 371.187743][ C1] __hrtimer_run_queues+0x552/0xd40 [ 371.187785][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 371.187815][ C1] ? ktime_get_update_offsets_now+0x3ab/0x3d0 [ 371.187847][ C1] hrtimer_run_softirq+0x1a3/0x2e0 [ 371.187869][ C1] handle_softirqs+0x22f/0x710 [ 371.187902][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 371.187934][ C1] run_ktimerd+0xcf/0x190 [ 371.187964][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 371.187994][ C1] ? schedule+0x91/0x360 [ 371.188023][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 371.188050][ C1] smpboot_thread_fn+0x53f/0xa60 [ 371.188078][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 371.188120][ C1] kthread+0x70e/0x8a0 [ 371.188155][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 371.188183][ C1] ? __pfx_kthread+0x10/0x10 [ 371.188218][ C1] ? __pfx_kthread+0x10/0x10 [ 371.188252][ C1] ret_from_fork+0x3f9/0x770 [ 371.188281][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 371.188312][ C1] ? __switch_to_asm+0x39/0x70 [ 371.188332][ C1] ? __switch_to_asm+0x33/0x70 [ 371.188352][ C1] ? __pfx_kthread+0x10/0x10 [ 371.188386][ C1] ret_from_fork_asm+0x1a/0x30 [ 371.188415][ C1] [ 371.188423][ C1] [ 371.188428][ C1] Allocated by task 7172: [ 371.188439][ C1] kasan_save_track+0x3e/0x80 [ 371.188463][ C1] __kasan_slab_alloc+0x6c/0x80 [ 371.188488][ C1] kmem_cache_alloc_noprof+0x143/0x310 [ 371.188515][ C1] taskstats_exit+0x147/0xa20 [ 371.188539][ C1] do_exit+0x630/0x2300 [ 371.188555][ C1] do_group_exit+0x21c/0x2d0 [ 371.188572][ C1] get_signal+0x125e/0x1310 [ 371.188595][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 371.188619][ C1] exit_to_user_mode_loop+0x75/0x110 [ 371.188646][ C1] do_syscall_64+0x2bd/0x3b0 [ 371.188675][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.188694][ C1] [ 371.188700][ C1] Freed by task 28: [ 371.188709][ C1] kasan_save_track+0x3e/0x80 [ 371.188731][ C1] kasan_save_free_info+0x46/0x50 [ 371.188749][ C1] __kasan_slab_free+0x5b/0x80 [ 371.188772][ C1] kmem_cache_free+0x195/0x510 [ 371.188800][ C1] __put_task_struct+0x20e/0x450 [ 371.188824][ C1] rcu_cpu_kthread+0xbf6/0x1b50 [ 371.188871][ C1] smpboot_thread_fn+0x53f/0xa60 [ 371.188897][ C1] kthread+0x70e/0x8a0 [ 371.188950][ C1] ret_from_fork+0x3f9/0x770 [ 371.188993][ C1] ret_from_fork_asm+0x1a/0x30 [ 371.189015][ C1] [ 371.189020][ C1] The buggy address belongs to the object at ffff8880281d3b20 [ 371.189020][ C1] which belongs to the cache taskstats of size 560 [ 371.189041][ C1] The buggy address is located 687 bytes to the right of [ 371.189041][ C1] allocated 560-byte region [ffff8880281d3b20, ffff8880281d3d50) [ 371.189069][ C1] [ 371.189074][ C1] The buggy address belongs to the physical page: [ 371.189104][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880281d02b0 pfn:0x281d0 [ 371.189133][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 371.189152][ C1] anon flags: 0x80000000000040(head|node=0|zone=1) [ 371.189176][ C1] page_type: f5(slab) [ 371.189197][ C1] raw: 0080000000000040 ffff888140434140 0000000000000000 0000000000000001 [ 371.189219][ C1] raw: ffff8880281d02b0 0000000000170000 00000000f5000000 0000000000000000 [ 371.189240][ C1] head: 0080000000000040 ffff888140434140 0000000000000000 0000000000000001 [ 371.189261][ C1] head: ffff8880281d02b0 0000000000170000 00000000f5000000 0000000000000000 [ 371.189284][ C1] head: 0080000000000002 ffffea0000a07401 00000000ffffffff 00000000ffffffff [ 371.189304][ C1] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 371.189318][ C1] page dumped because: kasan: bad access detected [ 371.189334][ C1] page_owner tracks the page as allocated [ 371.189343][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6906, tgid 6893 (syz.5.169), ts 273979883245, free_ts 273946070334 [ 371.189387][ C1] post_alloc_hook+0x240/0x2a0 [ 371.189420][ C1] get_page_from_freelist+0x2119/0x21b0 [ 371.189441][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 371.189461][ C1] alloc_pages_mpol+0xd1/0x380 [ 371.189490][ C1] allocate_slab+0x8a/0x370 [ 371.189511][ C1] ___slab_alloc+0x8d1/0xdd0 [ 371.189542][ C1] kmem_cache_alloc_noprof+0xe6/0x310 [ 371.189569][ C1] taskstats_exit+0x147/0xa20 [ 371.189593][ C1] do_exit+0x630/0x2300 [ 371.189610][ C1] do_group_exit+0x21c/0x2d0 [ 371.189628][ C1] get_signal+0x125e/0x1310 [ 371.189650][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 371.189674][ C1] exit_to_user_mode_loop+0x75/0x110 [ 371.189701][ C1] do_syscall_64+0x2bd/0x3b0 [ 371.189732][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.189753][ C1] page last free pid 6907 tgid 6903 stack trace: [ 371.189767][ C1] __free_frozen_pages+0xb59/0xce0 [ 371.189798][ C1] free_large_kmalloc+0x13a/0x1f0 [ 371.189827][ C1] ops_undo_list+0x856/0x990 [ 371.189856][ C1] setup_net+0x2d3/0x320 [ 371.189881][ C1] copy_net_ns+0x31b/0x4d0 [ 371.189904][ C1] create_new_namespaces+0x3f3/0x720 [ 371.189931][ C1] unshare_nsproxy_namespaces+0x11c/0x170 [ 371.189957][ C1] ksys_unshare+0x4c8/0x8c0 [ 371.189990][ C1] __x64_sys_unshare+0x38/0x50 [ 371.190023][ C1] do_syscall_64+0xfa/0x3b0 [ 371.190054][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.190077][ C1] [ 371.190093][ C1] Memory state around the buggy address: [ 371.190117][ C1] ffff8880281d3e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 371.190133][ C1] ffff8880281d3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 371.190148][ C1] >ffff8880281d3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 371.190160][ C1] ^ [ 371.190184][ C1] ffff8880281d4000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 371.190198][ C1] ffff8880281d4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 371.190208][ C1] ================================================================== [ 371.190268][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 371.190285][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 371.190311][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 371.190325][ C1] Call Trace: [ 371.190333][ C1] [ 371.190359][ C1] dump_stack_lvl+0x99/0x250 [ 371.190396][ C1] ? __asan_memcpy+0x40/0x70 [ 371.190421][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 371.190456][ C1] ? __pfx__printk+0x10/0x10 [ 371.190488][ C1] vpanic+0x281/0x750 [ 371.190522][ C1] ? preempt_schedule+0xae/0xc0 [ 371.190569][ C1] ? __pfx_vpanic+0x10/0x10 [ 371.190603][ C1] ? preempt_schedule_common+0x83/0xd0 [ 371.190634][ C1] ? preempt_schedule+0xae/0xc0 [ 371.190664][ C1] ? __pfx_preempt_schedule+0x10/0x10 [ 371.190698][ C1] panic+0xb9/0xc0 [ 371.190731][ C1] ? __pfx_panic+0x10/0x10 [ 371.190769][ C1] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 371.190807][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 371.190830][ C1] check_panic_on_warn+0x89/0xb0 [ 371.190854][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 371.190877][ C1] end_report+0x78/0x160 [ 371.190908][ C1] kasan_report+0x129/0x150 [ 371.190941][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 371.190968][ C1] mcp2221_raw_event+0x106a/0x1240 [ 371.190992][ C1] ? down_trylock+0x50/0xb0 [ 371.191028][ C1] hid_input_report+0x40f/0x530 [ 371.191062][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 371.191092][ C1] hid_irq_in+0x47e/0x6d0 [ 371.191120][ C1] __usb_hcd_giveback_urb+0x3b4/0x5e0 [ 371.191155][ C1] dummy_timer+0x89c/0x45a0 [ 371.191213][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 371.191249][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 371.191282][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 371.191310][ C1] __hrtimer_run_queues+0x552/0xd40 [ 371.191358][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 371.191395][ C1] ? ktime_get_update_offsets_now+0x3ab/0x3d0 [ 371.191432][ C1] hrtimer_run_softirq+0x1a3/0x2e0 [ 371.191455][ C1] handle_softirqs+0x22f/0x710 [ 371.191491][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 371.191528][ C1] run_ktimerd+0xcf/0x190 [ 371.191561][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 371.191594][ C1] ? schedule+0x91/0x360 [ 371.191627][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 371.191657][ C1] smpboot_thread_fn+0x53f/0xa60 [ 371.191688][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 371.191721][ C1] kthread+0x70e/0x8a0 [ 371.191770][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 371.191808][ C1] ? __pfx_kthread+0x10/0x10 [ 371.191842][ C1] ? __pfx_kthread+0x10/0x10 [ 371.191875][ C1] ret_from_fork+0x3f9/0x770 [ 371.191905][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 371.191936][ C1] ? __switch_to_asm+0x39/0x70 [ 371.191956][ C1] ? __switch_to_asm+0x33/0x70 [ 371.191976][ C1] ? __pfx_kthread+0x10/0x10 [ 371.192009][ C1] ret_from_fork_asm+0x1a/0x30 [ 371.192038][ C1] [ 371.192372][ C1] Kernel Offset: disabled