last executing test programs: 16.941479922s ago: executing program 2 (id=3): r0 = openat2$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000280)={0x620240, 0x2, 0x8}, 0x18) mkdirat(r0, &(0x7f0000000340)='./file0\x00', 0x1d6) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff000040b90661400001010203010902320002010080320904000000ff0000000904010000ff000000"], 0x0) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write(r2, &(0x7f0000000600)='dir .', 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x1) openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000240)=0x8) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000640)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [{@smackfshat}, {@func={'func', 0x3d, 'CREDS_CHECK'}}, {@fowner_eq}, {@uid_eq}, {@subj_user={'subj_user', 0x3d, 'syz_tun\x00'}}, {@audit}], 0x2f}) write(r2, &(0x7f0000000700)='bind', 0x4) syz_usb_control_io(r1, &(0x7f0000000200)={0x2c, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r4 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x80) ioctl$BLKIOOPT(r4, 0x1279, &(0x7f0000000040)) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r5, 0x8982, &(0x7f0000000000)={0x0, 'syz_tun\x00', {0x1}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000900)=ANY=[], 0x64}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[@ANYBLOB="0180c2000021001122334455000a42420300010102"], 0x0) 12.152368703s ago: executing program 2 (id=9): syz_emit_vhci(0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r0, 0x0, 0x3b) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) 12.090307447s ago: executing program 3 (id=10): userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000240)=0x1) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) setns(0xc9, 0x0) r4 = socket(0x1f, 0x5, 0x8) ioctl$VFAT_IOCTL_READDIR_BOTH(r4, 0x82307201, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) syz_usb_control_io(r3, &(0x7f0000000b40)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="20110c0000000c4845"], 0x0, 0x0, 0x0, 0x0}, 0x0) 8.03541855s ago: executing program 0 (id=12): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000"], 0x128}, 0x4004000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000540)=@mangle={'mangle\x00', 0x64, 0x6, 0x798, 0x550, 0x1f0, 0x408, 0x550, 0x120, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6, 0x0, {[{{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}, @common=@inet=@length={{0x28}, {0x7, 0xb0, 0x81}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@mcast2, @loopback, [0x0, 0x0, 0xff0000ff], [0x0, 0x0, 0x0, 0xff000000], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {0xff}}, 0x0, 0x1d0, 0x218, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@recent0={{0xf8}, {0x9, 0x58, 0x4, 0x1, 'syz0\x00', 0x9}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv6=@private1, 0x0, 0x38}}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}, {0xfffffffc, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe]}}, @common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x1, 0x8]}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@empty}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7f8) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000240)=0x1) setns(0xc9, 0x0) r4 = socket(0x1f, 0x5, 0x8) ioctl$VFAT_IOCTL_READDIR_BOTH(r4, 0x82307201, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b40)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="20110c0000000c4845"], 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/rds/tcp/rds_tcp_rcvbuf\x00', 0x1, 0x0) write(r5, &(0x7f0000000100)='1', 0x1) 7.854695471s ago: executing program 1 (id=13): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f00000004c0)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r3, &(0x7f0000000500)="0802110000010802116000000800", 0xe) 7.343203248s ago: executing program 2 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./dev\x00', 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000401e09030001000102000109022700010100c0320904000003ffffff00070581034000010705020240"], 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/ttyUSB0\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)="5fd31003", 0x4) 6.769490949s ago: executing program 3 (id=15): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x1000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 6.49869139s ago: executing program 3 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000004080)='./mnt\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./trace/trace\x00', 0x0, 0x0) read(r0, &(0x7f0000000500), 0x1000) 6.371335239s ago: executing program 1 (id=17): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) setsockopt$sock_int(r0, 0x6, 0x25, 0x0, 0x0) 6.370230969s ago: executing program 0 (id=18): socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) setgroups(0x1, &(0x7f0000000080)=[0x0]) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='3', 0x1) 6.316869392s ago: executing program 3 (id=19): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x2, &(0x7f0000000340)=[{0x12, '\x00', @st={0x4, [{0x2, @uvalue=0x9}, {0x2, @svalue=0x4}, {0x1, @svalue=0xffffffffffffdfd3}, {0x2, @svalue=0x6c}]}, 0x2}]}) 6.133752733s ago: executing program 3 (id=20): prctl$PR_SET_MM(0xd, 0x0, &(0x7f0000004000/0x3000)=nil) move_pages(0x0, 0x0, 0x0, &(0x7f0000001180), &(0x7f0000000000), 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='file', 0x4) 6.011503941s ago: executing program 1 (id=21): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @random="42238e910adb", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "3e090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="c323567fea2eb55ab91640ea77eb5f6ae9f6564983ae5689da72d2e7a28657524e863f1102f9bbf99e3f973e4abe7a95eeb4e1e213c0bf915331001e04c028f2dbc32428bb43d87ac6364d93d936435e000aa9cc8dff68141f7e752a1a10d9ec3f0a87583236e7d32f3fa56ba46a6081ee30f26f6c71aca4c7c43bf653cb768932e992", @ANYRES16, @ANYRESOCT, @ANYRES64=0x0], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendto$packet(r4, &(0x7f0000000140)="09000000e7001400000000803500008100000088a8000000000050", 0x1b, 0x4044804, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r6, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1000000014000300ce5d6201ffdbdf25"], 0x10}}, 0x40000) sendmsg$nl_route(r5, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 6.010213082s ago: executing program 0 (id=22): syz_emit_vhci(0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r0, 0x0, 0x3b) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDCTL_SEQ_RESET(0xffffffffffffffff, 0x5100) 4.516209572s ago: executing program 3 (id=23): userfaultfd(0x801) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_STREAMOFF(r2, 0x40045612, &(0x7f0000000240)=0x1) r3 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) setns(0xc9, 0x0) r4 = socket(0x1f, 0x5, 0x8) ioctl$VFAT_IOCTL_READDIR_BOTH(r4, 0x82307201, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) syz_usb_control_io(r3, &(0x7f0000000b40)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="20110c0000000c4845"], 0x0, 0x0, 0x0, 0x0}, 0x0) 4.425200502s ago: executing program 1 (id=24): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r3, 0x1000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.8546732s ago: executing program 2 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f00000004c0)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r3, &(0x7f0000000500)="0802110000010802116000000800", 0xe) 2.659746674s ago: executing program 2 (id=26): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @random="42238e910adb", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "3e090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="c323567fea2eb55ab91640ea77eb5f6ae9f6564983ae5689da72d2e7a28657524e863f1102f9bbf99e3f973e4abe7a95eeb4e1e213c0bf915331001e04c028f2dbc32428bb43d87ac6364d93d936435e000aa9cc8dff68141f7e752a1a10d9ec3f0a87583236e7d32f3fa56ba46a6081ee30f26f6c71aca4c7c43bf653cb768932e992", @ANYRES16, @ANYBLOB="99061762e348c5774f5a7938c05120d53914d04aa1519eb03dece010d02e65f8ec0ebc6e66684ca7986bbccf1c260bdcd5c1a550eef5330ae0", @ANYRESOCT, @ANYRES64=0x0], 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_route(r4, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) 2.445825403s ago: executing program 0 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000004080)='./mnt\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004200)='./mnt/trace_marker\x00', 0x1, 0x1a) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./trace/trace\x00', 0x0, 0x0) read(r0, &(0x7f0000000500), 0x1000) 1.197476047s ago: executing program 2 (id=28): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000000)={0x2, &(0x7f0000000340)=[{0x12, '\x00', @st={0x4, [{0x2, @uvalue=0x9}, {0x2, @svalue=0x4}, {0x1, @svalue=0xffffffffffffdfd3}, {0x2, @svalue=0x6c}]}, 0x2}]}) 538.760597ms ago: executing program 1 (id=29): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) setsockopt$sock_int(r0, 0x6, 0x25, 0x0, 0x0) 410.437367ms ago: executing program 1 (id=30): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000"], 0x128}, 0x4004000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000540)=@mangle={'mangle\x00', 0x64, 0x6, 0x798, 0x550, 0x1f0, 0x408, 0x550, 0x120, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6c8, 0x6, 0x0, {[{{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}, @common=@inet=@length={{0x28}, {0x7, 0xb0, 0x81}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@mcast2, @loopback, [0x0, 0x0, 0xff0000ff], [0x0, 0x0, 0x0, 0xff000000], 'veth0_to_team\x00', 'syzkaller0\x00', {}, {0xff}}, 0x0, 0x1d0, 0x218, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@recent0={{0xf8}, {0x9, 0x58, 0x4, 0x1, 'syz0\x00', 0x9}}]}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv6=@private1, 0x0, 0x38}}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0x138, 0x178, 0x0, {}, [@common=@dst={{0x48}, {0xfffffffc, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe]}}, @common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x1, 0x8]}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@empty}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7f8) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x2, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x0, 0xfffffffd, 0x59455247, 0x0, 0x0, 0x0, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000240)=0x1) setns(0xc9, 0x0) r4 = socket(0x1f, 0x5, 0x8) ioctl$VFAT_IOCTL_READDIR_BOTH(r4, 0x82307201, &(0x7f0000000180)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b40)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="20110c0000000c4845"], 0x0, 0x0, 0x0, 0x0}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/rds/tcp/rds_tcp_rcvbuf\x00', 0x1, 0x0) write(r5, &(0x7f0000000100)='1', 0x1) 315.694718ms ago: executing program 0 (id=31): socket$inet6_udp(0xa, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) setgroups(0x1, &(0x7f0000000080)=[0x0]) mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='-2 -3\n', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='3', 0x1) 0s ago: executing program 0 (id=32): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@local, @random="42238e910adb", @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "fca33f", 0x30, 0x67, 0x0, @dev, @local, {[@fragment={0x21}, @dstopts={0x0, 0x3, '\x00', [@generic={0x0, 0x17, "3e090e541b64f22a8982d3f5aaacd21a0ca186608b74f1"}]}]}}}}}, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000200)=0x40003) r4 = socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="c323567fea2eb55ab91640ea77eb5f6ae9f6564983ae5689da72d2e7a28657524e863f1102f9bbf99e3f973e4abe7a95eeb4e1e213c0bf915331001e04c028f2dbc32428bb43d87ac6364d93d936435e000aa9cc8dff68141f7e752a1a10d9ec3f0a87583236e7d32f3fa56ba46a6081ee30f26f6c71aca4c7c43bf653cb768932e992", @ANYRES16, @ANYRESOCT, @ANYRES64=0x0], 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendto$packet(r4, &(0x7f0000000140)="09000000e7001400000000803500008100000088a8000000000050", 0x1b, 0x4044804, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r6, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1000000014000300ce5d6201ffdbdf25"], 0x10}}, 0x40000) sendmsg$nl_route(r5, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.134' (ED25519) to the list of known hosts. [ 75.836548][ T5765] cgroup: Unknown subsys name 'net' [ 75.977874][ T5765] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.652217][ T5765] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.900208][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.925113][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.933298][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.941449][ T5780] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.956279][ T5780] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.965958][ T5780] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.976392][ T5780] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.985168][ T5780] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.993203][ T5780] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 80.003195][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.012910][ T5780] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 80.030952][ T5780] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 80.054288][ T5780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 80.055203][ T5790] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.071258][ T5790] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.078952][ T5790] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.090075][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.092831][ T5790] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.108643][ T5790] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.117349][ T5790] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 80.120463][ T5780] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.126180][ T5790] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.134109][ T5780] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 80.148342][ T5790] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.606985][ T5786] chnl_net:caif_netlink_parms(): no params data found [ 80.680647][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 80.768940][ T5789] chnl_net:caif_netlink_parms(): no params data found [ 80.805187][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 80.924927][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.934103][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.942320][ T5786] bridge_slave_0: entered allmulticast mode [ 80.949828][ T5786] bridge_slave_0: entered promiscuous mode [ 80.990179][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.998382][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.006576][ T5777] bridge_slave_0: entered allmulticast mode [ 81.014710][ T5777] bridge_slave_0: entered promiscuous mode [ 81.023856][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.031455][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.038678][ T5786] bridge_slave_1: entered allmulticast mode [ 81.046427][ T5786] bridge_slave_1: entered promiscuous mode [ 81.053593][ T5789] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.061155][ T5789] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.069250][ T5789] bridge_slave_0: entered allmulticast mode [ 81.076614][ T5789] bridge_slave_0: entered promiscuous mode [ 81.089871][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.097721][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.105423][ T5777] bridge_slave_1: entered allmulticast mode [ 81.112592][ T5777] bridge_slave_1: entered promiscuous mode [ 81.130418][ T5789] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.137630][ T5789] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.145385][ T5789] bridge_slave_1: entered allmulticast mode [ 81.152918][ T5789] bridge_slave_1: entered promiscuous mode [ 81.236051][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.250921][ T5789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.264239][ T5789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.282617][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.290186][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.297540][ T5781] bridge_slave_0: entered allmulticast mode [ 81.305044][ T5781] bridge_slave_0: entered promiscuous mode [ 81.315407][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.330219][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.358340][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.365930][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.373737][ T5781] bridge_slave_1: entered allmulticast mode [ 81.381505][ T5781] bridge_slave_1: entered promiscuous mode [ 81.391568][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.425379][ T5786] team0: Port device team_slave_0 added [ 81.444602][ T5786] team0: Port device team_slave_1 added [ 81.468481][ T5789] team0: Port device team_slave_0 added [ 81.509122][ T5777] team0: Port device team_slave_0 added [ 81.518038][ T5789] team0: Port device team_slave_1 added [ 81.526595][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.537275][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.544896][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.573605][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.587023][ T5777] team0: Port device team_slave_1 added [ 81.613742][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.635154][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.642570][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.668976][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.725608][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.732983][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.760072][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.772467][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.779538][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.810159][ T5789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.823246][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.830994][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.858382][ T5789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.873964][ T5781] team0: Port device team_slave_0 added [ 81.880977][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.888228][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.915676][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.953608][ T5781] team0: Port device team_slave_1 added [ 81.972487][ T5786] hsr_slave_0: entered promiscuous mode [ 81.980710][ T5786] hsr_slave_1: entered promiscuous mode [ 82.069150][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.077059][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.104658][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.115776][ T5087] Bluetooth: hci1: command tx timeout [ 82.149037][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.157449][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.185338][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.194377][ T5087] Bluetooth: hci0: command tx timeout [ 82.203301][ T5780] Bluetooth: hci2: command tx timeout [ 82.210721][ T5785] Bluetooth: hci3: command tx timeout [ 82.228651][ T5789] hsr_slave_0: entered promiscuous mode [ 82.236559][ T5789] hsr_slave_1: entered promiscuous mode [ 82.244523][ T5789] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.253671][ T5789] Cannot create hsr debugfs directory [ 82.266612][ T5777] hsr_slave_0: entered promiscuous mode [ 82.274567][ T5777] hsr_slave_1: entered promiscuous mode [ 82.282149][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.291328][ T5777] Cannot create hsr debugfs directory [ 82.347758][ T5781] hsr_slave_0: entered promiscuous mode [ 82.357204][ T5781] hsr_slave_1: entered promiscuous mode [ 82.364596][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.372587][ T5781] Cannot create hsr debugfs directory [ 82.726870][ T5786] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.756972][ T5786] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.768825][ T5786] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.782491][ T5786] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.885472][ T5789] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 82.901546][ T5789] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 82.914953][ T5789] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 82.924497][ T5789] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.005293][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.073703][ T5777] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.089363][ T5786] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.115982][ T5777] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.129321][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.137129][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.149264][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.156772][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.181099][ T5777] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.196146][ T5777] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.267418][ T5789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.293918][ T5781] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 83.306158][ T5781] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.326937][ T5781] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.336985][ T5781] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.413286][ T5789] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.447809][ T1076] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.455890][ T1076] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.483615][ T1076] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.491334][ T1076] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.567473][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.640872][ T5789] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.675316][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.706942][ T1138] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.715313][ T1138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.753602][ T1138] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.761370][ T1138] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.817807][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.889169][ T5777] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 83.907209][ T5777] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.951717][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.996704][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.003994][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.038312][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.045608][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.119684][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.195404][ T5087] Bluetooth: hci1: command tx timeout [ 84.217282][ T5789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.269895][ T5087] Bluetooth: hci0: command tx timeout [ 84.275466][ T5087] Bluetooth: hci2: command tx timeout [ 84.284644][ T5780] Bluetooth: hci3: command tx timeout [ 84.311950][ T5786] veth0_vlan: entered promiscuous mode [ 84.354483][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.384251][ T5786] veth1_vlan: entered promiscuous mode [ 84.455006][ T5789] veth0_vlan: entered promiscuous mode [ 84.521201][ T5789] veth1_vlan: entered promiscuous mode [ 84.536266][ T5777] veth0_vlan: entered promiscuous mode [ 84.577041][ T5777] veth1_vlan: entered promiscuous mode [ 84.612124][ T5786] veth0_macvtap: entered promiscuous mode [ 84.653250][ T5786] veth1_macvtap: entered promiscuous mode [ 84.664233][ T5789] veth0_macvtap: entered promiscuous mode [ 84.678286][ T5789] veth1_macvtap: entered promiscuous mode [ 84.699263][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.738705][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.762871][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.786544][ T5789] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.796858][ T5789] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.810749][ T5789] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.820077][ T5789] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.840273][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.853093][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.867296][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.883056][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.893992][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.905931][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.926288][ T5777] veth0_macvtap: entered promiscuous mode [ 84.945569][ T5777] veth1_macvtap: entered promiscuous mode [ 84.975470][ T5786] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.985184][ T5786] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.995863][ T5786] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.004916][ T5786] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.055324][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.082598][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.093073][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.104031][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.115143][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.125225][ T5781] veth0_vlan: entered promiscuous mode [ 85.180191][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.194259][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.206816][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.222035][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.235977][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.278611][ T5781] veth1_vlan: entered promiscuous mode [ 85.293609][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.302868][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.312876][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.323158][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.340381][ T4177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.348422][ T4177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.431606][ T1138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.439514][ T1138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.449937][ T4250] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.457805][ T4250] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.558897][ T1076] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.570386][ T1076] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.604740][ T5781] veth0_macvtap: entered promiscuous mode [ 85.639186][ T5781] veth1_macvtap: entered promiscuous mode [ 85.678975][ T1076] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.700934][ T1076] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.863806][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.877084][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.892228][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.975255][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.014192][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.094750][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.147514][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.198044][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.269868][ T5087] Bluetooth: hci1: command tx timeout [ 86.282552][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.349713][ T5087] Bluetooth: hci2: command tx timeout [ 86.356219][ T5785] Bluetooth: hci3: command tx timeout [ 86.361887][ T5785] Bluetooth: hci0: command tx timeout [ 86.510707][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.567932][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.627662][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.683397][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.731261][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.785333][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.846042][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.882750][ T5781] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.893411][ T5781] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.903606][ T5781] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.914028][ T5781] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.012007][ T5767] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 87.909349][ T5767] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 88.262737][ T5767] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.00 [ 88.279923][ T5767] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 88.299639][ T5767] usb 3-1: Product: syz [ 88.304001][ T5767] usb 3-1: Manufacturer: syz [ 88.330846][ T5767] usb 3-1: SerialNumber: syz [ 88.359644][ T5087] Bluetooth: hci1: command tx timeout [ 88.429821][ T5087] Bluetooth: hci3: command tx timeout [ 88.439924][ T5087] Bluetooth: hci2: command tx timeout [ 88.445640][ T5087] Bluetooth: hci0: command tx timeout [ 88.545573][ T1138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.605172][ T1138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.763718][ T5843] CacheFiles: Failed to register: -95 [ 88.790084][ T1090] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.835603][ T1090] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.953316][ T5852] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 89.217666][ T5767] usb 3-1: selecting invalid altsetting 1 [ 89.230134][ T5767] speedtch 3-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 89.239014][ T5767] speedtch 3-1:1.0: usbatm_usb_probe: bind failed: -22! [ 89.269724][ T5767] speedtch: probe of 3-1:1.0 failed with error -22 [ 89.291873][ T5767] usb 3-1: selecting invalid altsetting 1 [ 89.297868][ T5767] speedtch 3-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 90.051889][ T5767] speedtch 3-1:1.1: usbatm_usb_probe: bind failed: -22! [ 90.135934][ T5767] speedtch: probe of 3-1:1.1 failed with error -22 [ 90.245641][ T5767] usb 3-1: USB disconnect, device number 2 [ 90.621125][ T5876] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 91.095190][ T5886] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 91.412229][ T27] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 91.421704][ T5767] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 93.039913][ T788] cfg80211: failed to load regulatory.db [ 94.721200][ T5767] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 94.733992][ T5767] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 94.757665][ T5767] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 94.839226][ T5767] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 94.860090][ T5767] usb 4-1: Product: syz [ 94.868155][ T5767] usb 4-1: Manufacturer: syz [ 94.881210][ T5767] hub 4-1:4.0: USB hub found [ 95.843214][ T5767] hub 4-1:4.0: config failed, can't read hub descriptor (err -22) [ 95.931956][ T5767] usb 4-1: USB disconnect, device number 2 [ 95.975478][ T5903] binder: BINDER_SET_CONTEXT_MGR already set [ 96.003689][ T5903] binder: 5902:5903 ioctl 4018620d 200000004a80 returned -16 [ 96.429748][ T5913] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 99.739743][ T5767] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 100.279799][ T973] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 100.979697][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 101.386151][ T973] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 101.440243][ T973] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.462049][ T973] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 101.510041][ T973] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 101.518460][ T973] usb 4-1: Product: syz [ 101.539843][ T973] usb 4-1: Manufacturer: syz [ 101.561709][ T973] hub 4-1:4.0: USB hub found [ 101.829461][ T973] hub 4-1:4.0: config failed, hub has too many ports! (err -19) [ 101.962316][ T5942] binder: BINDER_SET_CONTEXT_MGR already set [ 101.969180][ T5942] binder: 5941:5942 ioctl 4018620d 200000004a80 returned -16 [ 102.639870][ T5781] ================================================================== [ 102.648796][ T5781] BUG: KASAN: slab-use-after-free in nfsd_shutdown_threads+0x8d/0x1a0 [ 102.657525][ T5781] Write of size 4 at addr ffff88802547c450 by task syz-executor/5781 [ 102.666159][ T5781] [ 102.668534][ T5781] CPU: 0 PID: 5781 Comm: syz-executor Not tainted syzkaller #0 [ 102.676503][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 102.690775][ T5781] Call Trace: [ 102.694201][ T5781] [ 102.697372][ T5781] dump_stack_lvl+0x18c/0x250 [ 102.702296][ T5781] ? __lock_acquire+0x7d80/0x7d80 [ 102.708230][ T5781] ? show_regs_print_info+0x20/0x20 [ 102.716829][ T5781] ? load_image+0x420/0x420 [ 102.719779][ T5954] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 102.722913][ T5781] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 102.722950][ T5781] ? __virt_addr_valid+0x10c/0x380 [ 102.722977][ T5781] ? __virt_addr_valid+0x10c/0x380 [ 102.722998][ T5781] ? __virt_addr_valid+0x10c/0x380 [ 102.723019][ T5781] ? __virt_addr_valid+0x10c/0x380 [ 102.723043][ T5781] print_report+0xa8/0x210 [ 102.723065][ T5781] ? nfsd_shutdown_threads+0x8d/0x1a0 [ 102.723087][ T5781] kasan_report+0x117/0x150 [ 102.723110][ T5781] ? nfsd_shutdown_threads+0x8d/0x1a0 [ 102.723208][ T5781] kasan_check_range+0x241/0x290 [ 102.723244][ T5781] nfsd_shutdown_threads+0x8d/0x1a0 [ 102.723268][ T5781] nfsd_umount+0x42/0xc0 [ 102.723299][ T5781] deactivate_locked_super+0x97/0x100 [ 102.723320][ T5781] cleanup_mnt+0x3d7/0x460 [ 102.723360][ T5781] task_work_run+0x1d4/0x260 [ 102.723386][ T5781] ? task_work_cancel+0x220/0x220 [ 102.821053][ T5781] ? exit_to_user_mode_loop+0x3b/0x110 [ 102.826656][ T5781] exit_to_user_mode_loop+0xe6/0x110 [ 102.832272][ T5781] exit_to_user_mode_prepare+0xee/0x180 [ 102.838258][ T5781] syscall_exit_to_user_mode+0x1a/0x50 [ 102.843834][ T5781] do_syscall_64+0x61/0xb0 [ 102.848382][ T5781] ? clear_bhb_loop+0x40/0x90 [ 102.853103][ T5781] ? clear_bhb_loop+0x40/0x90 [ 102.858011][ T5781] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 102.864400][ T5781] RIP: 0033:0x7fa46599f397 [ 102.869018][ T5781] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 102.889002][ T5781] RSP: 002b:00007ffdeed56778 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 102.897695][ T5781] RAX: 0000000000000000 RBX: 00007fa465a344bb RCX: 00007fa46599f397 [ 102.905706][ T5781] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdeed56830 [ 102.914187][ T5781] RBP: 00007ffdeed56830 R08: 00007ffdeed57830 R09: 00000000ffffffff [ 102.922364][ T5781] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdeed578c0 [ 102.930864][ T5781] R13: 00007fa465a344bb R14: 000000000001908a R15: 00007ffdeed57900 [ 102.939491][ T5781] [ 102.942714][ T5781] [ 102.945116][ T5781] Allocated by task 5951: [ 102.949457][ T5781] kasan_set_track+0x4e/0x70 [ 102.954497][ T5781] __kasan_kmalloc+0x8f/0xa0 [ 102.959328][ T5781] __svc_create+0x60/0xbb0 [ 102.964351][ T5781] svc_create_pooled+0x66a/0x7e0 [ 102.970535][ T5781] nfsd_create_serv+0x29f/0x5c0 [ 102.976160][ T5781] write_ports+0x698/0xfa0 [ 102.980979][ T5781] nfsctl_transaction_write+0x10c/0x150 [ 102.987351][ T5781] vfs_write+0x299/0x9a0 [ 102.992079][ T5781] ksys_write+0x151/0x260 [ 102.996619][ T5781] do_syscall_64+0x55/0xb0 [ 103.002017][ T5781] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.008838][ T5781] [ 103.011615][ T5781] Freed by task 5951: [ 103.015976][ T5781] kasan_set_track+0x4e/0x70 [ 103.020946][ T5781] kasan_save_free_info+0x28/0x40 [ 103.026169][ T5781] ____kasan_slab_free+0x126/0x1f0 [ 103.031934][ T5781] slab_free_freelist_hook+0x130/0x1a0 [ 103.038105][ T5781] __kmem_cache_free+0xba/0x1f0 [ 103.043082][ T5781] write_ports+0xb1a/0xfa0 [ 103.048301][ T5781] nfsctl_transaction_write+0x10c/0x150 [ 103.054569][ T5781] vfs_write+0x299/0x9a0 [ 103.059017][ T5781] ksys_write+0x151/0x260 [ 103.063659][ T5781] do_syscall_64+0x55/0xb0 [ 103.068125][ T5781] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.074311][ T5781] [ 103.076759][ T5781] The buggy address belongs to the object at ffff88802547c400 [ 103.076759][ T5781] which belongs to the cache kmalloc-512 of size 512 [ 103.091205][ T5781] The buggy address is located 80 bytes inside of [ 103.091205][ T5781] freed 512-byte region [ffff88802547c400, ffff88802547c600) [ 103.105712][ T5781] [ 103.108053][ T5781] The buggy address belongs to the physical page: [ 103.114590][ T5781] page:ffffea0000951f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2547c [ 103.125205][ T5781] head:ffffea0000951f00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 103.134798][ T5781] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 103.144145][ T5781] page_type: 0xffffffff() [ 103.149259][ T5781] raw: 00fff00000000840 ffff888017c41c80 0000000000000000 dead000000000001 [ 103.160058][ T5781] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 103.170852][ T5781] page dumped because: kasan: bad access detected [ 103.177577][ T5781] page_owner tracks the page as allocated [ 103.183519][ T5781] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1685, tgid 1685 (kworker/u4:5), ts 13802219864, free_ts 0 [ 103.206775][ T5781] post_alloc_hook+0x1c1/0x200 [ 103.211922][ T5781] get_page_from_freelist+0x2181/0x22a0 [ 103.217589][ T5781] __alloc_pages+0x1f0/0x460 [ 103.222439][ T5781] alloc_slab_page+0x5d/0x180 [ 103.227334][ T5781] new_slab+0x87/0x2d0 [ 103.231498][ T5781] ___slab_alloc+0xc5c/0x12f0 [ 103.236578][ T5781] __kmem_cache_alloc_node+0x11f/0x250 [ 103.242350][ T5781] kmalloc_trace+0x2a/0xe0 [ 103.246926][ T5781] alloc_bprm+0x56/0x9a0 [ 103.251377][ T5781] kernel_execve+0x98/0x980 [ 103.256245][ T5781] call_usermodehelper_exec_async+0x20b/0x350 [ 103.263283][ T5781] ret_from_fork+0x48/0x80 [ 103.268174][ T5781] ret_from_fork_asm+0x11/0x20 [ 103.273848][ T5781] page_owner free stack trace missing [ 103.279596][ T5781] [ 103.281961][ T5781] Memory state around the buggy address: [ 103.287605][ T5781] ffff88802547c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.298236][ T5781] ffff88802547c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 103.306516][ T5781] >ffff88802547c400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.315246][ T5781] ^ [ 103.321939][ T5781] ffff88802547c480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.330027][ T5781] ffff88802547c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 103.338281][ T5781] ================================================================== [ 103.354324][ T5781] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 103.361594][ T5781] CPU: 0 PID: 5781 Comm: syz-executor Not tainted syzkaller #0 [ 103.369267][ T5781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 103.379711][ T5781] Call Trace: [ 103.383378][ T5781] [ 103.386494][ T5781] dump_stack_lvl+0x18c/0x250 [ 103.392343][ T5781] ? show_regs_print_info+0x20/0x20 [ 103.398114][ T5781] ? load_image+0x420/0x420 [ 103.403210][ T5781] panic+0x2ca/0x720 [ 103.407145][ T5781] ? bpf_jit_dump+0xd0/0xd0 [ 103.411713][ T5781] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 103.417827][ T5781] ? _raw_spin_unlock+0x40/0x40 [ 103.422888][ T5781] ? print_memory_metadata+0x314/0x400 [ 103.428764][ T5781] ? nfsd_shutdown_threads+0x8d/0x1a0 [ 103.434371][ T5781] check_panic_on_warn+0x84/0xa0 [ 103.439804][ T5781] ? nfsd_shutdown_threads+0x8d/0x1a0 [ 103.445216][ T5781] end_report+0x6f/0x130 [ 103.449673][ T5781] kasan_report+0x128/0x150 [ 103.454324][ T5781] ? nfsd_shutdown_threads+0x8d/0x1a0 [ 103.460222][ T5781] kasan_check_range+0x241/0x290 [ 103.465427][ T5781] nfsd_shutdown_threads+0x8d/0x1a0 [ 103.470807][ T5781] nfsd_umount+0x42/0xc0 [ 103.475632][ T5781] deactivate_locked_super+0x97/0x100 [ 103.482267][ T5781] cleanup_mnt+0x3d7/0x460 [ 103.486850][ T5781] task_work_run+0x1d4/0x260 [ 103.491765][ T5781] ? task_work_cancel+0x220/0x220 [ 103.497436][ T5781] ? exit_to_user_mode_loop+0x3b/0x110 [ 103.503882][ T5781] exit_to_user_mode_loop+0xe6/0x110 [ 103.509573][ T5781] exit_to_user_mode_prepare+0xee/0x180 [ 103.515455][ T5781] syscall_exit_to_user_mode+0x1a/0x50 [ 103.521269][ T5781] do_syscall_64+0x61/0xb0 [ 103.525699][ T5781] ? clear_bhb_loop+0x40/0x90 [ 103.530387][ T5781] ? clear_bhb_loop+0x40/0x90 [ 103.535073][ T5781] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.541161][ T5781] RIP: 0033:0x7fa46599f397 [ 103.545689][ T5781] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 [ 103.565863][ T5781] RSP: 002b:00007ffdeed56778 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 103.574298][ T5781] RAX: 0000000000000000 RBX: 00007fa465a344bb RCX: 00007fa46599f397 [ 103.582455][ T5781] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdeed56830 [ 103.590519][ T5781] RBP: 00007ffdeed56830 R08: 00007ffdeed57830 R09: 00000000ffffffff [ 103.598583][ T5781] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdeed578c0 [ 103.606651][ T5781] R13: 00007fa465a344bb R14: 000000000001908a R15: 00007ffdeed57900 [ 103.614632][ T5781] [ 103.617959][ T5781] Kernel Offset: disabled [ 103.622288][ T5781] Rebooting in 86400 seconds..